Hacker News Reader

Comment by gergles | Hacker News Reader

EMV has been trivially broken[1], and it unpopularly pushes the risk of fraud onto the customer. Customers in the US don't want that (especially since EMV is broken!). On top of that, there are a hell of a lot more merchants that would all need to purchase entirely new credit card terminals, which is a much larger undertaking in this country than it would be elsewhere.

[1] http://www.cl.cam.ac.uk/research/security/banking/nopin/oakl...

View on HN

The paper you have linked describes an attack that is only possible if the attacker has stolen the victim's physical card. I think the real security of EMV lies in the fact that cards cannot be cloned - this attack does not change that fact.

" In this paper we describe and demonstrate a protocol flaw which allows criminals to use a genuine card to make a payment without knowing the card’s PIN, and to remain undetected even when the merchant has an online connection to the banking network."

I wasn't even aware that the chipped cards _had_ PINs.

I think we can all agree that a chipped card + PIN is more secure than a magnetic strip card with no PIN. But, perhaps the reduction in fraud isn't worth the cost of replacing all the old gear.

That attack is far from trivial. There were other attacks against EMV in the past, but they're fixed as they come. Magnetic stripes stay vulnerable, and ATMs in the US are not that secure either (seriously, some of them can be stolen and taken home by one man alone). Securing chips is hard, but a lot of the process has already been figured out. What you should fear is the new RFID cards coming up soon. Those are even more vulnerable than magnetic stripes.

That's not trivial compared to magnetic stripe. I created a credit card reader with £2 of electronics, my laptop, and a freely available open-source program. (And I'm pretty dumb, so it's really easy)

What about the most vulnerable part of credit cards, the fact that the card information is printed right on the front (and back) of the card? Someone in line at the grocery store with a pen camera in their pocket can catch a glimpse of the front and back of a card. That is generally enough information to use the card online.

http://dilbert.com/strips/comic/1996-01-11/

How will you use that card information, though? The printed information isn't sufficient to create a new magnetic stripe (the CVV1 code in the magstripe isn't printed on the card). Using the card info online requires knowing the cardholder's address. If you can find someone still using an imprinter, then that would work, but so would completely made-up data.

> Using the card info online requires knowing the cardholder's address.

US (and Canada, UK) issued cards are verified against the billing address (AVS), in most cases. In other countries (e.g. Australia), this is not the case.

The card number and CVC are typically sufficient; you can put any other address you would like. My Amazon billing address is my work address, which is not the address my bank has (my home).

Interesting. Any idea why they don't verify the billing address there? Seems like it would be no harder than doing it in the US.

Reply on news.ycombinator.com