Hacker News Reader

Comment by samwillis | Hacker News Reader

I don't think Square can come to the UK in their current form. The card reader, although could technically work, will not be allowed by the credit card companies here. Square would need to make a small chip and pin reader for phones, similar to what PayPal have done.

Are confusing Square with Stripe? If so I am in the beta and its brilliant. You can get in the beta by emailing them.

View on HN

And you can't 'just' have a small chip reader. The PIN can only be entered in hardware, so you end up with something ridiculous like this http://www.ingenico.com/en/products/payment-terminals/mobili...

This is curious, why can it only be entered in hardware? Is it a safety precaution?

You need control of the hardware to insure security. Think about what you could do if you run the credit card verification software in a debugger.

Yes, if the pin number is entered into the software running on the phone then that software can easily be changed to log people pin numbers.

True, but eventually the hardware PIN has to become a software PIN that will be transmitted. Why is it more difficult to sniff out hardware PINs?

The PIN is only transmitted to the chip embedded in the card. If the PIN matches, the smart card chip authorizes the transaction. So the PIN is never transmitted to the card processor, just the authorization message from the card. They only allow specialized tamper-proof terminals for Chip and PIN cards as that's the only place you could sniff the PIN.

I was indeed confusing the two! Thanks!

Reply on news.ycombinator.com