Hacker News Reader

Comment by praptak | Hacker News Reader

> What else could be done simply?

A simple thing that is actually being done: ATMs pulling in the card with a randomly changing speed. This makes it very hard for the skimmer to get a reliable reading. The actual reading by the ATM is done during the second phase, inside the ATM.

View on HN

That's something companies like JPMC and Citi are doing. But there are tens of thousands of crappy Tranax deli-style ATMs out there that aren't going to change.

Interesting, I called my bank about this annoying "feature" and was told it is for security reasons, but never understood why (and they were unwilling or unable to inform me). Enlightening. This functionality is very common in Australia, at least in Sydney.

Perhaps the in-store machines are safer because it would be harder install and later retrieve the skimmer? Or, maybe an insider allows the skimmer to be installed? Aren't many small, retail ATMs owner-serviced, so no one with an incentive to audit would ever check it out?

Oh is that what it is? I have been wondering why my local Wells Fargo ATM was taking the card in in such a jerky fashion.

That's a good idea. But I guess it's only a matter of time (and feasibility) before they add an optical sensor to pick up the card speed. Or more low-tech: a rubber wheel.

Why does that make it harder? It's a row of bits sliding by, right? Why does the speed matter? (I'm not saying your wrong, I'm just wondering why it would help?)

The bits don't have "start of bit" nor "end of bit" marks. The only way the reader can know which impulse constitutes a bit is by timing.

There are a lot of credit card machines where the purchases swipes the card themselves. Since the speed that people swipe is going to be variable, it can't be too hard to read a card without knowing the speed. (Like, say, putting 10101010 at the beginning, which you could use for calibration) So I'm not sure how a random speed helps things. Maybe ATM bits aren't encoded like credit cards?

"Since the speed that people swipe is going to be variable, it can't be too hard to read a card without knowing the speed."

The speed just has to be fairly constant within a single swipe - then you can adjust for it. It usually is when humans do that - human hand has quite an inertia.

The security feature on ATMs makes it vary wildly within a single swipe.

Reply on news.ycombinator.com