After the recent Target hack there has been talk about moving from credit cards with magnetic stripes to cards with a chip.
In what ways are chips safer than stripes?
|show 15 more comments|
You can't clone the chip.
A magnetic strip holds a secret number, and if someone knows that number they can claim to be the owner of the card. But if a bad guy swipes the card, they then know the number, and can make their own card, i.e. "cloning". This has turned out to be a major practical problem with magstripe cards.
A chip also holds a secret number. However, it is securely embedded in the chip. When you use the card, the chip performs a public key operation that proves it knows this secret number. However, it never reveals that secret number. If you put a chipped card in a bad guys machine, they can impersonate you for that one transaction, but they cannot impersonate you in the future.
All of the above assumes that the implementation of the chip is good. Some chips have been known to have implementation flaws that leak the secret code. However, chip and pin is now pretty mature, so I expect most of these issues have been ironed out.
|show 10 more comments|
The chip carries out a cryptographic operation on data passed to it that requires knowledge of the key that is strongly protected within the chip - so an attacker cannot easily copy the card.
That said, there have been some successful research papers on timing or power attacks, but these are from lab conditions, and probably not a real worry in the wild.
In the UK pretty much all bank cards are chip and pin - which does lead to one of our most common types of fraud: The magstripe is skimmed, and the details used in a country with no chip and pin infrastructure.
|show 4 more comments|
The magnetic strip contains the exact information used to identify the card. The chip holds a piece of information that it doesn't share, but that it can use to prove it has that information.
Thus, a magnetic stripe is dumb and can be copied, but since the chip doesn't give out its secret, a vendor can't simply copy it when you use it.
A magnetic stripe says "I'm credit card ABC." when the point of sale asks the number. With a chip the point of sale says "what is your response to this random value?" and the chip gives a response that the point of sale can validate, but since the next point of sale will use a different random value, the response is useless to a thief.
Other answers already given are correct, but I would like to give the following as an answer with no technical background required on part of the person asking:
When you use a magnetic strip Credit Card, the device is saying to the card: "My user will input a PIN to verify, let me read your strip so I can check it".
OK, the above paragraph is not what actually happens. But the POS (or other) device reads (or is capable of reading) all the information contained in the strip. That means you can manufacture a card which is for all intents and purposes a copy. )
When you use a chip Credit Card, the device is saying to the chip on the card: "My user has provided 4567 as the PIN, is it correct?"
Now, because the chip is smarter than a magnetic strip (which is in effect only a store for data), it can answer this question. This way, the PIN can stay hidden.
|show 3 more comments|
You might want to clarify your question - here's an answer as to why it's safer card issuer:
If a magstripe card is stolen it's quite easy for the thief to use it fraudulently - how often are signatures really checked (in fact in the US I've often had the card handed back to me before I've signed, even where extra ID isn't requested).
If a chip&pin card is stolen then used fraudulently, the card alone is not sufficient for use - a good thing of course - but that puts the onus on the owner to protect the pin (check the T&Cs). Say the card was stolen just after the owner used a cashpoint where the thief shoulder-surfed the PIN, then the thief is at least as likely to get away with using the card - and can now withdraw cash rather than just buying goods as a forged signature would allow.
Then of course there's the simple matter of intimidating (or worse) the victim of a theft into handing over the PIN.
Here's a BBC article - we're on chip&pin in the UK - a quote from near the end
edit: generalised "bank" to "card issuer"
This question is protected to prevent "thanks!", "me too!", or spam answers by new users. To answer it, you must have earned at least 10 reputation on this site.