Re:Why are McDonald’s Self Service Kiosks so hackable?
by MBCook on Sunday July 24, 2022 @08:32PM
(#32219296)
You only get unencrypted stuff when doing mag-stripe, and that’s mostly just card number and name. Same with tap-to-pay may-stripe emulation (the old way which no one is supposed to use anymore, even in the US per credit card rules).
That’s why everyone has/is moving off mag-stripe (depending on country) and to EMV. With EMV and EMV contactless the terminal never gets the full card number, among many other significant security improvements.
Re:Why are McDonald’s Self Service Kiosks so hackable?
by charles_kaw on Wednesday July 27, 2022 @01:41AM
(#32247230)
>You only get unencrypted stuff when doing mag-stripe
The terminal encrypts it before sending it over the wire
Re:Why are McDonald’s Self Service Kiosks so hackable?
by closewith on Monday July 25, 2022 @02:07AM
(#32221031)
Do you have a source for this?
The EMV spec doesn’t include encryption of any data sent to the terminal from the card.
The transaction cryptogram is signed, however.
Re:Why are McDonald’s Self Service Kiosks so hackable?
by charles_kaw on Wednesday July 27, 2022 @01:42AM
(#32247237)
The terminals themselves use mtls to communicate and wrap the payload , wasn't referring to the payload itself.
Re:Why are McDonald’s Self Service Kiosks so hackable?
by closewith on Wednesday July 27, 2022 @07:15AM
(#32249093)
That seems like a walkback? You said:
> However, the card terminal does not see unencrypted payment data.
The card terminal does see unencrypted payment data. Hard to see your comment as ambiguous?
In some solutions, the readers are in fact hooked up directly to the POS system. However, the card terminal does not see unencrypted payment data. The POS is acting as a network bridge or switch, while getting limited information over network from the terminal.
In fact, I'm not sure that's even something that's allowed in large scale installations today.