News for hackers. Stuff that matters.
Re:Ask HN: Why are credit card chip readers so slow? by bluGill on Monday June 26, 2017 @10:37AM (#14637117)
I don't want pin. I have half a dozen credit/debit cards in my pocket (the card I use for almost everything, my backup card just in case the first is lost, my HSA card, my company card, a debit card, and the store care for a store I shop at often) there are another half a dozen that the issuers want me to carry but are not worth the space they take up. I cannot mentally manage that many different pins.

verification comes in 3 parts: something you carry (card), something you know (card number, pin), something you are (your signature, fingerprint). Generally you need two. However since the card number is memorable (hard but possible) the pin is no additional security.

Re:Ask HN: Why are credit card chip readers so slow? by Dayshine on Monday June 26, 2017 @10:41AM (#14637138)
Signature isn't something you are, it's not in any of those three categories, it's closer to your address.

Chip + pin = Something you carry (card/chip) + something you know (pin). You need the physical card to use it, card number isn't sufficient.

Re:Ask HN: Why are credit card chip readers so slow? by mugsie on Monday June 26, 2017 @11:13AM (#14637417)
Signature is also not something "you are" - it is an easily faked thing, that is basically never actually verified.

PINs can be changed, so if you came up with a way of memorising them, its easy.

You also don't need PINs for things like loyalty / membership cards traditionally - just for payment cards.

Re:Ask HN: Why are credit card chip readers so slow? by cmurf on Monday June 26, 2017 @01:16PM (#14638495)
This is b.s. for numerous reasons:

- You can have the PIN reset for all of those cards so that they all match, (or better we should be using PK based push notifications to a smart phone app; plug in the card, and you get a push notification to deny/allow on your phone, instead of entering in a PIN.)

- Signatures aren't even verified the vast majority of transactions. They only come into play if you catch fraud and report it. So it's used after the fact, not in advance.

- Signatures are predicated on pen on paper on a flat writing surface perpendicular to gravity. Your signature is not at all the same to a handwriting expert if you change any of those things, and in particular the digital capture of signatures is complete utter bullcrap: no angular, or pressure information is captured. We should just use smiley faces on all such POS systems, in lieu of even attempting a signature (it is in fact what I do).

Digital signatures are Tonka Toys. They are nothing like a finger print.

Re:Ask HN: Why are credit card chip readers so slow? by cat199 on Monday June 26, 2017 @12:10PM (#14637854)
> I cannot mentally manage that many different pins.

Pick 4 digits on the card, multiply/add them by some constant number you know. You're now done 'memorizing'.

Re:Ask HN: Why are credit card chip readers so slow? by digikata on Monday June 26, 2017 @12:30PM (#14638012)
Don't simple mnemonics have a risk of helping to reduce the search space to guess a pin?
Re:Ask HN: Why are credit card chip readers so slow? by stickfigure on Monday June 26, 2017 @02:26PM (#14639079)
We're talking about a 4-digit search space. The system already needs (and presumably already has) extreme rate-limiting measures.
Re:Ask HN: Why are credit card chip readers so slow? by IncRnd on Monday June 26, 2017 @12:44PM (#14638138)
Signatures are not in the category, "something you are."
Re:Ask HN: Why are credit card chip readers so slow? by LordKano on Monday June 26, 2017 @11:26AM (#14637523)
I don't use my PIN either, for a different reason.

I force them to process it as a credit card because I get the consumer protections of the CC processing agreements. If I use my PIN, it's more like an ATM transaction.

LK

Re:Ask HN: Why are credit card chip readers so slow? by stan_rogers on Monday June 26, 2017 @11:47AM (#14637674)
Chip and PIN credit card transactions are still credit card transactions everywhere else, with all of the attendant protections.
Re:Ask HN: Why are credit card chip readers so slow? by cmurf on Monday June 26, 2017 @01:26PM (#14638609)
Which law applies to the transaction is what the card account is; not the transaction. TILA applies to credit cards, and EFTA applies to debit cards.

Whether you're costing the merchant more money with higher fees for credit transactions, or if this gets normalized to a debit transaction later on, I'm not sure. But either way it's ridiculous to "force" a credit card transaction on the merchant.

Re:Ask HN: Why are credit card chip readers so slow? by tonyztan on Tuesday June 27, 2017 @01:02PM (#14647121)
Even though the different transactions on a debit card may have the same legal status by law, banks typically apply "zero liability" to transactions processed by Visa/MasterCard, while holding users accountable for fraudulent debit transactions processed by ATM networks, up to $50 if you report within 2 days, then $500 within 60 days, and then unlimited customer liability after that.
Re:Ask HN: Why are credit card chip readers so slow? by LordKano on Tuesday June 27, 2017 @03:11PM (#14648337)
This! Precisely this!

There is no benefit to me to go with a debit transaction and the risk of significant liability if there is a data breach. So, I don't do debit transactions.

Re:Ask HN: Why are credit card chip readers so slow? by kevin_thibedeau on Monday June 26, 2017 @03:41PM (#14639658)
> either way it's ridiculous to "force" a credit card transaction on the merchant.

I do it more often because of the number of times I've been screwed by trying to use debit mode and end up with a non-functional gas pump or forced to reswipe with the mag stripe because they only support credit transactions from the chip.