Hacker News Reader

Hacker News

Comment by tpmx | Hacker News Reader

Full thread

tpmx

So most of my current cards (in Europe) have 3 interaction methods:

In order of decreasing readability/communication reliability:

1. Magnetic stripe

2. NFC

3. EMV

The EMV ("chip") method is the least insecure, but lately all of my cards have been started oxidating. And it seems like the pogo pins in almost all readers also started wearing out too. Chip reader failures have become very common lately.

It's very common that I have to both clean the card before using it and also bend it while pushing it into the reader to counteract the worn out pogo pins in the in-store reader. Super annoying.

NFC has been a saver, but because of the banks security risk (it's cleartext, after all) you can't really use it all of the time.

The magnetic stripe seems like it never seems to stop working. I've assumed I can't use it outside of my native country, though, perhaps incorrectly.

View on HN

NFC (EMV Mode) is partially encrypted and much more secure than magnetic stripe

I wasn't aware of that mode. Is there a way of figuring out if your card has NFC (EMV Mode), or is just blasting out the CC number/expiration date when powered up via induction?

Note that the CC number / expiration date are not used for contactless payment, and should not be enough to make a payment online.

Almost all NFC you find these days is going to be a form of EMV and is encrypted.

There was a form of contactless magstripe (MSD) that was not encrypted and has been phased out of usage as of like, late 2019 via card update bulletins.

I can't remember ever having paid using the magnetic stripe in Europe since 2010 (having been to Spain, Italy, France, Netherlands, Romania and living in Germany), before I didn't use a credit card at all since it wasn't very popular here.

Honestly curios: where (and when) did you make that observation?

I made that observation from using a loyalty card from a grocery chain that only has a magnetic stripe. ~10 years from the same card now.

(Sorry, this was unclear from the first iteration of the observation.)

Thanks for the clarification!

I’m young enough to literally never have paid by swiping.

Except for my exchange year in Texas.

Same here, but Britain introduced EMV cards in 2004 (France and I think Australia were earlier, but with the previous version).

So you can have never paid by swiping and be well over 30.

It's a wonder if you can actually pay by card in Germany :D They're hardcore cash users for some weird reason.

And yet you can pay with card nearly everywhere but in small kiosks.

>it's cleartext, after all

What do you mean by "cleartext" exactly ? When I pay using my card with NFC, it's not really cleartext.

Real-world demo: https://play.google.com/store/apps/details?id=com.github.dev...

Well… This kind of data you access with this app is not used to do contact-less payments.

Show me? (Genuinly curious; I'm not claiming to be an expert in this field.)

To echo my other comment: my chip broke on my debit card and the card refused to work with magstripe only (and it was broken in a way were the NFC thing also no longer functioned). So not sure if the magstripe has any functionality in the SEPA region based on that experience.

I think the magstripe is disabled in my region, I've never managed to use it on any of my cards. I tried testing it out to see if it even was functional. Surely they must work as I've heard quite a few stories of card skimmers...

There is definitely a card number on the magstripe on it, but i think you cannot make a transaction with it in the SEPA region. So you need to "clone" that card and make a transaction with it in a non SEPA region country and that is disabled by default on debit cards (not credit cards though).

Banks can reject magstripe use when it knows both the card and the card reader should have chip support.

I believe this is to help discourage downgrade attacks.

You can request a new card from your bank, you will get it probably within a week. Problems solved.

Sure, but it doesn't solve the worn out card EMV reader problem.

Huh, wherever I try to use a magnetic stripe, the terminal would ask me that I have to use the chip. Even if a transaction failed when I used the chip.

I have never had to use the mag stripe, ever. Failures happen sometimes with the chip as you mention, but it usually works on the second try.

Reply on news.ycombinator.com