Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Even if the kiosk loads the payment terminal firmware, that firmware will be signed.

It’s 2022, pretty much all developed nations use chip cards so you wouldn’t have anything to gain from this exercise anyway.



I'm not sure I understand why you brought up chip cards so this may be irrelevant, but in the US cards still have magnetic strips, and I believe most terminals are configured to fail over to the strip reader after a few failed attempts to read the chip.


There’s a process to it.

Every card, as part of the mag-stripe, has a little bit of data on it called the Service Code. It’s three characters. Part of that tells the terminal if the card has an EMV chip.

The terminal is required (I believe, by the brands) to force you to use the chip. The chip has to fail a set number of times (I believe usually 3) before it will process a mag-stripe transaction.

Even then, the payment processor is informed this transaction was a failed chip transaction that fell back to msg-stripe. So the processor can determine if they want to take the risk.

(Of course this doesn’t apply to mag-stripe only devices like older gas pumps)


It’s possible for a compromised payment terminal to record magnetic stripe card data. These kinds of payments essentially do not exist in developed countries.

It’s not possible for a compromised payment terminal to do anything interesting with other kinds of cards.


In the US skimming of mag-stripe is still surprisingly/sadly common.

Most(?) store gift cards don’t have chips. I think some smaller banks may not have chips on debit cards. I don’t know about “food stamp” cards or gas station branded cards.

So as a thief you can collect what you can get. Plus you can screw up the EMV slot so people must swipe, making them vulnerable (if they don’t use contactless).


> you can screw up the EMV slot so people must swipe

I think that outside of USA most banks would configure their systems to automatically decline any transaction from a chip-capable terminal for a chip-capable card (to prevent cloned cards from being used with just the mag-stripe data), so swiping would be possible only on terminals that never had a EMV slot in the first place, and IIRC even that is limited to certain regions as in many countries it's expected that all terminals must be chip-capable; a damaged EMV slot should result in the bank returning an error code effectively saying 'broken terminal, repair or use another' instead of permitting to swipe.

Alternatively, I think I have seen contracts (for merchants who really wanted to keep swipes longer than the expected transition) that say that any fraudulent swiped transactions are fully paid for by the merchant.


That wouldn’t surprise me. Everything about the way we’re doing this in the US is going slow. I mean we’re only just starting to get it on gas pumps.

It wouldn’t surprise me if mag-stripe is just turned off in a few years.


It definitely took the US a long time to get started, but I think once it got started it's nudged along at a reasonable pace. RFID pay at least is growing a lot faster than chip pay did previously.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: