Hacker News Reader

Comment by al3x | Hacker News Reader

Are you serious?

The victim in this scenario is handing their credit card to the attacker. That's game over. It doesn't matter whether the attacker has a Square, a VeriFone device, or a piece of paper for writing down the card number. If you hand your credit card to someone malicious, they can figure out how to do bad things with it.

I'm a big fan of Square, but it's important to remember that their solution doesn't remove the traditional risks of credit card usage. But then, there isn't yet a widely-deployed, field-tested alternative, at least in the US. The advent of NFC payments may put reasonable crypto in the POS flow, but I'm sure it's matter of time before side-channel attacks are discovered in the burgeoning NFC solutions.

Security is hard. But VeriFone isn't talking about security. They're using security as an anti-competitive stalking horse, and that's a disgusting way to do business.

View on HN

> Are you serious?

Very, and I will dig my heels in on this. For the record, your point would have been just as clear without this assertion that my point is stupid.

> The victim in this scenario is HANDING THEIR CREDIT CARD TO THE ATTACKER. That's game over. It doesn't matter whether the attacker has a Square, a VeriFone device, or a piece of paper for writing down the card number. If you hand your credit card to someone malicious, they can figure out how to do bad things with it.

So everybody should just stop doing security, since people will figure out ways around it? Why bother? The Square device, as another commenter points out elsewhere in this thread, sets the expectation of a legitimate transaction. It's pushed, it's marketed, it's being set as the new brand of credit card processing.

As such, Square have a responsibility to make sure that their products do not make skimming easier. And guess what? VeriFone found a way to skim, easily, with their product.

This whole "but you can do it on the black market for $20!" argument is, pardon the Latin, fucking ridiculous. I seriously can't believe there are people in this thread, who identify themselves as IT specialists, siding with Square because credit card processing is a lost cause. Internet Explorer 6 is pretty much a lost cause for Web exploits. Does that mean the rest of the browsers should not protect against Web exploits? This argument makes absolutely no sense. Who cares what others are doing? Do your product right.

> I'm a big fan of Square, but it's important to remember that their solution doesn't remove the traditional risks of credit card usage.

True. But there is NO REASON to make the vector EASIER. PERIOD. Simply because there are real risks with the vector means that we should take strides to make the vector harder.

I don't know about you, but when I hand my credit card to somebody, I don't actually check out the brand name of the reader they're using. Whether the little gadget says Square or Circle or Rhombus on it has no effect on my expectation of a legitimate transaction.

If legitimate people using Square could have their numbers stolen because the upstream communication to the server wasn't encrypted, that would be a problem. That would be something to secure.

I mean, if the Square device couldn't read the raw numbers, then people would be complaining about how they own the hardware and they should be able to do whatever they want with it.

"This whole "but you can do it on the black market for $20!" argument is, pardon the Latin, fucking ridiculous."

Nice way to add 'black market' in there to try to dismiss a valid point. You can get card readers from legitimate businesses. They are valid peripherals used all the time. Do a search for 'usb credit card reader' on Google. All those results are not black market.

As an aside, it's funny how you have a problem with GP saying 'Are you serious?' and thinking it implies your point is stupid but then take the exact same dismissive tone for your whole post.

"I seriously can't believe there are people in this thread, who identify themselves as IT specialists, siding with Square because credit card processing is a lost cause. "

The fact of the matter is that people hand their cards over all the time to pay for things and no one ever looks to see what kind of device it is. When you are paying for something in a shop, do you check out the credit card processing machine first to make sure it's secure? When you hand your card over to the waiter to take to the back and pay for your meal, do you follow him to make sure he isn't swiping it into another machine or writing the number down on paper? Nope. And the fact that the square reader is a plaintext device, like a lot of the readers on point-of-sale systems, really doesn't mean anything.

Jed, there are exactly two directions you can go from here, and I advise you to pick one of them instead of standing in the crossroads hollering and waving your arms.

On one road, you make the argument that it is fundamentally unsafe to accept credit cards with commodity mobile computing devices, because there is no way to do chain-of-custody control with insecure magstripe cards. There is a reasonable case to be made here. I'll disagree with it, but you won't automatically lose.

On the other road, you can provide one of more specific steps Square could take to make their commodity mobile card reader device meaningfully more secure. Be careful on this road because it is dangerous; people, myself included, will be standing on the side of the road shooting at you. Remember, anything you come up with must meaningfully improve the security of a device that can only interact with insecure magstripes.

You can also walk your argument back, which is what I'd do if I were in your shoes.

> You can also walk your argument back, which is what I'd do if I were in your shoes.

Good point. I'm just leaving my argument where it is, since I've poignantly lost. The way you summarized it made something clear to me, though, so thank you for your response.

I had a response typed up to the "we need to switch to $X" elsewhere in this thread, then discarded it and went back to work after writing a much smaller one. That's probably the best way forward from the whole mess, since it is indeed true that magstripe technology is outdated and insecure. It's amazing to me that with the prevalence of strong crypto we haven't come up with something better that has been mass-adopted. Until Joe's Gas-n-Snacks in Bimbleberry, Kansas accepts my new-fangled card, I won't consider the replacement mass-adopted.

There's an interesting aside: Square hurts adoption of new-fangled payment technologies because it caters only to magstripes.

However, I still disagree on mere principle with "it's already broken, so no need to do it right for ourselves". That's a dangerous path to take in itself.

I think your perspective on what's broken is an issue.

It's one thing to say "everybody else is crappy, we can be crappy too." I agree, that's bad. Doing better can be a great differentiator.

It's another thing to realize "the input we receive is broken, our output will be too". Garbage in, garbage out.

Square, having decided they are going to be in the business of reading magnetic stripes, cannot make those magnetic stripes any more secure than they already are (not). They could maybe do better/right by being in a different business, but they can't do the business they are in any better.

To be fair to al3x, I was genuinely wondering if you were serious.

Reply on news.ycombinator.com