Hacker News Reader

Comment by modeless | Hacker News Reader

I've just discovered another serious security hole! When you hand your credit card to a waiter, they can see the credit card number totally unencrypted with their eyes! Clearly the solution is to blind all waiters.

The truth is credit card "security" is a bad joke. The only real defense these days is the fact that every payment processor has extremely sensitive fraudulent transaction detection systems because of the consumer protection laws that put fraud liability on the card issuer instead of the consumer. The whole system is a relic from the days before the internet and the only way to fix it is to replace it with something better like NFC.

View on HN

This is the only relevant comment in this entire thread.

What's more, the 3-digit "security" code (pardon me, whilst I scoff) for these cards is printed on the card! If you hand someone your card, you're already saying that you trust them not to keep your card number and security code and submit false charges. The Square reader isn't making that process any harder or easier; it's totally irrelevant.

> fraud liability on the card issuer instead of the consumer

The law may have put it on the issuer, but the issuers just fob it off on the merchants.

> The truth is credit card "security" is a bad joke.

Word.

[EDIT:] Some additional thoughts: http://news.ycombinator.com/item?id=2305899l

The last part is the really sad thing. We have the technology to do it right now, but because credit cards are everywhere and better stuff isn't, there's no motion toward improvement.

The fundamental problem is that the credit card system works by requiring the customer to provide the merchant with all of the credentials necessary to make a transaction. We could have inexpensive devices that receive payment details, display them on cheap LCDs, and digitally sign them if the user confirms. Such a device would be about as complex as a pocket calculator, and as secure as any application of digital signatures. Nobody is moving on them because of the chicken/egg problem.

It's true that Square's service is no less secure than paying with a Verifone device, sliding your card through the checkout system of your corner store, or handing you card over to the waiter and having them walk away with it in a restaurant. There is one thing that Square has done in a new way though: The service that they are providing, together with their corporate identity, has done a remarkable job at moving the idea of accepting credit card payments from big retail to small businesses and even private people. While this is an admirable feat, it has has potentially dangerous impact on the users' perception of who is a trustworthy entity to hand their credit card to. Before Square, I would have never handed over my credit card to a private person that I am doing a one-time transaction with and that I will likely never meet again in my life. With Square's efforts, that emotional barrier is slowly being torn down. Of course, they are not actively telling me to "trust everyone", but it is an inevitable development that they are continuously pushing forward. Before square, a merchant (a person I would give my credit card to) was usually a person connected to a job in a business entity that was registered, had a (somewhat) fixed location and that was invested into building a long-lasting relationship with me and many other customers (= not interested at screwing me over by doing some credit card scam). None of this applies to an independent person with a square dongle in their iPhone but thanks to Square's efforts, customers feel more and more confident, handing a stranger over their cc for a quick transaction. This is where there is a problem. It doesn't have to do with Square's technical implementation. It has to do with the inevitable customer's change in attitude, which ultimately, Square is "responsible" for.

I don't know. Seriously, I don't-- so I'll ask.

I've read that people will attach skimmers to gas station pumps/etc to get card info, so I assume there's more to be skimmed than just credit card numbers. So if you have 1 waiter with a Square-skimmer (or any other kind) and another without, can the first one get any more fraud-ready data than the second?

> I assume there's more to be skimmed than just credit card numbers

As usual, Le Wik to the rescue: http://en.wikipedia.org/wiki/Magnetic_stripe_card#Financial_...

Looks like a skimmer will get you account number, name, expiration date, and some verification numbers.

> So if you have 1 waiter with a Square-skimmer (or any other kind) and another without, can the first one get any more fraud-ready data than the second?

No, if you give your card to a malicious waiter he can skim all of its data. Because you gave it to him.

This is a good point. The real security flaw is in the credit card itself, not the device reading it.

what this could mean for Square is that since there is no security in practice one could argue they should pay the higher fees applicable to card-not-present transactions or where the number has been entered manually rather than the typically lower rates with verified card presence.

in practice it will boil down to how much VISA/MC like Square. i cannot imagine they see this expansion of CC billing to a new kind of merchants as a bad thing.

Reply on news.ycombinator.com