Comments on: Pet peeves revisited: Chip-and-PIN credit card “security” undermined http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/ Living the first class life -- at coach prices Fri, 09 Jan 2009 23:09:59 +0000 hourly 1 By: 1five9 http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/comment-page-1/#comment-560 1five9 Fri, 05 Jan 2007 21:35:41 +0000 http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/#comment-560 Thanks, Mark. Thanks, Mark.

]]> By: Oliver http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/comment-page-1/#comment-558 Oliver Fri, 05 Jan 2007 18:11:01 +0000 http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/#comment-558 Makes you wonder what a restaurant will do if you present them, after enjoying your meal, with a non-CHIP-enabled credit card for payment (thinking that the VISA/MC/Amex logo on their door was sufficient evidence that your card would be accepted). Will you end up in the kitchen cleaning dishes for the rest of the night? I might just try that out next time I am in Europe. What countries did you say use those CHIP/Pin systems? ;) Makes you wonder what a restaurant will do if you present them, after enjoying your meal, with a non-CHIP-enabled credit card for payment (thinking that the VISA/MC/Amex logo on their door was sufficient evidence that your card would be accepted). Will you end up in the kitchen cleaning dishes for the rest of the night? I might just try that out next time I am in Europe. What countries did you say use those CHIP/Pin systems? ;)

]]> By: Mark Ashley http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/comment-page-1/#comment-557 Mark Ashley Fri, 05 Jan 2007 17:46:33 +0000 http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/#comment-557 Oliver: Agreed, with every tactical innovation in security, someone will innovate to counter it. And I agree that the number of people who will hack the boxes, to play Tetris or otherwise, will be few. At the end of the day, my beef is not with efforts to make credit card transactions safer. I'm all for that. My beef is with limiting the ability of international customers to make purchases (see the "<a href="http://www.upgradetravelbetter.com/2006/10/04/rotten-in-denmark-credit-cards-with-mandatory-pin/" rel="nofollow">Rotten in Denmark</a>" post). <em>Especially</em> if the technology doesn't live up to its hype. Oliver:
Agreed, with every tactical innovation in security, someone will innovate to counter it. And I agree that the number of people who will hack the boxes, to play Tetris or otherwise, will be few.

At the end of the day, my beef is not with efforts to make credit card transactions safer. I’m all for that. My beef is with limiting the ability of international customers to make purchases (see the “Rotten in Denmark” post). Especially if the technology doesn’t live up to its hype.

]]> By: Oliver http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/comment-page-1/#comment-555 Oliver Fri, 05 Jan 2007 17:00:42 +0000 http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/#comment-555 Mark, my point really is: show me a secure technology and I'll show you someone who hacked it. I do think that in the big picture, it's quite a lot safer for the merchant to use the PIN-based terminal than to rely on my signature looking somewhat like the one on the back of my card. And I assume the merchants pay for the machine not to protect me, but rather to protect themselves. Is it safer for me? Probably as well; I doubt that there are going to be a ton of merchants all over Europe hacking their terminals (why bother... just write down my credit card number, expiration date and CVC code). But honestly I am not too concerned about that as my ultimate liability is very limited. Oh, and I don't have a PIN/Chip, so my card won't ever find its way into one of those machines. Mark, my point really is: show me a secure technology and I’ll show you someone who hacked it. I do think that in the big picture, it’s quite a lot safer for the merchant to use the PIN-based terminal than to rely on my signature looking somewhat like the one on the back of my card. And I assume the merchants pay for the machine not to protect me, but rather to protect themselves.

Is it safer for me? Probably as well; I doubt that there are going to be a ton of merchants all over Europe hacking their terminals (why bother… just write down my credit card number, expiration date and CVC code). But honestly I am not too concerned about that as my ultimate liability is very limited. Oh, and I don’t have a PIN/Chip, so my card won’t ever find its way into one of those machines.

]]> By: Joe http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/comment-page-1/#comment-554 Joe Fri, 05 Jan 2007 16:54:40 +0000 http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/#comment-554 I work in the retail credit side of the business, so I get to see all the various cards and card processing systems that come out and sadly I'm forced to agree with you. For whatever reason, Euro issuers are dead set on the chip-and-pin model...you know how it goes: they make up their mind to take the wrong course of action and then stick to it. I work in the retail credit side of the business, so I get to see all the various cards and card processing systems that come out and sadly I’m forced to agree with you. For whatever reason, Euro issuers are dead set on the chip-and-pin model…you know how it goes: they make up their mind to take the wrong course of action and then stick to it.

]]> By: Mark Ashley http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/comment-page-1/#comment-552 Mark Ashley Fri, 05 Jan 2007 16:21:36 +0000 http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/#comment-552 1five9: I've heard that chip-and-PIN is prevalent around Cape Town, but that it's not mandatory. Ask to swipe and sign. Oliver: We're not really trying to compete for the "whose hack-able technology is worst" championship here, are we? (An aside: When I voted in the last election here in Chicago, voters were given a choice between paper ballots and touch-screen voting machines. While I was there, every single person who was offered a touch-screen machine ("no waiting!") vehemently refused. At least we had a choice. In other districts, there was no choice. Much like there is no choice to use a different model of credit card terminal at the supermarket...) And you're right, many banks don't give the same protection as credit cards for customers using the PIN-enabled swipe terminals in the US. I haven't used a debit card with a PIN at a store in years. More risk, and no miles... I'll stick with the credit card. 1five9: I’ve heard that chip-and-PIN is prevalent around Cape Town, but that it’s not mandatory. Ask to swipe and sign.

Oliver: We’re not really trying to compete for the “whose hack-able technology is worst” championship here, are we? (An aside: When I voted in the last election here in Chicago, voters were given a choice between paper ballots and touch-screen voting machines. While I was there, every single person who was offered a touch-screen machine (”no waiting!”) vehemently refused. At least we had a choice. In other districts, there was no choice. Much like there is no choice to use a different model of credit card terminal at the supermarket…)

And you’re right, many banks don’t give the same protection as credit cards for customers using the PIN-enabled swipe terminals in the US. I haven’t used a debit card with a PIN at a store in years. More risk, and no miles… I’ll stick with the credit card.

]]> By: Oliver http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/comment-page-1/#comment-551 Oliver Fri, 05 Jan 2007 15:58:05 +0000 http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/#comment-551 Well, one continent has hackable voting machines, another has hackable credit card terminals. What's worse? You pick... What about those PIN-enabled ATM/debit card terminals that become more and more popular in US stores (because of lower fees for merchants)? As far as I know, unlike with credit cards, consumers don't even have the protection of the law as far as limited liability if someone unauthorized accesses their accounts ... Well, one continent has hackable voting machines, another has hackable credit card terminals. What’s worse? You pick…

What about those PIN-enabled ATM/debit card terminals that become more and more popular in US stores (because of lower fees for merchants)? As far as I know, unlike with credit cards, consumers don’t even have the protection of the law as far as limited liability if someone unauthorized accesses their accounts …

]]> By: 1five9 http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/comment-page-1/#comment-548 1five9 Fri, 05 Jan 2007 15:25:01 +0000 http://www.upgradetravelbetter.com/2007/01/04/pet-peeves-revisited-chip-and-pin-credit-card-security-undermined/#comment-548 I'm headed to South Africa in a few weeks and I was curious if anyone had any idea if PIN numbers were required there. I’m headed to South Africa in a few weeks and I was curious if anyone had any idea if PIN numbers were required there.

]]>