Hacker News Reader

Comment by notJim | Hacker News Reader

A big part of this is that apparently US credit card companies decided not to include contactless when they switched over to chip cards, in order to save money. Ironically, contactless was becoming fairly common before the move to EMV, but is now pretty rare. I think about half my cards had it a few years ago, but now none do.

View on HN

Contactless is all over the US but is rarely advertised and retail employees tend to tell me to “insert my chip.”

Weirdly enough, I have visited a US retailer that did not have working chip, but working contactless.

I wonder if contactless will also gain favor as being less likely to spread disease.

If you just wave the authentication device, it is less likely to communicate surface contamination.

Especially compared to cash currency, I’m sure this must be true.

Considering how frequently people use their devices while sitting on a toilet, I'm not so sure.

That doesn't matter, though. No one else touches the device.

You put your device down in public areas. You touch your nasty device and then touch other people, their desks, door handles, and on and on and on. The germs don't magically stay on the device.

The point is no one else touches my device or credit card, and I don't touch the terminal.

All my credits cards(Amex and Chase) support contactless and work at most stores. Most people don’t know about it.

It’s coming back quite quickly.

I had an old Amex card that had it but nobody had the readers at the time. Then the readers appeared about 3-5 years ago but the contactless cards had been mostly withdrawn. Now they’re coming back, my most recently issued Amex and Chase cards in the last year or so have been contactless.

Contactless is also a security concern on actual cards. It only stores a single number (like the stripe, unlike the chips or phone-based NFC), and it effectively "broadcasts" it in a radius of a couple of inches. Very easy to skim even while it's still in your pocket.

Much better to use contactless from your iphone. You don't broadcast it, it's via bluetooth and only lasts for a few seconds.

And isn't your actual credit card number

> it's via bluetooth

NFC (same as contactless CCs), not Bluetooth.

Oh my... I don't even know why I wrote Bluetooth. Of course it's NFC. There are some similarities, but it's obviously two different protocols. I stand corrected.

my contactless cards need a PIN when used for significant money, don't they all? Is skimming a major issue?

I don't know what qualifies as "significant", but I've used contactless on my actual card a handful of times and never needed a PIN

At least in the UK, contactless is limited to 20£ and probably has other limits as well I suspect.

£30 currently. Though mobile payments don’t fall foul of this in theory, in practice some terminals are limited to £30 to match the card limit, which can be annoying when you want to pay by mobile (the most secure way).

> £30 currently. Though mobile payments don’t fall foul of this in theory

I believe Apple Pay supports payments >£30 but I use Android Pay and it has never allowed me to exceed £30. I understand that it is probably a limitation of the terminal in many cases but I have observed an Apple Pay transation exceed £30 and then been rejected by my Android Pay device on the same terminal in one case.

Think it's a limitation of the issuer. I use my Hong Kong contactless card all the time for transactions up to 100GBP (the HK$1000 limit set by my bank) and the terminals just accept it.

Not sure where you are or why you experience this - I've made £300+ payments on my phone for sure (car service) and I think I might have done one close to £1000 at one point.

I regularly do payments >£30 with Android Pay. I'm not even sure where the limit is. It is probably an issuer limit.

>in practice some terminals are limited to £30 to match the card limit

Mostly the fault of a cheap implementation from my understanding as they them don't have the data required to verify the CDCVM.

£30 in the UK, and PIN is required 'occasionally'

https://www.barclays.co.uk/current-accounts/debit-cards/cont...

As mentioned by others, the limit was raised to £30 over 4 years ago. Although, there is SCA (Strong Customer Authentication) regulation in the pipeline. I received an alert from at least two providers last year, albeit it does not apply to Apple Pay or Google Pay. However, due to Brexit, it remains to seen, if the banks will continue to implement it, or maybe change it to fit a new framework or renege on this pledge entirely.

Every time you make payments totalling €150 (£127) since you last entered your PIN, the contactless transaction will be declined. And a payment will be declined every time you’ve made five contactless payments in a row.

https://www.telegraph.co.uk/technology/2020/02/06/new-europe...

I wonder what that meansーーwill you get an actual rejection or some sort of ‘downgrade’ workflow where you’ll be prompted to swipe? Or will I just look like a broke dude semi-randomly?

Probably the same thing it does now randomly. The reader says "Please use chip and PIN" then you follow the chip and PIN flow which automatically unlocks your card.

It will tell the terminal to demand a PIN, just as if you had inserted the card. It happening regularly will make the flow non-weird, at least.

For my cards (Italian visa and Hungarian MasterCard) I think it's 25EUR/5000HUF, above that you need a PIN.

Depends on card issuer, jurisdiction, retailer, security heuristics, etc.

Most of my cards have a $100 contactless limit for most retailers. Costco gets $200.

> It only stores a single number (like the stripe, unlike the chips or phone-based NFC), and it effectively "broadcasts" it in a radius of a couple of inches

This is only for magstripe-emulation contactless, which is very regrettably a thing, thanks United States! The civilised world uses true EMV contactless.

Edit: Huh, even the US will be forced to use EMV contactless soon, apparently. Makes sense that Visa and Mastercard wouldn't want to support that massive fraud risk for long.

From a quick search, it sounds like "EMV contactless" means the NFC circuit follows the same procedure as "the chip" instead of the same procedure as the magstripe? If so, that would indeed solve the problem

Yes, exactly.

>Very easy to skim even while it's still in your pocket

Do you have any details on that?

From my understanding skimming is mostly an issue for magstripe, as contactless (at least in the proper EMV implementation) is cryptographically secured. There is not much to skim.

I'm aware of a few papers on relay or downgrade attacks, but I would consider them mostly of theoretical relevance (e.g. https://www.usenix.org/system/files/conference/woot13/woot13... or https://pdfs.semanticscholar.org/c8a6/9d63996f8f1eef414dbd29...)

I've seen it demonstrated on local news programs, and sometimes I see TV commercials for metallic sleeves you can put your NFC cards in so they don't get skimmed.

When I had a Washington State combined driver's license/North America passport, it came with one of those little sleeves. So there must be some kind of threat, or the government wouldn't hand those out.

It's not skimming, it simply presents an NFC transaction to the card through wallet/clothes. The card instantly approves, without you doing anything. It's a one-time loss, capped at the transaction limit for contactless. They could try and do it over and over, I guess

The TV reports stated that the cards could be cloned in this manner. Nobody is bringing a store point of sale terminal on the bus and holding it to your butt.

I'm 90% sure that NFC on a card can't do any kind of dynamic token generation, so it'd be the same token every time. Even if it isn't your actual credit card number, that would mean you could at least use a copy of it at other contactless terminals.

That's Static Data Authentication. Dynamic Data Authentication is also a thing - the recommended thing nowadays, actually. Check it out https://www.openscdp.org/scripts/tutorial/emv/DDA.html

These schemes are independent of physical transfer mechanism (well, mostly)

Edit: https://en.m.wikipedia.org/wiki/Contactless_smart_card you might be talking about MSD while I'm talking about EMV. C'mon, America, you're better than that

I think all of my cards have contactless now. I've used it precisely once, when I handed my card to the teller and they tapped it on the pad for me.

I thought that was because the whole point of the chips is that it's vastly more secure and contactless is hopelessly insecure

EMV contactless is essentially as secure as a chip-based transaction (same chip, but look-ma-no-contact).

Reply on news.ycombinator.com