Hacker News Reader

Comment by tn13 | Hacker News Reader

It feel the same about these modern chip based credit cards. While giving a totally intangible security benefit these cards have brought great discomfort to everyone. A swipe takes around 1 second to register. Chip based cards take anywhere from 5 to 9 seconds with the message "do not remove card" flashing in between. Machines are designed such that you have to insert card in a slit you cant see, I have seen elderly people struggle to do that and cards falling out on floor creating more delays.

I really wonder if the wasted human time is worth saving handful of frauds.

View on HN

To be honest: This is more based around the terminal designers, both hardware and software, than anything else. For far too long, the designers have been shit hardware and software while charging an insane premium. The cryptography required for processing chip transactions requires more horsepower yet the exact same hardware specs are being used.

Furthermore, the chip is not only protecting from cloned cards, but also protecting from the vast malware breeches that occurred at Target, Home Depot, and more.

The decision is right. The crap the processors are pulling with their terminal designs is not. The processing market is ripe for someone to break formation and accept smaller margins in return for a well designed and faster terminal.

Are you saying people who designed the secure chip card have no say in the terminal technology. I don't know the details but I suspect that the terminal also needs to have sufficient security mechanism isn't it ?

I still find it bizarre the USA is only just dealing with this - the UK and most of Europe moved to chip and PIN years ago, and are now increasingly rapidly moving to using contactless payments.

I was in Iceland 2 years ago, and I could not get fuel for my rental car anywhere with my chipless and PINless card, and had to pay a large amount of money to have the agency fill it. Even though the USA has finally started to roll out chip based cards, half the places I go to have the chip slot, but say to swipe instead. It is confusing. We also still do not have PINs so if your card is lost, it can still be used for fraud.

I'm American and I find it bizarre too.

What really baffles me is how inconsistent the rollout has been. Chip-capable terminals are everywhere, but maybe 3/4ths of them don't have the chip part enabled. So many times, I've inserted my card only to find that it simply doesn't work. Yesterday I made a purchase where they had taped over the slot so you wouldn't even try.

It seems like once you have the hardware, the rest should just work. I don't know what the hell is going on.

I was at a place the other day with a taped over chip slot, with a little note saying "please swipe". I asked what the deal was, and the guy said all chip purchases were being double billed (apparently due to some software issue). I commented, "at least they were being securely double billed". Chuckles all around.

Australia has had this for the last year or so. It's remarkable how far behind the U.S. has fallen on this issue.

I disagree - I'm in the UK where these have been standard for a long time (I've had cards for around 6 years or so, and I have only ever used the old swipe when travelling).

My experience is that it takes way less time (I'd say 3-4s, maybe it's a connectivity issue?), and (comparing to what I have done travelling and memories from watching my parents in childhood) any time you did save with a swipe is instantly eaten up by signing taking far longer than tapping in a pin (not to mention the magstripes wearing out faster than the pins).

As to 'saving a handful of frauds' - I was shocked at the ease of fraud in the old system. When I was in the US, I felt uncomfortable with the staff taking my card (here in the UK, it's always in my hands) - often taking it out of my sight, and a colleague had 'Please ask for ID' rather than a signature on his card - he never once got asked for it, implying that the signature check is valueless, because apparently no one does it.

The US doesn't have chip-and-pin, we have "chip-and-sign", plus the older magstripe system (and the CC number is still necessary for online purchases).

As of this spring update I'd estimate vendor uptake is about 30-50%. So half the time you either swipe and wait 2 seconds for it to beep that you need to insert, or you insert and wait a couple seconds for nothing to happen and be told to swipe. The chip mode is poorly integrated into many POS systems - at most local groceries even if you tap "card" and insert the card it will make you go back to the screen and push "card" again, or take several seconds before it accepts it. Then it processes for ~5 seconds, then you need to sign.

Some of this is teething issues with rollout and POS integration, but the signature is unfortunately not going away.

I'm sorry, but I'm having a hard time relating to this. In Sweden, we have had chip cards for a very long time (it feels like), and I've never heard anyone complain that it takes so much longer than swiping. I guess you're in a country where it is relatively new?

Could it be that your card readers are somehow worse compared to the ones we have here, which makes it more painful to use? Could it be that here we always use a PIN code as well, so that takes a bit of time anyway, and you do not?

GP is probably in the US, like me, where chip and PIN is pretty new. I can confirm that it tends to take a lot longer than swiping; I still do a lot of both swiping and chipping, so it's easy to compare.

In other countries, chip based credit cards have reduced in store fraud by about 75%. This is a lot more than a "handful of frauds".

That said, make one thing harder, they find another avenue in. I'm voting for cameras that read your physical card while it is in, then the fraud is conducted online. (Downside of that for thieves being that now they have to give out a working address.)

Does it allow the credit issuers just to shift the blame to the end-users and deny 75% of fraud claims where the user could not adequately prove they were not present at the time and place of the fraud?

No. The default in the USA is that consumers are not liable for anything that consumers claim they didn't buy, and the company can't prove they did.

The reason it reduces crime is that you can't make fake credit cards with data collected from a skimmer, and use them in stores. Your fake credit cards fail because they can't do the chip interaction. Therefore in store fraud is reduced to people physically stealing your credit card.

Why is this comment being down voted? This system is an embarrassment. The improved security measures are important but there's no excuse for it to come at a cost of a worsened user experience.

Reply on news.ycombinator.com