News for hackers. Stuff that matters.
Re:Stop Calling it ‘Identity Theft’ by 8ytecoder on Wednesday September 27, 2017 @04:37PM (#15352071)
A commenter below already mentions the difference between high-trust and low-trust society. I'm from a country which has a notoriously low-trust society. Opening a credit card or bank account is notoriously hard. It's so hard that a large portion of the society is left out of the system.

The problem with chip-pin, 2FA ...etc is that people would still be vulnerable to fraud. Except in those cases, banks can wash off their hands.

I lost my credit card recently and someone misused it. my bank reverted the transactions immediately. I know they got my back. It's the merchant or the merchant's bank that usually absorbs the cost. It's also a conscious decision the merchant makes to not check an id card for every single purchase. It's a risk they are willing to take and they probably take an insurance to cover for it. They are rewarded with reduced friction in transacting with them and hopefully better revenues as a result. I think it's a system that works good enough. Would I prefer something more secure like Apple Pay - 100%! But I'd take this over being checked for my ID card for any purchase over very trivial amounts.

Now, you may argue that it would never happen with chip-pin...etc. That's not true at all. There are people who can't remember the pin well and would choose to use cash or write the pin in a paper and keep it in their wallet. Exposing themselves to more risk and no protection from the card company either - "hey someone knew your pin so you are responsible for it".

Re:Stop Calling it ‘Identity Theft’ by snarf21 on Wednesday September 27, 2017 @05:00PM (#15352300)
I agree the system has to protect both sides and that may not always pan out completely. I'm genuinely curious what you think would work better. All systems have drawbacks. Some of them may be systemic but those are harder to abuse than a waiter writing down your CC # and selling that to people who encode them on magstripes.

I think with chip+pin it is at least a lot harder to be vulnerable. More and more credit card companies also have an app that you can easily report your card missing/stolen almost instantly. Also, if you have trouble with a 4 digit # of your choosing, then you should stick with cash which is still open to theft but not digital duplication.

Re:Stop Calling it ‘Identity Theft’ by 8ytecoder on Wednesday September 27, 2017 @06:22PM (#15352870)
If you are really interested, read this ArsTechnica article [1]. Interesting tidbit [2]. This makes it far superior to even chip+pin. You have to enable TouchId to use Apple Pay - there's the 2FA which doesn't requiring writing it down. It never sends the real cc number - no way for the waiter to even see it. It's a shame it's not catching up. Even in a tech-savvy city like SF it's adoption is abysmal.

[1] https://arstechnica.com/gadgets/2014/10/how-mobile-payments-...

[2] On top of that, Apple has introduced tokenization into its payment system. Like Google Wallet's Virtual Card, this obfuscates the user's actual credit card number, but it does so using a security standard developed by various standards groups and big-name card networks like Visa. It all happens without having to go through another bank as an intermediary supplier of a virtual card.