Hacker News new | past | comments | ask | show | jobs | submit login

Actually, I just wish that US banks would get up to speed with the Chip & PIN thing Europe has been doing since the '90s.

Every time I buy groceries here in England, I get grief about my ancient relic of a Visa card that doesn't even have a chip on it, and thus requires swiping through a reader like the cavemen used to do and then signing a piece of paper.

About every 3rd visit, I get to have a manager called over and explain that I come from a primitive country where the banks still do things the old way.

It's embarrassing.




I think UK was also the last in Europe to use chips on the cards, which, as far as I know, are the French invention. I remember using their specialized cards with chips there twenty years ago only to make some phone calls.

By the way a lot of elementary security issues with cards are there because all the mechanisms still have to allow Americans to use their magnetic stripes, allowing simple tricks with them that would otherwise not be possible. On another side, chips are no silver bullet when it comes to the security. There are a lot of possible attacks, just some specific set of them would be excluded by only having chips. So no matter how it's popular among the geeks, the real-life solutions to real life problems are not purely technological and probably will never be.

Still, as I live in Europe, I'd personally like to have the cards without the magnetic strip.


Chip and PIN have one major drawback for you though: they shift the liability from the merchant to the consumer. With conventional cards you can contest a purchase and the merchant is out of pocket. With Chip and PIN it's like a debit card and typically you the consumer is out.


Hm? I have combined and separate Visa- and MasterCard-branded chipped cards. Insofar as I know, they work as credit/debit normally does.


Yes, but the card never leaves my hand, and since it's a challenge-response system, you can't skim the data off of it with a fake reader. This means that for someone to buy stuff in my name, they would need to steal my card and peek at my pin-code, and unless I'm a bumbling moron, I will notice if you steal my credit card.


Chip and pin was broken pretty thoroughly early this year: http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-i...


Swiping and signing is heck of a lot faster than figuring out which to insert the card in this particular terminal, waiting for the damn machine wade through its various phases and navigating through a couple of menus, and eventually entering the PIN code followed by the green enter key.

But that's not the real problem, in my opinion.

With hand-written signatures I was pretty sure that if someone stole my card then with great certainty he couldn't replicate my signature in a way a professional hard-writing analyst could be fooled. Thus, I would have some buffer of justice against the period between stealing my card and informing the bank about it. They could just run the signatures and I would have a pretty strong proof that someone else counterfeited my signature.

With PIN code it's different. As soon as someone types in the correct PIN code, everything is kosher and validated. I can't prove it wasn't me. It doesn't really matter that you're supposedly the only one who knows the PIN code because it's dead easy to eavesdrop and then you're out of luck.


> Swiping and signing is heck of a lot faster than figuring out which to insert the card in this particular terminal

Well, there's always the issue of unfamiliar terminals, but that's a question of habit. I, for one, can complete a chip+pin transaction faster than most terminals can print a slip for signing.


What country are you in? The machines in Zurich pretty much always take 8-10 seconds just to get around to asking for a PIN, then a further 5 seconds to confirm. This, in a reasonably wired city where both my bank and the merchant's bank are a couple blocks down the street. At grocery stores in North America, I usually swipe the card, sign the screen, and have a receipt in under 5 seconds.


The screen-signing solution is very fast - I was talking about paper-signing.

I'm in the UK now, but I'm talking about Denmark. I'm probably pretty biased by my experience with my Danish chip-card that still requires a signature here. I'm often asked by confused checkout assistants if I have a pen. Not fast.

In the beginning, when the chip-cards were rolled out in Denmark, they were very slow, on the scale of what you're describing, but it's much faster now.


Agreed, most terminals I use are pretty quick - certainly a lot faster than waiting for a bit of paper to be printed, singing it and then the bits of paper torn apart.


Banks in the US do issue such cards, and in NYC at least I see them used. Are you certain that your bank does not?


Amex Blue has the Euro chip.


I will need you to cite your source on that claim. I have the original Blue, with the chip to which you refer, and can assure you that it is not the same chip as in "chip and pin".

It was marketed by Amex with a special RFID-esque reader that was designed to unlock your Amex "password vault" or some such silliness.

It was such a flop that the new Amex cards have switched to actual RFID (or similar technology) for use in "Speed Pay" or whatever, in that you need not take your card out of your wallet to buy things at CVS or Whole Foods (for example).


You are correct, they are not compatible.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: