Comment by halviti | Hacker News Reader

Comment by halviti | Hacker News Reader

Parent Full thread

The problem of tricking the reader will be solved in the US the same way the rest of the world solved the problem. You stop using magnetic stripes.

For the longest time, chip-and-pin readers in most european countries would let you just swipe the magnetic card if you didn't have a chip.. this allowed americans (and whoever else still uses this technology) to be able to shop when they travel.

Unfortunately a disproportionate amount of theft occurs by bypassing the chip-and-pin system. Many european countries and banks finally had enough and said "no more loopholes, chip-and-pin only" and set a date.

Lo and behold this spurred the US banks to finally start releasing chip-and-pin enabled cards, otherwise their clients would find themselves unable to buy things overseas.

The deadlines have come and went in my country, and today it is literally impossible to buy anything with just a magnetic stripe.

I imagine the US will solve the problem the same way.. by no longer allowing magnetic stripes to be used.

I can't claim to spend a ton of time in a huge variety of countries, but in the past year I've been to Iceland, England, Wales, Scotland, Italy, France, and New Zealand, and I can't remember anywhere I had to use the EMV chip in my credit cards except places like parking garages that didn't have the physical facility for a mag stripe swipe. Every retailer terminal could read a magstripe.

More annoyingly, whether I swiped or dipped, a signature was required. Except, again, where there was no way to sign (parking garages). Then, magically, my PIN was "good enough".

I went out of my way to get EMV cards last year due to upcoming trips, because I had only been overseas sporadically over the past decade and assumed that the magstripe was gone. It was not. If anything, merchants seemed more able to deal with them than 10 years ago, where I occasionally had a clerk who couldn't figure out whether to swipe extremely slowly, or quickly enough to set fire to the equipment.

You're a US resident with a US card?

As a UK resident with a UK card it's been a long time since I swiped or signed. I think you must have the "require signature always" bit set on your cards because someone in the issuing chain doesn't trust EMV.

IIRC, US uses chip and signature 99% of the time, not chip and pin.

I don't think I have a single card that supports pin.

You're correct. From my understanding, most issuers have determined that Chip and Signature is secure enough for the US market provided they support DDA. Both of my EMV cards do not even provide a way to create a PIN for them. It will most like be this way for a year or two.

Correct. I HAVE a PIN for purchasing, but the card is set to prefer signature so I end up having to sign unless I'm purchasing somewhere without signature capability (eg, an automated kiosk). And yeah, US resident, US card.

I live in Iceland, and it is not possible for me to buy anything with a magnetic stripe.

Here is the campaign that was ran by the largest payment processor letting everyone know the old system was going away. It was heavily advertised all over the country.

http://www.valitor.is/fyrirtaekjalausnir/pinnid-a-minnid/

Perhaps there is somehow an exception for foreign cards? But this is news to me, and seems like it defeats the entire purpose.

There usually is an exception for foreign cards because otherwise visiting American tourists can't buy anything. Your local card may not even have a magstripe any more, but until the US upgrades most places will keep their magstripe readers.

Perhaps your card marks the use of EMV as optional.

A European-issued card would deny use of the magstripe on an EMV reader. This could possibly by overridden by the cashier, but most won't have the authority to do this. (The merchant takes responsibility for fraud in this case.)

not sure where in the UK you were spending/shopping but I live in the UK and all card readers require chip and pin and there is no signature required. Whilst the readers have a swipe facility if your card has a chip you are required to use it. Perhaps because you were using an international card it allowed you to use the swipe facility although I have no idea why you would choose that as it is significantly slower.

It's the signature that's the slow part. The swipe takes, what, 1/4 second vs perhaps 2 seconds for the dip?

Reply on news.ycombinator.com