Hacker News Reader

Comment by rbobby | Hacker News Reader

Yet another reason why we can't have nice stuff. Sigh.

I have a two-factor auth device that requires that I physically activate it by touching it in a certain way. Why the hell aren't contactless credit/debit cards similar? Why should I need to keep them in a Faraday wallet when they shouldn't be active except in those few second windows when I explicitly want them to be?

There is no "point" to Contactless if you have to take the card out and touch it. At that point you may as well swipe it.

Contactless as an idea is probably ill-conceived though.

Its very, very convenient. More-so than cash.

1. I don't have to carry cash 2. I don't have to go to the bank to get cash 3. I don't have to count the cash when paying 4. No change to worry about. 5. Transaction logs via bank statement

The downside that this (OP) problem illustrates does need sorting and I was very sceptical of contactless before I used it, but its quite nice.

Most credit and debit cards are not contactless and can only be read when inserted into a reader. Why not use one of those?

These contactless cards can also be used on TFL (Transport for London) Underground entry points, directly debiting your bank account. There is no mechanical degradation associated with using a contactless card whereas in my experience swiping the mag-stripe is problematic.

However as many have pointed out, there are potentially a boat load of skimming issues.

In the UK, most new debit cards at least do have contactless payment. I'm not sure about credit cards, but it's probably the same.

I think the "point" of contactless is to make the transactions quicker. Where it used to (in the UK) take 30 seconds to put your card in the chip and pin machine, enter your pin number and wait for the transaction to be confirmed, now its literally 3 seconds. Over the course of a year that is a massive time saving for the retailer and so a cost saving (less staff).

With chip and pin the customer was liable for all transactions when their pin number was used. It was your responsibility to ensure it wasn't exposed.

Now with contactless there is no risk to the customer, the bank/retailer takes on the full risk of fraud for contactless payments. You will not be out of pocket for a fraudulent contactless transaction. This is why contactless transaction are limited to £30 (initially was £20), it limits the bank/retailers potential exposure to contactless fraud, its also handily set to just about the average card transaction in the UK.

Interesting. In the US most businesses use magnetic stripe readers which take ~1 second from swipe to approval.

We stopped using that for lack of security, plus I think signing the receipt (and carbon copy) is time consuming, right?

I don't do much legacy brick and mortar CC shopping anymore, but it seems completely random at Home Depot and Target if they want my signature or not. Maybe after X transactions in the last Y days they no longer need a sig. With a possible side dish of Z percent or lower of transactions are fraudulent from this store.

You can use swipe in some places in the UK, but then you have to wait for the receipt to print, the cashier to find a pen, you have to sign it and the cashier has to verify it, click on the terminal that they did, and get a final receipt printed. It's even more hassle than typing in a pin.

But then you usually have to sign as well. Chip and PIN transactions don't need a signature, and in my experience the total time to swipe+sign is about the same same as insert+pin.

Contactless payments don't need a signature or a PIN, so they're significantly quicker.

I rarely if ever have to sign for a purchase under $25.

In that sense, wouldn't it be just as easy to insert the card into a POS device and supply the PIN?

The point of contactless is to make it less bother to use cards. One of the tradeoffs for that is reducing the security – it's sort of a necessary condition. Losses are limited to maybe £150 in the UK (that's 5 transactions at the maximum of £30) without further authentication, and it's virtually certain that the card provider will refund these transactions too if your card is used without authorisation.

It's significantly easier to simply touch the card than to have to insert it into a device that provides a keypad, and then type a PIN into said keypad. The keypad approach is safer though, and I'd prefer that for lots of situations, but there's no situation in which I'd want to be able to have money leave my card without me at least touching the damn thing to activate it.

Yes, but the reason isn't what you suggest it is. The reason is that people like the OP on Facebook, whoever posted it here, and whoever up-voting it, are happy to feed the fear of strangers by propagating these kinds of stories. This story will probably make it into the tabloids tomorrow thanks to having gone viral.

A lie gets halfway around the world before the truth has a chance to get its pants on.

Contact less payments without verification is certanly not "nice stuff" but simply negligently and stupid.

Its nice because it makes payments significantly faster especially for small transactions.

When your in a busy shop getting lunch, or a bar, it saves a significant amount of time and effort.

It does save you some time, but is this time worth the security downgrade?

I guess it is up to each person to answer this question.

The main issue I have with this is that no one gave me a choice : I received my card with this feature turned on and absolutely no way to have a card without it (I asked at the bank).

I changed banks about things like this. My bank once thought that i have to have Online Banking with my account, while all i wanted (and still do) is absolutely no remote access except with the debit card. They also told me that their eTan is much safer than the classic Tan system via post so they stopped it.

I really think less is more when it goes about the safety of my money.

When it comes to my money, i want safe. not convenient.

Honestly i have the few extra seconds. My security and peace are fully worth that.

Also we have fingerprint scanners on android now. So contactless plus verification is not a issue at all.

Contactless without verification is just lazy. There is really nothing to argue.

If speed was a priority at restaurants, nobody would ever eat anything but McDonalds. Apparently speed is not the highest priority for food, at least for most people most of the time.

At more traditional retail, the cost of going to Target retail store is fifteen minutes rounding up the kids, sitting in the car for thirty minutes round trip, wandering thru parking lots and aisles for a half hour, waiting in line fifteen minutes, after ninety minutes of time a couple seconds at payment are a rounding error. If I'm in a hurry and not willing to invest ninety minutes to buy a frying pan, I can pull my phone out and amazon can deliver it with an investment of perhaps three minutes.

Contactless solves A problem, unfortunately its the wrong problem.

The implementation of these is deliberately intended to make it less effort for small transactions. The risk of fraud is relatively low, the scope limited, and the impact minimal.

Contactless providers have obviously made the decision that the risk of fraud and the associated costs will be lower than the additional revenue received be encouraging people to use contactless cards more. In contrast to being negligent and stupid, it's actually pretty thoroughly thought-out.

And who pays for the fraud? The consumer. Thats already a huge issue with credit cards, if this now gets normal as well...

I am so glad nobody looks strange in my country when you pay with cash. Most people do, its efficient, depending on the currency fast enough, has privacy in mind and is as safe as myself.

Only in an indirect sense. AFAIK all UK banks will reimburse any fraudulent transactions; they've decided that the increased use is worth more than the costs of fraudulent transactions.

Obviously the public feels there is a benefit using contactless cards over cash, or we wouldn't be using them.

And that's why the value of the transaction is limited

Reply on news.ycombinator.com