Shimmers are the newest tool for stealing credit card info

cbc.ca

11 pointschaosmachine3 comments

How is this possible? Wasn't the point of chip cards to sign specific transactions using an internally stored secret? Or is it actually just an obtuse way to move a shared secret around?

What "tap" function is the author talking about?

I believe they're referring to "contactless" use. Here are the reference I found:

https://www.shopify.com/blog/36816197-emv-chip-cards-are-com...

Tap (Contactless)

Data between chip card and a payment terminal is exchanged wirelessly when the two come into contact. In most cases, the customer will be required to provide no verification for smaller transactions. New forms of mobile payments like Apple Pay will also work this way.

Here's another article describing it (and potential issues):

http://globalnews.ca/news/2295763/tap-and-pay-cards-its-fast...

I'm by no means an expert! I just used google. Clarification and corrections most welcome!

Reply on news.ycombinator.com