8

The new Chip credit cards are being introduced to provide better security to consumers, merchants and credit card vendors.

Sample Card:

MasterCard Chip Card
(source: mastercard.com)

Card Reader & PIN Entry:

Chip Card Reader

Are they really better from a security point of view? What are the advantages and disadvantages?

  • Hey Z! Congratulations on your Fanatic gold badge :-) :-) – Chris W. Rea Feb 26 '10 at 1:34
  • Has it been that long? :-) – Zephyr Feb 26 '10 at 4:15
11

Cambridge researchers called this system fundamentally broken. Here's the news story on ZDNet.

It relies on the card to authenticate that the PIN inserted was correct, and the card merely sends a "PIN okay" note to the payment processing system. This "everything OK" signal can be faked. If the PIN challenge was communicated over a secure channel over the network to a central authentication mechanism somehow, it would have been more secure than the card alone. (There's a couple of schemes you can use to do that without transmitting the PIN itself, too, for extra security.) But they didn't do any of these.

So, it makes stolen cards a little harder to use, and makes forgery a little trickier, but doesn't really do much else. It's like one of those locks on your door that can be jiggled open with a credit card: a casual deterrent. Which is worth something; however, if it fails,

Anderson noted that in disputed transactions, if the transaction has been verified by PIN, the liability for the loss rests on the consumer rather than on the bank or merchant.

Fun, huh?

  • 6
    so it is only a 'security' feature for the card issuer who can now disclaim liability. Nice. – harmanjd Mar 2 '10 at 23:52
  • @harmanjd: Yup, plus it's solving a problem that doesn't really exist. I don't know anyone who has had a credit card compromised by a retail clerk or waiter. Why? It's pretty trivial for police to prosecute. I do know about a half dozen people who were victimized by fraudulent activity when a shoe store's systems were hacked -- 6 months after a purchase. Why would a thief go to the effort to clone the mag-strip on a credit card when there are so many other, easier ways to get money? – duffbeer703 Feb 8 '11 at 14:56
  • The ability to use PIN for credit card transactions exists for both EMV and mag stripe (at least, in Australia) - it's scheme (MC/VISA) policy, rather than any technical reason, for transferring liability to the card holder for PIN based transactions. – dkam Feb 8 '11 at 23:04
  • 3
    @duffbeer703 - actually fraud where the retailer compromises the card is very very common, especially in countries without chip and pin such as the US. Cloning magstrips is easy, cheap and convenient! – Rory Alsop Feb 23 '11 at 10:44
  • 1
    @fennec - can you figure out where the link is, the one you share doesn't work anymore/is outdated. – shirish Dec 20 '16 at 22:52
7

There's little doubt that EMV has better security than simple mag stripe cards. EMV cards currently can't be skimmed or duplicated, unlike mag stripe cards. That gets rid of a bunch of fraud channels.

The EMV standard is large and there are many ways to implement it. There are currently(?) 3 types of chips - SDA, DDA and CDA, with each chip improving security. With such a large standard, and so many ways to implement it, there are bound to be insecure combinations. It's far from perfect.

Allowing the Chip to authenticate the PIN (Offline PIN) is not mandatory. In Australia for example, I believe it's uncommon as EFT terminals are always online - in Europe I understand it's more common to have terminals which are offline. So I believe the attack linked from ZDNet wouldn't work in Australia. Which isn't to say there aren't others - see here for another great attack: http://www.schneier.com/blog/archives/2010/02/man-in-the-midd_1.html

EMV will be the future in most countries, with the US being the exception (It's the only exception I know of, but I'm no expert) where EMV has yet to take hold, partly, I hear, due to the cost of rolling out such a large number of new terminals. In Australia at least, MasterCard and VISA tune the liabilities to favour companies which adopt the new standards. This has the effect of encouraging take up of EMV and other schemes like 3D-Secure.

4

As a consumer, I don't really care at all about the security of payment cards. I don't carry debit cards, and fraud on my credit cards is the bank's problem. The cost of a card compromise to me is a 5-minute phone call.

Personally, I'm wary of PIN-transactions because banks have a tendency to consider 12 bits of entropy (ie. 4 numbers) as a foolproof security measure that shifts liability for fraud to me.

If this technology actually reduces fraud to a level that improves the bottom line of the issuing banks, you'll know when they start replacing the current magnetic stripe cards en masse. Judging by the fact that American Express abandoned chip and pin efforts (the original hook for the "Blue" card), new credit card paradigms like RevolutionCard haven't had a ton of uptake, and RFID payment doesn't seem to be a big deal to consumers, my guess is that it doesn't have a big impact.

  • The world is changing en masse. The US is the exception to the rule. It'll be interesting to see what the US does. – dkam Feb 8 '11 at 23:19
2

They are better for the bank, as the terms put more liability on the user. They can be a little more secure in some circumstances, but while some countries still avoid using chip and pin a simple attack which is incredibly common is fir attackers to get the magstrip and pin code and send them to one of those countries where a cloned card can be used, or for simple 'card not present' transactions - like Internet shopping.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .