> Better yet, if only the USA banks would finally get to this millennium and start using chip-and-pin cards. Then there would be no need for this nonsense.

What about a chip-and-pin card prevents a skimmer from either monitoring or emulating the radio conversation between the card and the terminal (and thus capturing the card number) and another keypad skimmer from capturing the PIN?

It seems to me that the problem is that everything required to conduct a transaction is handed to every merchant and/or untrusted machine of the merchant. (Compare to public key cryptography, where I remain in possession of a private key.) What about chip-and-pin changes that situation?

Chip and pin cards use public key cryptography. From my understanding, you would have to provide the PIN code to the device to first unlock it, and then you could verify the authenticity of the card by reading a public key, which identifies the card (and is used in transactions), and providing some nonce for it to sign for offline verification.

They also require the pin code to start the process, so you would have to skim that as well.

In addition to this, in the online scenario it can interact with the payment provider's servers to provide security.

The combination of these methods make rapid stealing of EMV cards difficult.

More info here: http://www.emvco.com/download_agreement.aspx?id=653

It is slightly more complex than that. EMV is designed as to allow configurable methods of card holder verification and to be backward compatible with back-end systems. This means that PIN is not required to unlock card and even not mandatory for successful transaction. This is configurable and whether PIN is actually required depends on both card's and terminal's configuration and current state, this allows for things like small payments without PIN (which is how NFC cards usually work).

Because of backward compatibility, the transaction signature generated by the card has to fit into 8 BCD digits, which essentially precludes use of any kind of public key cryptography. Actual algorithm for how signatures are generated and verified is issuer defined and only card issuer can actually verify signatures (terminal just blindly trusts whatever was returned by card).

Public key cryptography (ie. RSA) is used in EMV to verify that card was really issued by claimed issuer (card contains data structure that is signed by issuer's key) and to optionally encrypt PIN sent to card for offline verification (PIN is somehow regarded as super-sensitive by banking industry)

One can certainly imagine better design than EMV (eg. without various implicit trust relationships), but in all, it is pretty reasonable mechanism nonetheless.

Can you actually read the public key from the card? A secure system should sign the transaction on the chip, so even a manipulated machine could not steal the card data.

Card's and issuer's public keys can be read from the chip, but these are not directly relevant to actual transaction signing.

Even if these keys was relevant, the important part is that they are public keys, not private keys. You cannot get card's private key from the chip by normal means (ie. without doing something that is classified as attack, be it side-channel, physical inspection or exploiting some firmware bug/backdoor).

I don't know too much about the protocol used by these cards, but it would be easy to e.g. have a secret key on the chip, which signs the transaction (date and time, amount, location) if the right PIN is provided to it. Even listening in to all the communication between the card and the machine would not allow an attacker to make a bogus transaction.

Apart from that, making a skimmer that sits between the chip of the card and the contacts of the machine would be much harder to make than the current skimmers. So even if the chip would not sign the transaction but just provide static data if given the right PIN, the situation would be significantly improved.

This article has details about how cards using the EMV protocl work, and discusses a vulnerability that seems to have been exploited in the wild regarding predictability of a nonce (called the "unpredictable number", funny enough).

http://www.cl.cam.ac.uk/~sjm217/papers/oakland14chipandskim....

Chip and Skim: cloning EMV cards with the pre-play attack Mike Bond, Omar Choudary, Steven J. Murdoch, Sergei Skorobogatov, Ross Anderson Computer Laboratory, University of Cambridge, UK

There is no radio conversation in the most typical setup. The payment terminal has electrical connection to the contact surfaces of the smart card. While eavesdropping this link might be possible as well, it must require a lot more sophisticated equipment than stripe skimming.

Wireless payment by NFC is also a possibility, but at least with my card, no payments bigger than 25€ can be done through NFC.

In the UK we have chip and pin but the ATM's do not use them, we get skimmed just the same. http://www.bbc.co.uk/news/uk-england-london-28879973

Afaik UK ATMs do use chip-and-pin -- the thiefs you referenced installed a pinhole camera in order to retrieve PINs.

I do agree that skimming exists over here as well, a friend of mine got his card cloned once. He'd used it with an ATM located in a very central and visible place, famous for night-time entertainment -- thiefs must have thought drunk people don't pay too much attention to this sort of thing, especially when they've been queuing for a while (which they typically have to, at this location).

Same in Italy and France, last I heard; places where banks are extremely fraud/security-conscious and continuously maintain their infrastructure to guard from these threats.

Yes, was walking passed UK bank as it opened the other day and the anti-pinhole camera protocol was being carried out. One of the staff went round all the ATMs sweeping his hand across all surfaces to check that there wasn't anything untoward.

They are going to chips now. (But not pin, so it's chip-and-signature. Not quite as secure, but still much better than a magnetic stripe.) I have two credit cards with chips already, and expect all of them to switch within a year as changes to fraud liability rules coming into effect late 2015 essentially force everything to change over.