Asus refunds Zenfone buyer for failing to provide bootloader unlock tools

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by lxgr on Saturday April 06, 2024 @11:57AM (#39953282)

EMV chip cards still contain your card number and expiry date.

Skimmers would need a way to also learn the CVC2 from the back of the card to use it at most (but not all!) online merchants, but that's feasible using a small camera or a waiter/cashier accomplice doing the skimming.

With Google Pay and Apple Pay, and similar mobile wallets, that number is never shared during payments (and in fact not even stored on the device).

[ Parent | on HN ]

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by jjmarr on Saturday April 06, 2024 @12:15PM (#39953399)

They do, but you can't get the card number from reading the chip. The protocol is a challenge-response one based on a private key stored within the chip.

https://en.wikipedia.org/wiki/Chip_Authentication_Program

You need to read the entire card number + cvc2 + expiry date with your camera. That's not skimming, that's just taking a photo of the card.

[ Parent | on HN ]

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by worewood on Saturday April 06, 2024 @12:24PM (#39953468)

Yeah, and it's easily solvable with a sticker or a dremel to scrape the number off

[ Parent | on HN ]

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by lxgr on Saturday April 06, 2024 @03:01PM (#39954578)

You can't dremel it out of the chip, though.

[ Parent | on HN ]

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by justinclift on Saturday April 06, 2024 @08:42PM (#39957090)

Well technically you can. The card won't be so usable after that though. ;)

[ Parent | on HN ]

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by lxgr on Saturday April 06, 2024 @10:28PM (#39957654)

Destroying the chip is easy, actually chiseling away the correct trapped electrons making up the PAN in the EEPROM is the challenge ;)

[ Parent | on HN ]

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by lxgr on Saturday April 06, 2024 @02:04PM (#39954215)

No, you can most certainly get the card number and expiry via the chip and even over contactless, as it’s a vital part of transaction routing/processing. There are Android apps that can do it.

[ Parent | on HN ]

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by jjmarr on Saturday April 06, 2024 @04:17PM (#39955131)

If I could I'd delete my original comment since I did more research and you're right.

https://stackoverflow.com/questions/14861908/apdu-command-to...

[ Parent | on HN ]

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by M95D on Saturday April 06, 2024 @02:59PM (#39954564)

Any responsible user will learn the CVC, like any other password, and then erase it from the card.

[ Parent | on HN ]

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by lxgr on Saturday April 06, 2024 @03:06PM (#39954618)

That seems like a lot of extra effort for something that's arguably not your opsec problem, but that of the card payment industry.

In the end, you'll always have to enter it on payment websites anyway.

[ Parent | on HN ]

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by didntcheck on Saturday April 06, 2024 @03:16PM (#39954683)

I can certainly remember mine from repeated use, but I can't say I've ever heard of someone erasing it

[ Parent | on HN ]

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by catlikesshrimp on Saturday April 06, 2024 @04:07PM (#39955045)

I have done it since many years ago

[ Parent | on HN ]

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by justsid on Saturday April 06, 2024 @10:20PM (#39957616)

You can always tell what part of the HN regularly goes outside and interacts with normal people. I’m sorry but “just memorize the CVV and erase it from the card” isn’t something anyone really does. The comment that Google Wallet is more secure is a generally applicable comment.

[ Parent | on HN ]

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by M95D on Wednesday April 10, 2024 @06:40AM (#39989166)

You can always tell which part of HN does things right and which part does things easy.

[ Parent | on HN ]