Hacker News Reader

Comment by ljd | Hacker News Reader

Chip & Pin [0] as well online authentication challenges such as 3-D Secure [1] have already solved these issues but the United States has been slow to picking them up.

[0] http://en.wikipedia.org/wiki/Chip_and_PIN [1] http://en.wikipedia.org/wiki/3-D_Secure

View on HN

Chip and Pin has already been attacked successfully.

https://www.cl.cam.ac.uk/research/security/banking/relay/

With that attack, it's super-easy to catch the criminals (both the merchants should know who they hired). With mag-strip hacks, you can anonymously attach a skimmer anywhere that broadcasts the information to wherever you are at a safe distance. Huge difference in security.

edit: for the record, I believe EMV should be upgraded to put a display and PIN pad on the card itself

It seems like yet another bandage on the current model, no?

http://en.wikipedia.org/wiki/EMV#Vulnerabilities

It may have some vulnerabilities, however the biggest vulnerability is still the backwards compatible magnetic stripe

EMV is a more secure than a trivially copyable magnetic stripe.

And 3-D Secure is a JOKE.

So for pin, you really only need to hack the keyboard right? Either malware in existing one or setup a fake? Is it really that more secure than magnet strip then? I.e. if you have access to install a malicious strip reader, you surely can get access to pin keyboard?

The magstripe reader hack lets you copy the data using the magstripe and then replay it at any other mechant.

When you hack a PIN keyboard, all the transactions will still go through the merchant's account, and it's easy to catch the thief.

You only forgot about the chip. It is very difficult to copy, and may even be impossible.

Yes, there are pin readers, either a fake keyboard or a camera.

Some implementations of 3D secure are better than others. For instance, one of my banks uses a challenge/response system with a separate physical card reader http://farm4.staticflickr.com/3237/2486214902_8feafd8200_b.j...

Reply on news.ycombinator.com