Hacker News Reader

Comment by cbhl | Hacker News Reader

Considering how expensive point-of-sale systems are, I'm not surprised that these systems are running old, vulnerable software. Heck, there are still ATMs running OS/2 Warp in the United States; the only reason people don't hack those is because it's so obscure.

My father still uses a small pre-computer cash register to this day; I've had no luck convincing him to buy a new computerized one so he can accept credit cards.

View on HN

I'm surprised these PoS systems aren't managed with automatic updates, since the merchant service providers (along with the banks) are usually the ones losing money if they get hit with chargebacks.

In europe typical deployment solves this problem (EMV is quite orthogonal to this) by the fact that card data does not touch the PoS system itself. In fact any other approach is not feasible as PoS systems themselves are invariably horrible mess of accumulated kludges and backward compatibility restrictions. And there are quite powerful economic incentives to keep this state of things. Security-wise this is one of the few situations where semi-air-gapped network makes sense (for the PoS part, with card terminals having their separate network).

> I've had no luck convincing him to buy a new computerized one so he can accept credit cards

You can still accept credit cards without a new register. It's just a different machine. They don't have to be integrated.

Almost every single doctor's office accepts credit card and exactly NONE of them have a register.

The way it works is you charge the card on a separate machine, type in the total, have them sign and put the slip somewhere and press "paid with credit" on the register if it is computerized or if it isn't then just ignore the register for that transaction.

Reply on news.ycombinator.com