Hacker News Reader

Comment by i386 | Hacker News Reader

That’s very US centric. In every other place except America, credit card issuers mandate the use EMV’s and pin codes.

How does that chip work online? As far as I know, CCs around the world still depend on numbers.

For what it’s worth, in the US, chip is pretty much everywhere. Main difference is that it’s chip and signature vs chip and pin. I wish we’d switch to pins as well, but it’s not like it’s the dark ages or anything.

You need a 2FA style confirmation code for online transactions.

Yeah, I actually need to login to my online bank to confirm most of my online Visa transactions (at least for the first time with a particular merchant).

It's called 3D Secure and requires a PIN to verify transaction(typically with SMS), or a security device provided by bank.

Except that 3D Secure is opt-in by the merchant. All you need to do is find a web store that is more than 2 years old and you can use stolen/skimmed cards all day long.

... at the risk of the store. The card holder just goes to the bank, says "I didn't do those transactions!" and gets all money back.

That's how it works for all credit card fraud. But do they treat 3D Secure transactions any differently?

Yes, 3D secure leads to a different liability layout. Stores that don't implement it face liability on chargeback, whereas stores that do use it are protected, and the banks themselves take liability.

At least that's my understanding of it, might not be that clearcut.

Oh wow, now I'm even more amazed that more stores don't support it. I guess chargebacks aren't common enough to be worth paying a dev to upgrade their systems...

Yep that's right, the liability shifts from the merchant to the bank.

My primary card declines all non 3D Secure internet purchases unless I click the scary sounding "Open card to all internet purchases for 60 minutes" button in the bank app.

That's brilliant! May I ask where you're from? Our national processor was one of the first to implement 3D Secure but none of the banks I know about offer that kind of protection (even on my company card).

Sweden! Having Nordea as my bank. Have had it for at least 5 years, probably more!

Not for long, it will be mandatory in the EU from the end of the year under the PSD2 regulations (though the deadline has moved back into 2021 for some countries, including the UK which is adopting them despite Brexit).

Issuers will start to decline card transactions for any merchants that submit payments that haven't gone through 3DS.

Hell yeah! Now we just need to get banks to stop using SMS 2FA and embrace an open 2FA standard like TOTP and our money (!!) will finally be almost as secure as our Facebook accounts have been for 5 years...

TOTP can be phished (there is even ready to use proof of concept software for building a TOTP phishing site), so it's a pretty poor choice.

https://breakdev.org/evilginx-2-next-generation-of-phishing-...

Instead banks should use WebAuthn. WebAuthn's credentials are directly bound to the DNS name. So anything that involves fooling the human like a phishing site can't work. The only site your authenticator can give the real-bank.example credentials to is... real-bank.example.

SMS 2FA can also be phished, so TOTP would still be better and WebAuthn is such a complete paradigm shift that it would take many years for banks to implement it. TOTP is so stupidly simple they could roll it out in a month, audits and all.

Not to mention that in order to have a decent WebAuthn experience, you need a Yubikey with NFC, which go for 30-60$ if I remember correctly. Cost of authenticators is why everyone switched away from RSA SecurID.

WebAuthn for relying parties (what the bank is in this scenario) just isn't very hard. And you don't end up with any long term secrets at all, so that makes the security story easier. But I sadly do not expect banks to adopt it anyway.

I don't see what a Yubikey with NFC is getting you here. For a laptop/desktop user any of the Security Key products in an appropriate USB form factor (USB C for some newer laptops otherwise USB A) would be suitable.

The high end phones are or in the case of the iPhone very shortly will be WebAuthn platform authenticators, there's nothing extra to buy. Apple released a video of the pleasant UX journey they want to promote, obviously being Apple it doesn't actually say this would work on non-Apple devices but I use it already so I know it does.

My bank never used SMS as 2FA. They supported mobile signature for… I do not even remember how long, at least 11 years now. TOTP was supported even before that and is phased out in favour of https://www.smart-id.com/

My bank once gave me a one time pad :)

Was it Symantec? You can import that into Authy/Google Authenticator/1Password if you want. It's good at least for backup.

https://github.com/dlenski/python-vipaccess

Nah, if the really card holder make a complaint to the card issuer, there will be a full charge-back by the card issuer plus a investigation fee and the store will have to cover the loss.

And its super annoying. I bail out when I'm asked to do that.

It may be annoying if one is not used to take care about own transactions safety and is willing to shift this responsibility to some other entity - of course this convenience has a cost.

Well, I already moved to Paypal whereever I'm forced to do this dance. It is also completely unusable for me when travelling, because I like to keep the stuff to authorize unlimited transactions from my bank account at home.

Use using credit card numbers is IMHO a very conventient way of paying with the liability for fraud being setup exactly in the right customer-friendly way.

I have two options, both provided for by the bank.

1. I have a dongle that creates a number code when prompted. 2. My phone is set up for 2fa, again through the bank. The screen shows the same keyword as the website and I enter a pin into my phone to authorize the transaction. I can't remember if I need to use the fingerprint option on the phone or if that's just for the bank's app.

For my bank, I scan a QR code in the bank app. Then, on the phone it shows me who I'm paying, how much, and an appove or deny button. It also allows me to select the account that the money will actually come from.

I think most us cards have chips, but no pins. It’s bizarre.

I used to think the same thing, but it turns out it actually makes sense (at least in the US): the vast majority of credit card fraud is counterfeit cards, not stolen cards. Requiring a chip which can’t be counterfeited from a list of lifted CC numbers (and sometimes track codes) solves most of the problem as far as card present purchases are concerned. That and shifting more liability to merchants if they don’t support chip readers.

You can't skim the chip but you can trivially intercept the PIN.

My card has a PIN but the PIN is actually quite dangerous. If someone gets my PIN, then it fraudulent transactions become my problem. Whereas a stolen credit card number is a problem for the bank or the merchant.

PIN is not going to help you as transactions made with PIN will be deemed made by you and you are most likely going to cover the loss if fraud did happen.

My bank has programmable pins. So one pin goes to account X, and the other goes to account Y. It's super handy when travelling so we can have our "per diem" attached to one pin, and then have another pin for things that would fall outside of that purpose.

At least in the US, to be fair, they don't really take your money but rather the bank's money. Credit cards tend to be much more lenient and generous with fraud protection (among other benefits) in the US than in some other countries in which I've had cards.

They're lenient because they have to, and are paid to. Fraud is high and so are transaction fees.

And anecdotally, I cannot speak for the entire world, but European banks have no problem disputing fraudulent charges that happen overseas.

I believe you can make transactions up to 50 euros with the magnetic strip.

EMV is good, PIN is NOT

Reply on news.ycombinator.com