Hacker News Reader

Comment by cm2187 | Hacker News Reader

At this stage, if you have to pay the company that leaks your own data to prevent it from harming you, it starts to sound like protection racket.

View on HN

It is a protection racket that shifts the risks and costs from the financial system to consumers.

Same with chip and pin here in the UK

I have heard of no cases where liability has been shifted in that way.

There is strong evidence for it here: http://www.cl.cam.ac.uk/~sjm217/papers/oakland14chipandskim....

And regardless of whether you claim the evidence is inconclusive, it is simply not acceptable to dismiss a known vulnerability in something important by saying "I don't know of any case where it has been exploited yet."

Exactly. All it does as far as I can see is flag the transaction as card holder present. The PIN is easy to steal as well evidenced by the number of fake reader heads and cameras found attached to ATMs as well.

That's explicitly not what I said.

I know that flaws have and will continue to be discovered in those authentication systems, and also that a theoretical shift in liability occurs. Any bugs will need to be fixed, and that's important. But you can't ignore the situation in practice – liability is not being shifted, and all UK banks and credit card providers are pretty happy to refund fraudulent transactions regardless.

It is good to hear that UK banks are apparently no longer shifting liability, but this case, and others, show that banks were shifting liability until it was irrefutably demonstrated that the system was not as secure as they claimed. 'Liability shift' is not a term invented by conspiracy theorists: banks were explicit about this being a primary goal of EMV, so it does not require a leap of faith to accept that it happened. Sadly, neither is a leap of faith required in accepting that the banks' first response to evidence of weaknesses was to deny their exploitability.

Does your statement about UK banks no longer shifting liability apply in cases of fraud against merchants?

They only refund credit card transactions if suspected with fraudulent. Debit card transactions are held and investigated. I've had a card ripped and lost £500 permanently because the bank decided I had made the transaction. I had to small claims them to get it back. I have seen at least three other people lose against the bank.

At least you get the pin as well. We just have chip, and it does ~nothing.

Reply on news.ycombinator.com