Hacker News Reader

Comment by RussianCow | Hacker News Reader

EMV chips more or less solve this problem, though, they just haven't caught on here in the US yet.

They're slow though. EMV is being rolled out in the US and it will fail because it's slower than a swipe or a tap.

When chip+pin rolled out in the UK, it noticeably sped up checkouts, it is certainly faster than signing.

The US does a lot of swipe+pin or just swipe, but the EMV process itself takes a long time (regardless of a PIN or signing afterwards):

http://www.lowcards.com/emv-transactions-slow-37884

Compared to Apple/Android Pay it's painfully slow, but it's also noticeably slower than swiping.

That page is just plain wrong. You can put the card into a reader, type your PIN in, and get your card back almost straight away. 5 seconds is possible if you don't forget your PIN!

The process can be slower if the retailer uses an older system that hasn't got a permanent network connection. With some ancient terminals, you could hear a modem dialing up and talking to the bank. That was slow, but luckily those kind of terminals are now rare.

This is anecdotal, of course - but it's been much slower than swiping at every store I've used it at. These stores were using the exact same terminals for swiping just a few months ago, so it's not the network. Hopefully it's just crappy hardware in the terminals that's not optimized for EMV.

Edit: Swiping used to take 1-2 seconds to process, EMV seems to take about 10.

That page is specifically talking about EMV in the US, and for whatever reason, I've never seen a EMV 'dip' that takes less than 5-10 seconds here. Target for example has consistently been around 10 seconds every time I've used EMV there and I doubt they are using dial-up.

I've yet to have to put in a pin when I've used my chipped credit card in the US. In fact, I don't even know what the pins are on my credit card, just my debit/atm card.

Worse yet, not all the chip enabled readers have the chip part enabled. So you can stick your card in, wait, and then realize you have to swipe. Otherwise, you swipe, get the suprisingly aggressive BZZZRT sound, and then use the chip reader and wait at least 5 seconds while it authenticates.

I'll time it at the local Target. It's slow.

It's not wrong, it really is slow. It may be different in other places, but in the US it is slow. Still depends on the store (besides network connections there are tons of different hardware setups), but it is never as fast as swiping.

In terms of speed from fastest to slowest: Apple/Adroid, swipe, swipe and sign, swipe and PIN, dip and sign.

When swiping, my process is: swipe, put card back in wallet, put wallet back in pocket, wait for transaction to complete, go. (About 90% of my card transactions don't require a signature, because they're below the threshold for that.)

When using a chip, my process is: insert card, wait for transaction to complete, remove card, put everything away, go.

You'll notice that putting stuff away happens in parallel with the transaction in the first case, but they're in series in the second case.

It may be reasonably quick, but it's still noticeably slower than swiping. It's not a big deal, but it's just one of those little annoyances.

Yup. Comment below yours says EMV is fast, but it's just not. You need to stand there and wait with your card in the read for for the processing step. Maybe not 5 seconds, but a non-trivial amount of time. With a swipe, you'd have your card back in your wallet as the authentication was completing.

If we had chip+pin it would be a different story, but because we have to sign, the EMV+sign process is slower than swipe+sign.

In many places in USA, chip cards take significantly longer than swiping - like 10-30 seconds.

It's really astonishing that the credit card companies thought that mandating a much slower process was going to work. Should be a huge boon for Apple/Android Pay though.

What's astonishing is how far behind the rest of the world the US is in adopting the technology.

That's a problem with being first adopter: the considerable investment in early infrastructure leaves you with early infrastructure which is hard & expensive to replace, contrasted with later adopters who take advantage of scale, lessons, and bypassing incremental steps.

What is the purpose of the signature, anyways? Mine never looks anywhere close to the same as before, and most of the readers at the bad grocery store next to my apartment just select seemingly random pixels anyways when you touch it.

Is this seriously a security measure? Even if it did matter, it's on the back of the card anyways, for someone to copy!

Why not just get rid of it?

It won't fail, because the card companies want it and you aren't going to be given the option to swipe.

The US is way behind on this, it's ridiculous.

So is chip + signature, but that's a different argument.

All of my credit card companies and banks issued me new "chipped" cards within a month or so without my request, so I am guessing they are tryingto take it serious now

FWIW, the transaction time using the chip to authorize vs apple pay is night and day. The Apple pay swipe is quick and you can put the phone back in your pocket. The chip card has to linger through the authorization process and makes the whole thing feel slow.

EMV liability shift is why both banks and retailers suddenly got serious: http://www.emv-connection.com/understanding-the-2015-u-s-fra...

The funny part with those chips in the US is that on most terminals I've used you can just click "Yes" instead of entering your PIN number. This gives you the option to sign for it. So it really doesn't solve the problem at all.

Afaik you can't do that in Europe. At least I've never heard of it being possible.

That's one issue. I still cannot seem to get my mind around another, though.

Conceptually, I don't grasp how possibly exposing my PIN number at a point of sale is MORE secure. I just can't get past the idea that I'm now using the number I use to withdraw funds at an ATM at MORE places than just at my bank.

I've always had to enter my PIN when using my card...so I don't see it as any LESS secure.

I doubt it will take much for you to get past it.

You're not exposing the PIN number. Properly designed card readers make the dialpad hard to read for anyone looking over your shoulders (you obscure it with your hand and there's a guard thingy around so they can't see your fingers).

And the machine itself checks the PIN against the chip. No sending anywhere, no checking by the clerk.

You only have to trust the machine itself. If you don't, you're fucked anyway because who says a hacked machine will only charge as much as it says it will?

Card+signature is security by "something you have", Card+PIN is "something you have and something you know". That's much more secure.

A signature isn't "something you know" because it's written on the card anyway. If it's not written on the card, then using the signature doesn't do anything in the first place. And nobody checks those signatures anyway. This is why for large purchases they ask to see your ID.

If you don't, you're fucked anyway because who says a hacked machine will only charge as much as it says it will?

If a machine charged you too much, either it would say so on the receipt and you could protest immediately, or the receipt wouldn't match the charge so you could protest later. Sure, the first few customers might get fucked, but soon the bad machine would be caught. OTOH if the machine processed the current transaction correctly while sending all your codes to the bad guys, it could do so until the store noticed its bad firmware, which could take years.

So really it's just a matter of how sophisticated the hackers are. Add keylogger to get PINs. Add thug to get cards. Win.

There's no way around trusting the machine itself.

If someone physically steals a credit card, it's quite obvious to the owner of the card, and they can have it cancelled.

> OTOH if the machine processed the current transaction correctly while sending all your codes to the bad guys, it could do so until the store noticed its bad firmware, which could take years

Banks already correlate fraud reports to where customers have used their cards to track down offending stores that skim cards. They don't have to find the bad firmware, they just have to see "well 10 customers had their cards skimmed, and the only store they had in common was that one"

Credit cards get skimmed by altered machines all the time, trusting the machine is the sketchy part. The nice part with mobile payments is you only have to trust your device. I'm pretty sure a mobster hasn't found my phone in the middle of the night and altered it. I am not so sure about a POS terminal at any random store. Target's POS got owned, why should I trust anyone else?

If someone hacked the terminal I use for an Apple Pay transaction what exactly would happen? It's a one time token that gets passed to the terminal and I immediately get a push update about the transaction.

Your PIN is actually checked locally by the card before it signs the transaction. Sure, you're vulnerable to a POS system stealing your PIN, but they can't really do anything with it unless they also have your card's private key, which is pretty much impossible to get off the card without destroying it. This is a huge improvement over what it was before, where you only had to copy the mag stripe info to clone the card.

Someone can take that PIN and the magstripe data obtained from the card and use it to withdraw your money from ATMs that don't support Chip and PIN.

Which is why we need to get this adoption completed ASAP so we can eliminate the magstripes on our cards.

There is EMV & Sign mode, and EMV & PIN mode, and it's set on the card and marked as 2 different transactions types by the bank.

Most american banks are issuing EMV & Sign cards, which means no PIN. You can set a PIN, but it's not a default flow and you have to call in to get it set.

That's because US EMV is Chip+Signature not Chip+PIN (which is pretty stupid, why not go all out). Properly written readers should go directly to signature entry and bypass the PIN screen altogether since IIRC there's a flag on the card which tells it if it supports PIN or Signature.

You can do that with EMV terminals in Europe. I've done it repeatedly in Sweden. You hit the yellow button labeled "Signature" and they'll want to see an ID before they accept the signature.

And we're Chip+PIN here in general. But all merchants provide the Chip+Signature option.

Iceland just started requiring PINs earlier this year.

Our chip & pin does signature authorisation but the bank charges about 5 times the normal transaction rate.

Reply on news.ycombinator.com