News for hackers. Stuff that matters.
Re:Ask HN: Why are credit card chip readers so slow? by mugsie on Monday June 26, 2017 @09:58AM (#14636813)
The US was one of the last countries to get Chip + PIN, and even then they messed it up, and got chip + sign.

90% of the places I use a card in seem to be still swiping the cards, while we have had full chip + PIN implementation here (Ireland) since at least 2005 or 2006.

Re:Ask HN: Why are credit card chip readers so slow? by bzbarsky on Monday June 26, 2017 @01:10PM (#14638409)
Why do you think they messed it up?

Chip+sign is a solution to a real market problem with chip+PIN in the US: the the typical consumer has many credit cards. https://www.quora.com/What-is-the-median-number-of-credit-ca... claims an average, not median, of 3.5 per cardholder, and that matches the numbers at http://www.creditcards.com/credit-card-news/ownership-statis... . Heavy credit card users have a lot more: it's common for stores to have store-brand cards that give you a discount at that store, so a number of people end up with a dozen different cards for stores they commonly shop at.

Expecting people to remember this many different PINs is not realistic. So every card issuer was worried that users would just stop using their card because they could not remember the PIN. This is the problem chip+sign is meant to solve.

In other countries, patterns of credit card use are quite different. http://www.theukcardsassociation.org.uk/wm_documents/UK%20Ca... page 6 claims an average of 2 cards for the UK, for example. So the "can't remember the PIN" problem was not as big a deal.

Re:Ask HN: Why are credit card chip readers so slow? by mavhc on Monday June 26, 2017 @02:22PM (#14639050)
Just set all your pins to be the same
Re:Ask HN: Why are credit card chip readers so slow? by bzbarsky on Tuesday June 27, 2017 @02:57AM (#14643022)
That's assuming the issuer allows you to set the PIN. In many cases they do not, in my experience with both debit cards and chip+PIN cards (the one chip+PIN card I have in fact does not allow that).
Re:Ask HN: Why are credit card chip readers so slow? by mugsie on Tuesday June 27, 2017 @05:03AM (#14643511)
This is in the US, with the broken Chip + PIN implementation.

I can go to pretty much any ATM in the EU and change the PIN on all of my cards.

Re:Ask HN: Why are credit card chip readers so slow? by bzbarsky on Tuesday June 27, 2017 @11:34AM (#14646329)
Yes, I'm aware of that. I can't tell you why that difference exists, but it does.
Re:Ask HN: Why are credit card chip readers so slow? by muninn_ on Monday June 26, 2017 @10:58AM (#14637287)
Chip+pin isn't the sole marker of innovation. Anyway, as I said, if you build out an entire infrastructure based on a different way of doing things, you can't just up and change that over night. It takes time. It costs money. There are associated opportunity costs, etc....
Re:Ask HN: Why are credit card chip readers so slow? by mugsie on Monday June 26, 2017 @11:10AM (#14637400)
Sure - but the rest of the world had the same assumptions, (and infrastructure) and we managed to do it.

Chip and PIN is not the sole marker, but it is the most obvious one, which is why people use it as a benchmark.

Re:Ask HN: Why are credit card chip readers so slow? by muninn_ on Monday June 26, 2017 @12:21PM (#14637944)
It's an obvious one, which indicates a superficial understanding of the financial industry and technology in particular. Credit cards, and their use, was from the outset largely an American phenomenon. When Europe finally caught up (and to this day, in the year 2017 there are still businesses that don't have credit card infrastructure set up - meanwhile even mobile food trucks in the US offer it), Americans had already built out the infrastructure and found out about the hard issues - which gave Europeans time to implement a better solution, which was chip + pin.

But all that aside, the real question is, why are you still using a physical credit card? In the US, I can use Apple/Google Pay at nearly every business I find, and all of the large banks and most regional and smaller firms offer support for their products on the platform.

When will Europe catch up with banking technology?

Re:Ask HN: Why are credit card chip readers so slow? by cmurf on Monday June 26, 2017 @06:26PM (#14640916)
It's almost like you've never even been to Europe, and all you shop at in the U.S. is McDonald's, Chipotle and Starbucks.

For around a decade, many cities, example Prague, have accepted text message based payments for public transit. Today most public transit systems have their own apps for payment and ticketing. I can't think of a single U.S. city that does this. They're all exact change only or proprietary ticketing systems.

About the most advanced I can recall, Citi had a short lived tap and pay, NFC based, project in the NYC subway 10 years ago. You still got the 10% metrocard discount. It was ultra proprietary though, Citi cards only.

And then Citi and Amex went and ripped NFC out of all my credit cards for this slow EMV chip. Haha yeah, when will Europe catch up. What we did is catch up with their 3 decade old chip idea.

Re:Ask HN: Why are credit card chip readers so slow? by mymuss on Tuesday June 27, 2017 @08:54AM (#14644897)
> I can't think of a single U.S. city that does this. They're all exact change only or proprietary ticketing systems

MBTA in Boston had the mTicket app for mobile ticketing and payments for years. I live in Boston and use the app regularly. Can't comment on other cities because when I visit for a short trip I typically don't bother installing apps.

Amtrak and most airlines use mobile boarding passes too. Interestingly enough, on my recent trip to Europe I used the mobile boarding pass in Logan airport just like everyone else. But in Frankfurt when I showed my phone to the agent they looked at me like I was from another planet, probably thinking "stipid americans"

And while we're on the subject of transportation, about 5 years ago I visited a bunch of european countries, including my home country in Europe, and at that time the only way to call a cab was via dialing the local phone number, cash only of course. Funny because on that trip heading to the airport in the States was matter of acouple taps in the Uber app.

Re:Ask HN: Why are credit card chip readers so slow? by mugsie on Monday June 26, 2017 @01:21PM (#14638552)
> When Europe finally caught up (and to this day, in the year 2017 there are still businesses that don't have credit card infrastructure set up - meanwhile even mobile food trucks in the US offer it), Americans had already built out the infrastructure and found out about the hard issues - which gave Europeans time to implement a better solution, which was chip + pin.

It was a US based in the beginning - but by the time Chip + PIN started there was significant infrastructure already in place. Its not like we all just started to use cards in 2005

> But all that aside, the real question is, why are you still using a physical credit card? In the US, I can use Apple/Google Pay at nearly every business I find, and all of the large banks and most regional and smaller firms offer support for their products on the platform.

Sure - that is down to market forces, not banking tech. There are banks here where I can use both Apple / Android pay, and all merchants take it (by virtue of our advanced usage of contactless payments - another thing that was introduced before the US).

What other areas is the US more advanced in (bank tech wise) ? We have online only banks, push notifications for transactions, and all the other things I see advertised by US banks.

Re:Ask HN: Why are credit card chip readers so slow? by muninn_ on Monday June 26, 2017 @01:50PM (#14638804)
> It was a US based in the beginning - but by the time Chip + PIN started there was significant infrastructure already in place. Its not like we all just started to use cards in 2005

Sure, but it was far more widespread in the United States. Even now, to this day, there are businesses all over Europe (I just did an 11-country tour not long ago) that simply don't take credit cards. In the United States, even student organizations take credit cards for selling things like shirts. Europeans haven't been using credit and debit cards like Americans have, and so even though similar infrastructure has existed, it hasn't existed to the same extent as it has in the United States. It follows that retooling the infrastructure costs significantly more in the United States, as every "swipe machine" had to be replaced with a machine that accepted a chip. Everything from drive-up ATMs to Square, to gasoline pumps have to be replaced. At this point we're kind of conflating technology with economics and market dynamics, but it's worth pointing out that it's not a lack of technology that made the US swipe-only for so long, but market forces. If, it cost me less money to deal with swipe fraud than it does to replace all of my credit card machines... what do you think a business would do?

> Sure - that is down to market forces, not banking tech. There are banks here where I can use both Apple / Android pay, and all merchants take it (by virtue of our advanced usage of contactless payments - another thing that was introduced before the US).

How do you arrive at this conclusion? I don't recall being able to use contactless payments anywhere in Italy, for example. Not that it doesn't exist, but my impression from visiting Europe and living in the United States has been that contactless payments are far more ubiquitous in the States than the countries I've visited in Europe.

> What other areas is the US more advanced in (bank tech wise) ? We have online only banks, push notifications for transactions, and all the other things I see advertised by US banks.

Scale. Blockchain. Products. Payments.

What are your thoughts?

Re:Ask HN: Why are credit card chip readers so slow? by cmurf on Monday June 26, 2017 @07:32PM (#14641302)
I find most European cities are cashless, and accept MasterCard and Visa as well as the local country issuer for payments, attached to a local bank account.

You might have been running into the fact credit cards have much higher merchant fees, even if it's probably a violation of their EMV merchant agreement to refuse to accept these cards.

I see zero meaningful advancement of payments in the U.S. over Europe, to the contrary. There are more cash only restaurants in the U.S. especially if you're not in a big city, it's quite common. I think your opinion is based on a very limited experience across the U.S. and Europe.

And EFT payments in the U.S. are incredibly slow compared to their European counterparts. The fastest bank to bank transfer is Fedfunds wire, and that costs money, upwards of $30 for each party. It's cheap or free in Scandanavian and European cities.

I really have no idea what you're talking about when it comes to American innovation in this area... I see it as yet another example of American pay more to get less sort of classist mantra. Oh but if you have more money, and pay more fees, agree to give away more personal data in the EULA, you can get better services!

Re:Ask HN: Why are credit card chip readers so slow? by mugsie on Monday June 26, 2017 @02:05PM (#14638914)
I have been using contactless payments for years here, and the 4 other EU countries I have been in this year, all accepted contactless. You may not have been able to use a US contactless card, but people do use it. It is also worth noting that each country in Europe has a different culture and history, which inform the choices people make with banks, and particularly credit cards.

Scale - sure, the US is larger than any of the EU countries population wise - but not sure how that is "innovation".

Blockchain - work on blockchain tech is global - American companies even export the R&D to EU countries ;)

Products + Payments - there is nothing ground breaking in the US, that is not in the rest of the world

Re:Ask HN: Why are credit card chip readers so slow? by Mister_Snuggles on Monday June 26, 2017 @11:51AM (#14637709)
The infrastructure in the US seems to support Chip+PIN just fine, it seems to be that the card issuers don't want to issue cards with PINs.

When I last visited the US, my Canadian credit card worked just like it does in Canada. Insert into the machine, verify the amount, enter my PIN, done.

Re:Ask HN: Why are credit card chip readers so slow? by cmurf on Monday June 26, 2017 @01:34PM (#14638681)
That's right. It is basically a flag on the account, which ends up as a notification at the POS system. So you get this hilarious crap with a U.S. card outside the U.S. where you're still signing shit, because the POS system tells them you have to sign. I lost count of the various reactions when traveling outside the U.S.:

- Why is it printing extra receipts? Oh... you have to sign one of these.

- Hold on, let me go find a pen for you to sign.

- Asks coworker what this message means. Oh he has to sign, must be an American.

And get this shit. My debit card in the U.S.? I always use a PIN for it everywhere. But when I travel outside the U.S. that same goddamn card requires a signature every damn time.

It's really fucking stupid, there's no nice way to put it.

Re:Ask HN: Why are credit card chip readers so slow? by mugsie on Monday June 26, 2017 @12:19PM (#14637916)
Yeah - my EU cards can use a PIN in some machines in the US now.
Re:Ask HN: Why are credit card chip readers so slow? by mikeash on Monday June 26, 2017 @12:32PM (#14638036)
Since chip-and-pin seems to be used as an excuse to push liability for fraud onto the cardholder, I'd much rather stick with chip-and-signature. If we could have chip-and-pin while still keeping me at zero liability for fraud, I'd take it.
Re:Ask HN: Why are credit card chip readers so slow? by bluGill on Monday June 26, 2017 @10:37AM (#14637117)
I don't want pin. I have half a dozen credit/debit cards in my pocket (the card I use for almost everything, my backup card just in case the first is lost, my HSA card, my company card, a debit card, and the store care for a store I shop at often) there are another half a dozen that the issuers want me to carry but are not worth the space they take up. I cannot mentally manage that many different pins.

verification comes in 3 parts: something you carry (card), something you know (card number, pin), something you are (your signature, fingerprint). Generally you need two. However since the card number is memorable (hard but possible) the pin is no additional security.

Re:Ask HN: Why are credit card chip readers so slow? by Dayshine on Monday June 26, 2017 @10:41AM (#14637138)
Signature isn't something you are, it's not in any of those three categories, it's closer to your address.

Chip + pin = Something you carry (card/chip) + something you know (pin). You need the physical card to use it, card number isn't sufficient.

Re:Ask HN: Why are credit card chip readers so slow? by mugsie on Monday June 26, 2017 @11:13AM (#14637417)
Signature is also not something "you are" - it is an easily faked thing, that is basically never actually verified.

PINs can be changed, so if you came up with a way of memorising them, its easy.

You also don't need PINs for things like loyalty / membership cards traditionally - just for payment cards.

Re:Ask HN: Why are credit card chip readers so slow? by cmurf on Monday June 26, 2017 @01:16PM (#14638495)
This is b.s. for numerous reasons:

- You can have the PIN reset for all of those cards so that they all match, (or better we should be using PK based push notifications to a smart phone app; plug in the card, and you get a push notification to deny/allow on your phone, instead of entering in a PIN.)

- Signatures aren't even verified the vast majority of transactions. They only come into play if you catch fraud and report it. So it's used after the fact, not in advance.

- Signatures are predicated on pen on paper on a flat writing surface perpendicular to gravity. Your signature is not at all the same to a handwriting expert if you change any of those things, and in particular the digital capture of signatures is complete utter bullcrap: no angular, or pressure information is captured. We should just use smiley faces on all such POS systems, in lieu of even attempting a signature (it is in fact what I do).

Digital signatures are Tonka Toys. They are nothing like a finger print.

Re:Ask HN: Why are credit card chip readers so slow? by cat199 on Monday June 26, 2017 @12:10PM (#14637854)
> I cannot mentally manage that many different pins.

Pick 4 digits on the card, multiply/add them by some constant number you know. You're now done 'memorizing'.

Re:Ask HN: Why are credit card chip readers so slow? by digikata on Monday June 26, 2017 @12:30PM (#14638012)
Don't simple mnemonics have a risk of helping to reduce the search space to guess a pin?
Re:Ask HN: Why are credit card chip readers so slow? by stickfigure on Monday June 26, 2017 @02:26PM (#14639079)
We're talking about a 4-digit search space. The system already needs (and presumably already has) extreme rate-limiting measures.
Re:Ask HN: Why are credit card chip readers so slow? by IncRnd on Monday June 26, 2017 @12:44PM (#14638138)
Signatures are not in the category, "something you are."
Re:Ask HN: Why are credit card chip readers so slow? by LordKano on Monday June 26, 2017 @11:26AM (#14637523)
I don't use my PIN either, for a different reason.

I force them to process it as a credit card because I get the consumer protections of the CC processing agreements. If I use my PIN, it's more like an ATM transaction.

LK

Re:Ask HN: Why are credit card chip readers so slow? by stan_rogers on Monday June 26, 2017 @11:47AM (#14637674)
Chip and PIN credit card transactions are still credit card transactions everywhere else, with all of the attendant protections.
Re:Ask HN: Why are credit card chip readers so slow? by cmurf on Monday June 26, 2017 @01:26PM (#14638609)
Which law applies to the transaction is what the card account is; not the transaction. TILA applies to credit cards, and EFTA applies to debit cards.

Whether you're costing the merchant more money with higher fees for credit transactions, or if this gets normalized to a debit transaction later on, I'm not sure. But either way it's ridiculous to "force" a credit card transaction on the merchant.

Re:Ask HN: Why are credit card chip readers so slow? by tonyztan on Tuesday June 27, 2017 @01:02PM (#14647121)
Even though the different transactions on a debit card may have the same legal status by law, banks typically apply "zero liability" to transactions processed by Visa/MasterCard, while holding users accountable for fraudulent debit transactions processed by ATM networks, up to $50 if you report within 2 days, then $500 within 60 days, and then unlimited customer liability after that.
Re:Ask HN: Why are credit card chip readers so slow? by LordKano on Tuesday June 27, 2017 @03:11PM (#14648337)
This! Precisely this!

There is no benefit to me to go with a debit transaction and the risk of significant liability if there is a data breach. So, I don't do debit transactions.

Re:Ask HN: Why are credit card chip readers so slow? by kevin_thibedeau on Monday June 26, 2017 @03:41PM (#14639658)
> either way it's ridiculous to "force" a credit card transaction on the merchant.

I do it more often because of the number of times I've been screwed by trying to use debit mode and end up with a non-functional gas pump or forced to reswipe with the mag stripe because they only support credit transactions from the chip.