Hacker News Reader

> You wouldn't depend on technical know-how, you'd roll it into a card or something like that. Chip & pin cards already do all of this.

https://arstechnica.com/tech-policy/2015/10/how-a-criminal-r...

View on HN

This attack doesn’t work with smart cards that basically do nothing but act as a HSM. The MITM attack works with a loophole in some EMV cards because the card isn’t signing a transaction request but just saying “PIN is good!”

If your card holds a private key and won’t sign anything without also being fed a correct PIN you’d need a proper exploit of the application on the card to defeat it.

Reply on news.ycombinator.com