Old ladies paying with personal checks...

[MacLeod]

After reading Bruce Schneier's paper on EMV vulnerabilities, I am far less sold on them than I was before.

As Yoda said, it's an improvement, but when banks think they're completely foolproof and thus refuse to refund customers who report fraud, it's a net loser for customers.

I've had (non-EMV) credit cards compromised on multiple occasions thanks to lax POS security (thanks, Target!) and, presumably, online vendors who are careless with their systems. I'd really hate to be responsible for those kinds of charges.

I will say that it's pretty fucked up that EMV vendors are so lazy as to not take even basic cryptographical safeguards when implementing their systems. Unbelievable. They should be held criminally liable for that kind of negligence.

As you point out it's an improvement over the old style cards without a chip. The fact that some vendors are lax when it comes to cryptography is not a failing of the tech but of it's implemntation.

 

[Robert Maxwell]

After reading Bruce Schneier's paper on EMV vulnerabilities, I am far less sold on them than I was before.

As Yoda said, it's an improvement, but when banks think they're completely foolproof and thus refuse to refund customers who report fraud, it's a net loser for customers.

I've had (non-EMV) credit cards compromised on multiple occasions thanks to lax POS security (thanks, Target!) and, presumably, online vendors who are careless with their systems. I'd really hate to be responsible for those kinds of charges.

I will say that it's pretty fucked up that EMV vendors are so lazy as to not take even basic cryptographical safeguards when implementing their systems. Unbelievable. They should be held criminally liable for that kind of negligence.

As you point out it's an improvement over the old style cards without a chip. The fact that some vendors are lax when it comes to cryptography is not a failing of the tech but of it's implemntation.

It's a failure of accountability, too. These systems are presumably certified by some authority to ensure they comply with the standard. Clearly, non-compliant systems are being certified when they shouldn't be. It makes little sense to have a standard if it's not actually enforced properly.

 

[Mudd]

It beats standing in line behind a stripper paying for a week's worth of groceries for her whole family in ones.

You gotta shop where the successful strippers shop - faster to count tens.

 

[Mr. Laser Beam]

Surely better than standard magnetic strip cards from a raw security perspective, but not necessarily great or hack-proof.

I don't think anyone here has implied that chip-PIN cards are hack-PROOF, but the mere fact that they are more secure than magnetic-stripe and chip-signature cards is all the evidence we should need.

And any decent bank should still offer zero-liability protection even with chip-PIN cards. Zero liability is the absolute right of every bank customer. Any bank that doesn't offer that, go somewhere else.

 

[wulfio]

I know. I mean, I still have to write a check to pay my rent. I have no other means of paying my landlord. I would love to set something up so I could just pay him online.

I suppose I could mail him a wad of cash, but that seems ill-advised.

You can do E transfers. As far as I'm aware, all online banking supports this.

And I don't see why you wouldn't be able to do automatic transfers as well.

 

[Robert Maxwell]

US banks often charge outrageous fees to do interbank transfers.

 

[Sector 7]

In the last year, I have had to get new credit & debit cards thanks to Target & Home Depot; a new debit card because a "friend" stole the number & purchased Netflix and other items (bank & police are prosecuting); changed entire accounts because of same, including purchasing new checks again.

I have no faith that any system is secure more than another. They can all be hacked, stolen, etc.

 

[Yoda]

Chip/PIN cards can't be hacked, because the chip generates a one-time code for each transaction. So even if hackers get ahold of your PIN, they can't do anything with it.

I don't think anyone here has implied that chip-PIN cards are hack-PROOF, but the mere fact that they are more secure than magnetic-stripe and chip-signature cards is all the evidence we should need.

Anyway, ultimately I don't care one way or another that we're going to adopt Chip and PIN at some point, I just think it's funny that they screwed up their own security, and oversell the actual level of security it provides.

 

[Mr. Laser Beam]

Chip/PIN cards can't be hacked, because the chip generates a one-time code for each transaction. So even if hackers get ahold of your PIN, they can't do anything with it.

I don't think anyone here has implied that chip-PIN cards are hack-PROOF, but the mere fact that they are more secure than magnetic-stripe and chip-signature cards is all the evidence we should need.

Okay, you got me. Much apologizings for my shoddy thread-fu.

 

[MacLeod]

US banks often charge outrageous fees to do interbank transfers.

Transferring money from one bank to another is free in the UK.