851K views · Oct 14, 2015 · 8:45 · 2 HN recommenders · 3 mentions · discussed 2015–2018
Computerphile interview with Prof. Ross Anderson on how Chip and PIN payment systems are being compromised, and the attacks researchers have seen.
Why Hacker News points people here: HN points to it as a good overview of Chip and PIN attacks and the consumer-liability downsides.
“This is a good overview by some researchers in the different ways Chip and Pin can be hacked.”HN comment, 2015
“This is a good overview by some researchers in the different ways Chip and Pin can be hacked.”
Overview of ways Chip and Pin can be hacked.
This is a good overview by some researchers in the different ways Chip and Pin can be hacked. This explains this hack as well. this video
“still worth a watch discussing the attacks they have seen on Chip and Pin”
Discusses observed attacks on Chip and Pin.
One trick (which I believe has been fixed) is not so much a replay attack but a multiple transaction attack. A modified terminal makes multiple transactions on the card while the card is still in the terminal, coupled with another attack that modified what was presented on the screen of the terminal could turn a single $5 transaction to 3 $500 transactions. The video is 3 years old now but still worth a watch discussing the attacks they have seen on Chip and Pin - this video
“If you are interested in the downsides of the new pin card, checkout this video”
Explains downsides of PIN cards for consumer liability.
I want to have a system which protects me from money loss (through my own fault, a malicious third party, or my bank's fault). I don't care how as long as I'm protected. With Chip-and-PIn cards, I'm not protected because I have to proof that it was not my fault (which can be incredible difficult to do). So, I personal prefer cards that require a signature. It doesn't matter to me if it has a chip or not (the chip has nothing to do with the pin, there are also chip-and-signature cards and cards that support both. The chip makes it hard to physically clone the card). If you are interested in the downsides of the new pin card, checkout this video: this video So, if zero authentication means that I am not liable for financial damages, I'm happy with it but I wouldn't bother to use a pin if I had the same liability. Unfortunately, the pin adds laughable authentication which makes me liable for many types of fraud (see the video).
