Tag Info

Hot answers tagged

181

You can't clone the chip. A magnetic strip holds a secret number, and if someone knows that number they can claim to be the owner of the card. But if a bad guy swipes the card, they then know the number, and can make their own card, i.e. "cloning". This has turned out to be a major practical problem with magstripe cards. A chip also holds a secret number. ...


63

Checksums CC numbers, as well as pretty much any other well designed important numbers (e.g. account numbers in banks) tend to include a checksum to verify integrity of the number. While not a security feature (since it's trivial to calculate), a decent checksum algorithm can guarantee to always fail if (a) a single typo was made or (b) two neighbouring ...


57

The chip carries out a cryptographic operation on data passed to it that requires knowledge of the key that is strongly protected within the chip - so an attacker cannot easily copy the card. That said, there have been some successful research papers on timing or power attacks, but these are from lab conditions, and probably not a real worry in the wild. ...


53

The liability for a disputed transaction falls upon the merchant for Card-Not-Present transactions. Essentially, if you dispute a transaction, if the merchant doesn't have your signature, then if you persist they will end up footing the bill. By the same token, when a CNP merchant double bills you, they're going to end up paying when you dispute the bill. ...


50

Most likely answer: They don't have to (it's not a PCI requirement) It's better from a UI/support standpoint Let's keep this in perspective. This is the number that's printed, on the back of the card, right where minimum-wage cashiers are instructed to visually inspect when performing a POS transaction. Absolute secrecy from physical bystanders is ...


48

That code isn't necessary. This may cause more fraud and more chargebacks, but Amazon keeps those numbers low so that they can offer a faster shopping experience such as one-click. The only thing necessary to make a purchase is the card number, whether in number form or magnetic. You don't even need the expiration date. Most systems require more information ...


46

Any Faraday cage will do the trick. So a shielding of just about anything conductive, be it aluminum foil, conductive paint, wire mesh, or any of a number of similar alternatives is going to be opaque to radiation. That means no radio waves in or out, which means the RFID signal is blocked. Note that the size of the mesh has to be significantly smaller than ...


37

First, it's important to understand that security is not binary. It is not an "on" or "off" concept, but a continuum or risk management options, and each decision comes with a cost. Either the additional cost of controls or mitigation as you move toward the "secure" end of the spectrum, or the cost of exploitation as you accept more risk towards the ...


36

In the United States, they use the Luhn algorithm: http://en.wikipedia.org/wiki/Luhn_algorithm How the algorithm verifies a number: From the rightmost digit, which is the check digit, moving left, double the value of every second digit; if the product of this doubling operation is greater than 9 (e.g., 8 × 2 = 16), then sum the digits of the products ...


33

Amazon pays a slightly higher rate to accept your payment without the CVV, but the CVV is not strictly required to present a transaction - everybody uses CVV because they get a lower rate if it is present (less risk, less cost). Nobody who knows what they are doing will store your CVV - if the card networks suspect that you are storing CVV, you will have ...


28

As Phil stated, you can still use the card using its number (as you would do on-line). Also, some ATM machine won't accept the card if not able to read the magnetic strip. The best thing is to use a credit card: in that case you can block the payment and get a refund.


27

Ok, so if this is a business requirement that you must meet (check to see if a card already exists in the system) this is how I would do it. First, PCI-DSS does allow for a PAN (the primary account number, or credit card number) to be stored in hashed form using "strong cryptography" and they recommend (but do not require) that a salt be used as well. ...


26

You don't actually need the CVV to perform transactions, they're just required by most retailers as a means of verifying that you have the physical card in your possession. From Wikipedia (unsourced): It is not mandatory for a merchant to require the security code for making a transaction, hence the card is still prone to fraud even if only its number ...


26

Storing card numbers means you must comply with the requirements of PCI-DSS, or you risk fines and breach of your merchant account contract. PCI-DSS has an enormous set of requirements - some sensible, some onerous, some of questionable usefulness - and the cost of complying with it, and certifying that you've complied with it, can be very high. Download ...


25

I'm not an expert at using stolen credit cards... but from what I know: You could resell the numbers on the black market. You could buy stuff and have it shipped to a rube who reships it to you. You could "quickswap" on eBay. (Use the credit card to purchase an item that is shipped directly to the auction winner, and you pocket the money from the auction ...


24

"None of us are security experts" and "I wouldn't feel comfortable with a company storing my credit card information in this manner" are completely valid arguments. From a technical perspective (on the merits), they ought to end the discussion. But if you're arguing with folks who are not security experts, they may not be in a position to recognize good ...


24

Cardholder name, 4 last digits of CC number and its expiration date are all NOT sensitive data. The cardholder name and expiration date only require protection if you are storing them with the full primary account number, not the truncated 4 digit number. If you are storing, processing, or transmitting cardholder data then you must meet all of the other PCI ...


23

From an end user perspective, i usually give the reader and surrounding plates a good whack with my fist and i try and peel back any of the faceplates with my keys or a knife. The fact of the matter is, the best quality skimmers aren't detectable. POS machines can be hacked which results in an almost undetectable scenario. Your best bet, if you want to avoid ...


23

Yes, you can. On some places you can find a device called demagnetizer. Just run your card over it (or over a very strong magnet), and the magnetic track will be corrupted and you will only be able to use the chip part of the card.


22

The magnetic strip contains the exact information used to identify the card. The chip holds a piece of information that it doesn't share, but that it can use to prove it has that information. Thus, a magnetic stripe is dumb and can be copied, but since the chip doesn't give out its secret, a vendor can't simply copy it when you use it. A magnetic stripe ...


21

Yes, that last someone is correct, in addition to encryption (confidentiality) HTTPS gives you the assurances that the form is coming from where you think it is (authentication), and that it has not been interfered with in transit (integrity). Without HTTPS the form could be modified by a MITM as described. It'sNot using HTTPS for this is simply bad ...


18

Next time you go to the shop leave your card in your wallet and try as much as you can to pay for your purchase. Try with several different card readers to be sure. If you can't pay, then it's pretty well protected. If you can, well... I can't speak for that particular wallet but it is certainly possible to block RFID in that manner. It just depends if they ...


17

The CVC (sometimes "CVV" or "CVV2") is supposed to indicate whether the card is present at the time of the transaction. Card companies require that it never be stored or recorded, but rather passed directly from the customer to the merchant gateway and then immediately forgotten. Therefore, any time you give that number to a merchant, they're supposed to use ...


17

I cannot comment on how Stripe does this but I can tell you exactly how Braintree does it (because that is where I work). If I had to guess, Stripe probably uses a similar method. In the Braintree API, we offer a unique number identifier for a credit card. This identifier is a random opaque token that will always be the same for card number stored in our ...


15

Aside from the already mentioned attacks involving unauthorized usage of a credit card, the credit card information can also be used for social engineering and identity theft. As a somewhat current example, see how Mat Honan got hacked last summer : http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ In his case, Apple only required ...


15

Hashing credit card numbers is not a substitute for securing the data. If your system isn't secure enough to store raw credit card numbers then it's not secure enough to store CC hashes. Same thing for anything that's a fixed size and limited character set: date of birth, phone number, zip, etc. Credit cards are all sixteen digits and while 10^16 seems ...


14

Creating Luhn valid credit card numbers is not difficult, if you need them they're available here amongst other places. The trick for the criminal is tieing up the credit card number to the rest of the data to create a fraudulent transaction (CVV, expiry, name, perhaps address). Even if I have the customers name, expiry date and last 4 digits, brute force ...


14

Other answers already given are correct, but I would like to give the following as an answer with no technical background required on part of the person asking: When you use a magnetic strip Credit Card, the device is saying to the card: "My user will input a PIN to verify, let me read your strip so I can check it". ( EDIT: OK, the above paragraph is not ...


14

Embossed letters are still present on CC to allow to quickly carbon-copy (literally) the card on paper. That's in the (very) old days, but still allowed today, and it will count as PRESENTIAL. Magnetic strip is still there because half of the CC readers still work that way. ATM and TPV outside USA and UE are still missing the chip reader, and even inside ...


14

Of course you should worry. If the credit card payment processor is not able to fix well known and obvious security problems (A few days ago RC4 got explicitly prohibited for use with TLS by the IETF) which are even visible world-wide from outside, how will be the status of their internal security? Note, that it might be not that bad to offer RC4 for ...



Only top voted, non community-wiki answers of a minimum length are eligible