Hacker News Reader

Comment by TaylorAlexander | Hacker News Reader

This is why I really like the added security of the new Apple magnetic wallet I got. The wallet holds your cards and attaches to the back of the phone using magnets. While the inside of the wallet is magnetically shielded, I’ve found it’s nearly impossible when actually handling the magnetic wallet not to accidentally pass the card past the outside of the magnetic wallet. I have found that my card no longer works in pure magstripe readers such as parking meters and other older devices. Having ruined my magnetic stripe, Apple has protected me from mag stripe attacks. An idea so bold, no one but Apple could have thought of the magnetic card wallet.

View on HN

Can't have a mag stripe vulnerability if there is no more mag stripe, such simple and elegant solution is tradition for Apple (can't have a broken home button when you don't have one!)

Mag stripe needs to die anyways. It is such a glaring security issue, I openly welcome any effort towards getting rid if it.

You must be in the US -- America is the only place where mag stripe still exists. Everyone else is using tap or chip and pin.

Do you mean that credit cards in other countries don't have magnetic stripes, or just that nobody uses them?

Living in Canada, there's basically no instance where we'd swipe our credit cards, but they've still got mag stripes; and when I visit the US, I sometimes have to swipe my card, and it does work to do so.

> Do you mean that credit cards in other countries don't have magnetic stripes, or just that nobody uses them?

I don't know about other countries, but a few days ago I got a new Visa card in France. It still has the magnetic stripe. I'm not sure if I've ever seen it used here, but a few years ago I think they were still in use in German gas stations (at least).

Some banks have a nice feature where they allow you to disable the magnetic strip of the card. I presume the information is still physically on the card, but they can somehow know that the payment was done that way and decline it.

I’m in the UK, my cards still have the stripes but in my entire life (I’m 27) I’ve never used it. I don’t even think the card payment terminals we have here have the reader for the stripe anymore.

In Europe, most still have the stripe, but often you can't do magstripe payments unless you enable it beforehand through your bank's app or similar (which is often temporary and disables itself again after 24 hours). I've only ever had to do that when travelling outside of Europe. Most terminals here can't even read the magstripe (and there are even some NFC-only ones).

The card brands are just now beginning the process of phasing out actually putting magstripes on the card. The USA will be a bit later, but over the next few years they’re going to start disappearing from cards.

You're right. Poor choice of words. I seem to recall it's around 2025ish where most cards won't have mag stripes. Mag stripes only exist today because of the US. Everyone else uses the chip for either chip and pin or tap.

To be fair, chips have a similar vulnerability; it's just limited to being exploited immediately rather than being stored and played back later.

So you mention lower in the thread that in fact you didn't get the new Apple magnetic wallet, but actually a 3rd party wallet and just assume Apple's will have the same problem.

That seems like a distinction worth mentioning, especially with the first comment on the article.

While it seems reasonable that Apple's wallet might have the same problem, you dont actually know.

Yes I didn’t realize how seriously people would view this until after I could no longer edit the comment. I mostly thought my story was funny. Though it is true that my Popwallet demagnetized my cards due to the ease with which once can accidentally contact the non shielded exterior of the magnetic wallet with the magnetic card. As I said down thread, apple intentionally designed a wallet that has to have relatively powerful magnets on the exterior. A lot of people in thread are claiming their apple wallet hasn’t demagnetized their cards, but they have not confirmed if they’ve accidentally contacted the magnetic exterior of the apple wallet with their card. Obviously the inside of the wallet is shielded and I don’t believe my card was demagnetized due to poor shielding, but by accidental contact with the magnetic face of the wallet during handling. Apple is clear in their marketing materials that the inside of their wallet is shielded, but they say nothing about risks associated with accidental card contact on the magnetic exterior of their wallet. And this is the situation of concern for me. Perhaps they use much weaker magnets than Popwallet, and you’re right that I can’t say for sure, but I suspect they still use reasonably powerful magnets and accidental contact with a magstripe on the magnetic side of their wallet could pose a problem for cards.

Your original comment was funny, and the ones making fun of you for the sort of important, uh, tweaked detail are also funny, so you are 2 for 2 if the intent was to be lighten hearts.

Snark about Apple's shortsightedness tends to land better when you're not literally lying about using their product.

The problem is with the system Apple designed. They have a small removable wallet with magnets on the back. While I’m using a Popwallet brand wallet with my iPhone, the way it is designed I don’t think the official wallet would be any different. It has to have one side with exposed magnets per Apple’s design, and when handling the removable wallet I’ve found myself accidentally touching the magnetic side with my card. I genuinely don’t think it would be different with the official wallet.

Well my thought on "pop sockets" is when one of your flagship products needs another product for people to hold it... some one f'd up and is not there anymore to call out the bs.

You don't actually need them to hold the phone though, just some people want to hold on to less of their phone to keep it on their hand. I personally just hold on to my phone with my own hand.

For one hand usability they kinda are a must for most people. I can manage. But still, I'm OG SE camp.

https://www.youtube.com/watch?v=9g0Mft1CQ7A

I do this and it gives me hand pain due to how I have to hold my pinky to steady the phone. I use the large phone model.

Perhaps the large phone is not for you, but rather for people with large hands.

People never complain that tiny devices are too small for their big hands — they correctly conclude that they're made for children or for adults with small hands. But for some reason people expect to be able to use huge phones and phablets with regular-sized hands, rather than accepting that they're intended to be comfortably held by people with huge hands, who find regular-sized phones too small.

dont let the haters get you down

I’ve had an Apple Wallet since they came out and never had any cards lose their magnetic strip. Same with my wife.

Yeah, OP clarified he was using another brands wallet lol. Weird to dunk on Apple implying they underengineer their products. Engineering and (probably) precision manufacturing some magnetic shield is exactly the kind of thing Apple would do.

From [0]:

According to Apple's site, "the leather wallet is shielded so it’s safe for credit cards." That shield protects both Low Coercivity (LoCo) and High Coercivity (HiCo) cards — which is a fancy way of saying how resistant something is from being demagnetized. So, LoCo cards are considered things like hotel keys and gift cards while credit cards fall under HiCo.

[0] https://mashable.com/article/apple-magsafe-iphone-wallet-dem...

Sorry if I wasn’t clear, but I’m saying that it’s easy when handling the small removable wallet to accidentally touch the non-shielded side of the wallet. Both my Popwallet and the Apple wallet have essentially the same design. A shielded pouch for credit cards, and a magnetic backing that attaches to the phone. The magnetic back cannot be shielded on the side that attaches to the phone, or it wouldn’t attach to the phone. The problem is not insufficient shielding on the inside of the wallet, the problem is the way apple designed the system. Apple designed a small removable wallet with magnets on one exterior face of the thing. When handling the magnetic wallet I’ve found myself accidentally touching my card to the unshielded side of the wallet. I think the way apple designed it, their solution is “don’t do that”, but it’s very easy to do.

You're holding it wrong.

>but it’s very easy to do.

Let a thousand blossoms bloom, I guess.

Those must have been some low-coercivity card stock. HiCo cards should be very resilient to this sort of thing.

Brand new Visa Debit card from Chase Bank. I’d have thought it was one of the good ones. I should say I’m actually not using the official Apple magnetic case but the Popwallet brand which includes a little finger holder thing. Perhaps they’re using more powerful magnets than apple.

> This is why I really like the added security of the new Apple magnetic wallet I got.

> I should say I’m actually not using the official Apple magnetic case but the Popwallet brand

I don't understand why you would start this comment thread with a false statement though.

A few reasons.

One, it is a light hearted comment. I’m mostly just having some fun. Two, I suspect that the official wallet would have the same problem. The point is that apple designed a system where the wallet has to have magnets in it. The official apple product documentation states that there are in fact magnets in their wallet. And yes, just like my Popwallet brand, the inside of Apple’s wallet is magnetically shielded. The issue comes when you are handling the small removable wallet and your cards together. If you place your card next to the side of the wallet with magnets, you’re exposing it to the magnet without any shielding to protect your card.

I don’t have an official Apple wallet to test, but Apple repeatedly makes the same claim as the Popwallet - that the inside of the wallet is shielded. I think the problem is that apple designed a system where cards and magnets are close together, and during handling it is easy to expose the card to the unshielded side. This is why I think it is appropriate to jab at apple.

> Two, I suspect that the official wallet would have the same problem.

But… it doesn’t.

Which problem? People are misunderstand me and thinking I am saying that the problem is poor magnetic shielding, aka that the cards when properly stored in the wallet are being demagnetized. But what I am saying is that when handling the wallet it is easy to accidentally touch the card to the outside of the wallet where the magnet is. Are you saying you can rub your cards on the outside of the magnetic wallet, on the magnet, and not demagnetize your cards? I’m still trying to determine whether people are talking about touching the card to the magnetic side of the wallet or they think I’m referring to putting the card in the wallet and having a failure due to poor shielding. I’m not talking about the latter.

>I should say I’m actually not using the official Apple magnetic case...

Thanks, I needed this laugh.

This is the type with the silver stripe printed on rather than embedded in the plastic?

It also wasn't actually a card with a magstripe. It may not have worked before, but it sure as hell didn't work after!

So your point about Apple, is in fact, not about Apple at all. Cool.

Thanks to Apple, I had a bean burrito this afternoon that upset my stomach.

Not sure why iPhone engineering didn’t anticipate this happening, but the flatulence kept my boss away so everything worked out.

I’m mostly having fun, but Apple’s official wallet also has magnets on the back. The point is apple designed a system where a small removable wallet needs to be handled with your cards. That’s apple’s system design. And I suspect that you would encounter the same issue with Apple’s official wallet. Just like my Popwallet apple says the inside of the wallet is shielded. But the outside cannot be shielded as it has to magnetically attach to the phone. So unless the apple wallet has much weaker magnets, in which case it would fall off the phone easily, then it’s going to have the same issue. The problem is with the system apple designed.

> The problem is with the system apple designed

Is it? Numerous people up and down this thread who do use the official one have told you they've not experienced it, so I'm not sure your assumption holds.

They’ve not experienced the issue when touching a magnetic card to the magnetic side of the wallet, or they’ve not experienced the issue when placing the card in the shielded section? Because what I’m saying is the former is unfortunately very easy to do, and that would be easy no matter which brand holder is used.

With just about everything either chip or tap now, is there any danger in just scratching out the mag stripe of my cards?

Some banks even disable the mag strip by default [1], in the UK at least, allowing you to turn it back on temporarily if you need to.

[1] https://monzo.com/help/monzo-card-pin/what-is-magstripe

The small number of places with older swipe only terminals. Or when the chip isn't working (Lowes has a stripe reader on the register if the main terminal isn't working; mainly used for gift cards though). And finally, an alert employee might not accept a damaged card.

I've seen a few people in the US mention "when the chip isn't working". I don't think I've encountered this... ever? Of course, when the merchant's only alternative is handling cash, maybe there's more incentive to keep the card machine in order

At best I've found chip reading to work about 60% of the time across a range of local merchants here. And now the debit card I have, which is less than a year old, has a chip which has completely quit working. Making it totally useless for the (thankfully small) number of merchants whose POS systems won't let you fall back to mag-stripe when the chip fails.

As far as I'm concerned, chip cards can get stuffed. They're utter shit in my experience.

That sounds like you are somehow mistreating them, or your local merchants use "special" terminals (or maybe your bank is just using crappy materials). I can’t even remember how long ago it was that swiping worked, but chips have never broken until I cut them for the replacement card, this is over 3 different banks.

That sounds like you are somehow mistreating them,

I don't think I am. All I do is take it out of my wallet, put in the reader, take it out, put it back in my wallet, lather, rinse, repeat.

or your local merchants use "special" terminals

That would make sense if we were talking about one merchant, or even just two. But I can go to Barnes & Noble, Lowes, Food Lion, the local corner gas station, Ace Hardware, it doesn't matter, I routinely find the chip readers less reliable than the magstripe reader. I can't explain it, but chips are tainted in my worldview at this point.

> "At best I've found chip reading to work about 60% of the time ... Making it totally useless for the (thankfully small) number of merchants whose POS systems won't let you fall back to mag-stripe"

Here in the UK, many (most?) new payment terminals don't have mag-stripe readers at all. And I expect banks will start issuing new cards without a magnetic strip in the near future, if they haven't done so already.

I agree that chip & pin isn't ideal, not just because of reliability issues but also because of the security risk of PIN disclosure. But thankfully contactless (incl. Apple Pay/Android Pay) has already replaced it for 99% of daily transactions.

But if your card's chip is broken, can't you just get your bank to send out a new one?

But if your card's chip is broken, can't you just get your bank to send out a new one?

Of course I can. But that means I have to stop and take time out of my day to call my bank and dick around with them. And then if the new card comes with a new number (I don't know if it will or not), and/or expiration date (that almost certainly will change), then I have to login to EVERY SINGLE ONE of the places online where I use that card for some kind of automatic payment and change the payment details. I'm extremely loathe to do that, because it's incredibly tedious and painful, and I always miss one anyway and wind up getting scary emails about how my account is about to be closed.

Sure, my hand will probably be forced on this sooner or later. But as it stands, I just haven't cared enough to deal with all of that.

It might depend on your bank, but if you request it, it should be possible for them to issue a new card on the same account without cancelling the old card.

Your new card will have a new number and expiry date, but the old one will remain valid.

In any case, these days my web browser remembers card numbers and fills them in automatically, so it’s really not such a big deal to update card numbers online.

It might depend on your bank, but if you request it, it should be possible for them to issue a new card on the same account without cancelling the old card.

That's a good point. I guess I should call them and see if that's an option. If so, that sounds like the best of both worlds.

I could also buy a phone that has NFC / tap to pay support, and link my card to Google Wallet and use that. An awful lot of the place I shop support that these days...

I had a similar experience, but a clerk at a gas station wiped the chip edge of the card down and it worked on reinsertion. No idea how not really visible dirty (maybe from my very old wallet) was contributing to chip read failures but I have a much higher success rate after copying this fix.

When it comes to dipping the chip, it can wear down after a lot of use and stop functioning. I've never run into a problem with tapping however.

Here's an example image from a NY Times story about chips wearing down:

https://i.imgur.com/XlKEBsc.jpg

The last card I replaced due to chip wear, the chip looked even worse than that.

That is a totally acceptable amount of wear.

I have chip malfunctions at least once per month. I assume there is dirt or debris in the terminal or on the chip.

I find it odd that they're so unreliable in the US given they're neither new nor complicated technology and have a decade of use in Europe before they even started gaining adoption in the US, but I'll take your word for it. I wonder what US card or terminal manufacturers are doing wrong for such a reliability difference

Chip payments occasionally had problems in Europe too. The chips on the cards, or the contacts on the terminals would get dirty or wear out or whatever. Contactless is much more reliable.

That's wild. We've had chips on our cards in Australia for gosh-knows how long at this point, and I honestly cannot remember the last time it failed.

Not that they're even used that often these days either: everything is just tap-and-go NFC payment now.

And I do mean everything!

Remember that the US is huge, diverse, and opinionated, and really struggles to realize "My experience isn't everyone's experience"

I've had the chip struggle like once in my life. That was on a card very near it's expiration date. Most people I see in the store have no problems with their payment method, and when I was a cashier in 2012, people seemed to have significantly more problems getting their magstripes to scan.

All of this is SUPER dependent on which flavor/brand of POS is popular around you, the effort your bank put into making a good implementation, and whether your local merchants actually put effort into running their business and keeping equipment maintained. Pretty much nothing in this discussion is generalizeable to all of the US other than "We were late to the party of chip cards"

I’ve had the readers at Home Depot occasionally fail to read my chip card. The last time it happened an employee told me that the readers were designed for slightly thicker cards than some banks are using and so don’t always make contact but if you lightly press down on the exposed end after you insert it that lifts the chip end up enough to be read.

I’ve had no problems with their readers since I started doing that.

Also, when you use self check in terminals at the airport, if you use your credit card for ID, it only works via swipe.

Credit card for ID?

This explains a lot.

It’s easy so people go with it. Otherwise you have to type things.

If you go anywhere where they hold a tab open, such as a bar, you can't do that with tap/chip. Not that that's a blocker, since worst case you do a bunch of single transactions, but it's an annoyance.

Every time I'm in the US I'm amazed that I have give my card to the waiter who gets the card to some place and gets its back after few mins.

Don't people have wireless terminals in the US like the rest of the world?

Tabs work just fine in europe where mag stripe payments have been phased out. You pay at the end in the pin terminal.

And in Canada. 99.9% of the time if the machine asks you to use the magstripe period there's something wrong and the payment isn't going to process regardless.

Originally I was thinking they could handle an open tab like a gas station — place a hold on the card for $X for an open tab. But then, the more I thought about it, I’m not sure I want to be the bartender that has to explain why there was a hold of $100 on a college kid’s debit card.

Sorry you can’t buy lunch, but the hold will get released in a few days, so it’s ok!

There’s got to be a better way…

You could just prepay $X. Then extend it every so often. Any remainder gets refunded at the end. Honestly, in Australia I have not swiped my CC in over a decade.

In some ways we are pretty spoiled here in Australia, with regards to fintech adoption. The local farmers markets either take cash or contactless (or both depending on the stall). Its the literal only remaining place that I visit that takes cash-only at some stalls. Everywhere else is all contactless, all the time.

I suppose so. But it still blows me away that doing basic everyday payments in the largest economy in the world is still so poor and their physical money is terrible.

> Sorry you can’t buy lunch, but the hold will get released in a few days, so it’s ok!

I've bought gas in France with a Monzo card and the pump was able to hold and release money immediately - ~150EUR hold initially, as soon as I put the pump down it adjusted to the real amount.

Seems like the tech to make this happen does exist, it's just a matter of not using a shitty bank.

If the merchant is closing out the preauth correctly, the remainder of the hold is released on the spot.

Do you not give them the card, then they swipe it once at the end and you get it back? How does a stripe affect that?

The whole "giving your card away" thing is so foreign to me (German). Fuck no, I’m not giving you my card. In restaurants and bars they either come by with their handheld terminal, or you go to the machine at the register and simply pay like in any other place.

America having invented the dining (later credit) card, we have some customs remaining from when they worked analog.

I understand why Germany, a poorer country which was late to electronic payments, wouldn't do this; I don't understand the hostility to it. But then, I'm American, we've been doing this longer than you've been alive.

> I understand why Germany, a poorer country which was late to electronic payments, wouldn't do this; I don't understand the hostility to it. But then, I'm American, we've been doing this longer than you've been alive.

You mean payments between banks that take two to three days within the country instead of a regulated maximum of 15 seconds across borders?

It's a shame you're so salty that the rest of the world has far overtaken the US. You may have been doing it "longer", but you've absolutely failed to iterate and are still stuck with obsolete technology that's rife with fraud, for which a more appropriate feeling than saltiness is shame.

Hey, if you are proud of your security issues, good for you :)

The chargeback is always there, in the background, keeping people honest, broadly speaking. I generally wave my watch at something and carry on with my day, due to the innovative work of Americans. I mean probably a few Germans at Apple, but they're Americans now, and that's what matters.

But having a clunky thing at home you stick your debit card in is okay too! I guess.

There are a large number of “smart” tab systems in use in US bars where the system retains your magnetic stripe data for the duration of your visit. You pass off your card, it is swiped and immediately returned. If you don’t settle your tab, it’s automatically settled with a pre-set tip using the stored track data. It’s convenient for bar owners and patrons as the bar doesn’t have leftover cards to deal with and the patron doesn’t have to retrace their steps to recover their forgotten card the next day.

Interesting, I haven't encountered such a system at UK bars/pubs. Either it's entirely pay-as-you-go (easy when everyone has contactless), or, at fancier places, they'll trust you to run a tab without taking a card up front.

> There are a large number of “smart” tab systems in use in US bars where the system retains your magnetic stripe data for the duration of your visit.

What a security nightmare.

More or less a security nightmare than a drawer or tray full of physical credit cards behind a busy bar at night, which is the alternative at US bars? I'd argue that time-shifting card data is actually safer, even if it is often against the merchant agreement.

I really haven't heard of much trouble caused by these systems - of course, they require magnetic stripes in general, which are a massive attack vector, but the bar use case specifically doesn't seem to cause additional issues that I'm aware of. There are so many lower-tech and easy ways to steal magnetic track data, like skimmers, that I don't think compromising bar-back point of sale systems is a particularly high priority for most criminals.

Anyway, this is probably just a small snapshot in time regardless, since once swiped-card transactions finally go away US bars will have to switch to the mobile terminal pay-as-you-go method anyway.

>Once swiped-card transactions finally go away US bars will have to switch to the mobile terminal pay-as-you-go method anyway.

Now you get it.

>> It’s convenient for bar owners and patrons

LOL. It's convenient for bar owners. Patrons doesn't give a shit about that.

Speak for yourself, I can't tell you how many times I've left my card at the bar because of an open tab. Nowadays I'll favor places that give me my card back when I open a tab.

When the alternative is “hold onto the card” and you have to track it down or order a new one, sure it’s more convenient for the customer too…

This is incorrect. All the bars here in maine have no trouble opening a tab, no matter what payment method you have, including cash.

Some establishments take your card as collateral, some actually swipe it into their system to keep track, but that's not that common.

>If you go anywhere where they hold a tab open, such as a bar, you can't do that with tap/chip

???

Yes you can. At least the bars around me have no problem with holding a tab with chip and/or tap. Maybe they just use newer terminals.

So many people here extrapolating a one time issue they once experienced to cover the whole 50 states of the union and all 330 million of us.

Why is that? Due to older machines used or something else?

Adding to that: do people use physical cards? (except older generation)

I don't remember when I last saw a person not taping with phone or watch.

Fred Myers (a grocery store) where I live doesn’t have NFC POSes in their self checkout kiosks, so I have to whip out my card to chip there. But otherwise I don’t usually use it (though I bring it just in case).

Lots of smaller stores have readers where either the tap or the chip is broken. I just went to one today and took out my card to insert the chip instead of using Google Pay.

Wow it never happened to me, then the reader is broken no cards worked one time it was and by a pure chance I had cash (which I don't carry normally).

One of the shops near me can only do tap reading on their reader as the chip isn't working. My debit card only has chip, no tap. But I can pay with Google Pay via my phone. The CVS near me the tap readers in the pharmacy don't work. But the chip readers do.

I can see how this is annoying, but I think I use the magstripe 1 time per year on average. Although, I could see it being used more often by bartenders and other merchants who take my card.

I live in the UK, and I don’t think I’ve used my mag stripe here once in the last decade. The only time I can remember using it was on a plane.

Even EMV contactless is designed to work offline. There's no need for the mag stripe at all anymore unless you encounter a truly ancient card terminal. The last time I remember encountering one was at a toll booth in Italy around 2011 or so. And the transaction was immediately declined by my UK bank!

I've always wondered: What happens if I use a paused/canceled card on a plane? Do I just get the item for free?

Yep, like this person who used that method to steal £25,000 worth of goods from airlines: https://www.manchestereveningnews.co.uk/news/greater-manches...

Transport for London works similarly for contactless payment card acceptance on the tube, buses, etc. Cards are authorised in offline mode, with transactions processed overnight at the end of each day.

But they also maintain an internal blacklist of declined cards, so the most you'll get away with is one day's travel around London. Per card.

Oh wow, that's taking things to another level.

Reply on news.ycombinator.com