News for hackers. Stuff that matters.

A comment on The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple. Parent comment

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by pritambaral on Thursday October 04, 2018 @09:18AM (#18139585)
> To achieve this, the keyboard and the display is galvanically separated for the duration of the PIN entry

Perhaps this sounds too dull to ask, but what stops the terminal from just ... not separating the keyboard and display?

[ Parent | on HN ]
Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by koffiezet on Thursday October 04, 2018 @09:42AM (#18139776)
Certification. Worked in the same industry, and there were very strict both hardware and software requirements for POS software. Having gone trough credit-card audits, early EMV certification programs, and certification to place non-payment software next to payment software on such systems, I can tell you - it's no joke :)
[ Parent | on HN ]
Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by amelius on Thursday October 04, 2018 @12:45PM (#18141499)
> I can tell you - it's no joke :)

But still as a user I have no idea if I'm talking to a certified machine or not.

[ Parent | on HN ]
Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by lmilcin on Thursday October 04, 2018 @06:09PM (#18144124)
It's not your problem. For the transaction to take place it has to go to your bank and your bank trusts Visa/Mastercard to manage risks. You would be surprised to know most frauds are absorbed by banks. Nobody is interested in people fearing plastic because it causes people to increase very expensive debt plus additional interchange fee from every transaction.
[ Parent | on HN ]
Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by closeparen on Thursday October 04, 2018 @01:25PM (#18141828)
As a user, fraud is not your problem. Security isn’t there for your benefit.
[ Parent | on HN ]
Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by joe_the_user on Thursday October 04, 2018 @02:42PM (#18142427)
Certification [...] I can tell you - it's no joke :)

I'm not so sure. "And then initial supplier inserted hardware that thwarted all those pressing considerations" sounds a punchline to me. :(.

[ Parent | on HN ]
Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by lmilcin on Thursday October 04, 2018 @06:02PM (#18144062)
That, at least, is a problem that cab be solved by tightening security at supplier site.

The safeties are mainly to guard against the rest of the world. For example it prevents tampering in transit, or even in our own company - disgruntled employee can't do anything.

Or think for a second about the fact that we leave the device for, hopefully, entirety if its life at the client site. We had clients that were shady businesses like strip clubs that no other companies would touch with a stick.

[ Parent | on HN ]