183

After the recent Target hack there has been talk about moving from credit cards with magnetic stripes to cards with a chip.

In what ways are chips safer than stripes?

21
  • 6
    ever put a strong magnet to a stripe? Jan 23, 2014 at 14:33
  • 13
    @ratchetfreak Wouldn't that make the chip more secure (albeit, unusable)?
    – BanksySan
    Jan 23, 2014 at 18:22
  • 16
    I was listening to NPR talk about this topic this morning. Apparently most of the world aside from the US have moved away from magnetic stripes.
    – agweber
    Jan 23, 2014 at 18:59
  • 5
    @BanksySan Security is Privacy, Integrity, Availability.
    – David
    Jan 23, 2014 at 20:08
  • 4
    @Jim in Belgium the bank issues a challenge and you need the chip and a special device+PIN to get the response for it Jan 24, 2014 at 9:14

5 Answers 5

229

You can't clone the chip.

A magnetic strip holds a secret number, and if someone knows that number they can claim to be the owner of the card. But if a bad guy swipes the card, they then know the number, and can make their own card, i.e. "cloning". This has turned out to be a major practical problem with magstripe cards.

A chip also holds a secret number. However, it is securely embedded in the chip. When you use the card, the chip performs a public key operation that proves it knows this secret number. However, it never reveals that secret number. If you put a chipped card in a bad guys machine, they can impersonate you for that one transaction, but they cannot impersonate you in the future.

All of the above assumes that the implementation of the chip is good. Some chips have been known to have implementation flaws that leak the secret code. However, chip and pin is now pretty mature, so I expect most of these issues have been ironed out.

15
  • 60
    While it is hard to reverse-engineer one of the chips which are usually used in chip-cards, it isn't impossible. It's just that you need lab equipment worth several thousand dollar and experts who know how to use it, while a magnet stripe can be cloned by anyone with $100 hardware and step-by-step instructions.
    – Philipp
    Jan 23, 2014 at 14:59
  • 33
    @Philipp For most crimes it is not enough to be able to clone the card, you also have to do it without the owner noticing and blocking it. If you have already stolen the card in order to bring it to your chip-scanning lab to copy it, why would you need a copy? Jan 23, 2014 at 16:38
  • 6
    The current chip-enabled credit cards, at least here in the US, don't use crypto. My smartphone can use NFC to steal all the info that is on the chip in my Visa card (which includes everything that is on the magnetic strip). Jan 23, 2014 at 17:44
  • 5
    You can clone a chip, as noted in this question security.stackexchange.com/questions/46319/…, and it's more trivial than using equipment beyond the reach of most. It takes much more effort and equipment than a magstripe copy, but it can still be done for under $1000.
    – Owen
    Jan 23, 2014 at 18:00
  • 11
    Also, there are non-technical security benefits to the chip & pin system. For example, if you are paying for your meal at a restaurant, if you use a magstrip card, you typically hand your card to the waiter after he brings the check. He then usually processes your transaction at the cash register, which means your card leaves your sight for a minute or so, ample time to clone your card if anyone in the restaurant staff is a crook. With a chip card, a portable POS device is needed, or the customer goes to the cash register, the card being in his or her sight the whole time. Jan 24, 2014 at 0:07
68

The chip carries out a cryptographic operation on data passed to it that requires knowledge of the key that is strongly protected within the chip - so an attacker cannot easily copy the card.

That said, there have been some successful research papers on timing or power attacks, but these are from lab conditions, and probably not a real worry in the wild.

In the UK pretty much all bank cards are chip and pin - which does lead to one of our most common types of fraud: The magstripe is skimmed, and the details used in a country with no chip and pin infrastructure.

10
  • 2
    +1 for magstripe fraud abroad. It was also the case for a while that some cash machines only checked magstripe. I think this is now fixed
    – paj28
    Jan 23, 2014 at 14:16
  • IIRC the chip also supports a legacy mode which uses a CVV1 like the magnetic stripe (no crypto going on).
    – Bob
    Jan 23, 2014 at 16:32
  • 2
    Also the man-in-middle attack was proven some time back. Going to become much easier with such powerful mobile devices we all carry. Jan 23, 2014 at 21:00
  • 4
    Is it possible to get a chip and pin card without a magnetic stripe?
    – gerrit
    Jan 24, 2014 at 11:26
  • @gerrit a strong magnet corrupts the magnetic stripe, so just diy it :) Jan 24, 2014 at 13:43
34

The magnetic strip contains the exact information used to identify the card. The chip holds a piece of information that it doesn't share, but that it can use to prove it has that information.

Thus, a magnetic stripe is dumb and can be copied, but since the chip doesn't give out its secret, a vendor can't simply copy it when you use it.

A magnetic stripe says "I'm credit card ABC." when the point of sale asks the number. With a chip the point of sale says "what is your response to this random value?" and the chip gives a response that the point of sale can validate, but since the next point of sale will use a different random value, the response is useless to a thief.

15

Other answers already given are correct, but I would like to give the following as an answer with no technical background required on part of the person asking:

When you use a magnetic strip Credit Card, the device is saying to the card: "My user will input a PIN to verify, let me read your strip so I can check it".

( EDIT:

OK, the above paragraph is not what actually happens. But the POS (or other) device reads (or is capable of reading) all the information contained in the strip. That means you can manufacture a card which is for all intents and purposes a copy. )

When you use a chip Credit Card, the device is saying to the chip on the card: "My user has provided 4567 as the PIN, is it correct?"

Now, because the chip is smarter than a magnetic strip (which is in effect only a store for data), it can answer this question. This way, the PIN can stay hidden.

9
  • 7
    This is not correct. The PIN is not stored on the magstrip (although it is right that the chip can authenticate the PIN). The problem with magstrip is cloning of the card to be used without a PIN, not leaking the PIN.
    – user22393
    Jan 23, 2014 at 18:36
  • 1
    +1 for the edit - the new explanation is good. Jan 23, 2014 at 21:09
  • 3
    If the device says to the card "the user entered PIN 1234" and the card says back, "that is correct", how, exactly, does the PIN remain hidden? Jan 24, 2014 at 0:36
  • 1
    @SoftwareMonkey the device is the input device for the pin you can't hide it from that, to prevent brute force the chip disables itself after 3 tries Jan 24, 2014 at 9:16
  • 1
    @iconoclast: Indeed, but I think the assumption is that the POS device is at least as hard as the card to manipulate. I don't know how feasible it would be to build an "evil" POS terminal that logs all pin codes, but you still need to steal the card which the cardholder will probably notice (contrary to the magstrip case where you can quickly copy the card without the owner noticing). Jan 27, 2014 at 12:00
7

You might want to clarify your question - here's an answer as to why it's safer card issuer:

If a magstripe card is stolen it's quite easy for the thief to use it fraudulently - how often are signatures really checked (in fact in the US I've often had the card handed back to me before I've signed, even where extra ID isn't requested).

If a chip&pin card is stolen then used fraudulently, the card alone is not sufficient for use - a good thing of course - but that puts the onus on the owner to protect the pin (check the T&Cs). Say the card was stolen just after the owner used a cashpoint where the thief shoulder-surfed the PIN, then the thief is at least as likely to get away with using the card - and can now withdraw cash rather than just buying goods as a forged signature would allow.

Then of course there's the simple matter of intimidating (or worse) the victim of a theft into handing over the PIN.

Here's a BBC article - we're on chip&pin in the UK - a quote from near the end

[The victim's bank], Barclays, returned the £640 she had lost, but some banks can be reluctant to pay refunds if people have been careless with their Pin codes.

edit: generalised "bank" to "card issuer"

4
  • 1
    If there's some particular way the asker should clarify their question, could you leave a comment on the question requesting that clarification? Comments are the place for clarification requests, rather than answers. Ironically it's unclear in what way you find the question unclear, so please be clear about that! Jan 23, 2014 at 23:28
  • @JonathanHobbs, fair enough, but I wasn't asking for clarification per se. I was answering the question from another point of view while acknowledging that the OP problem meant "safer for the user"
    – Chris H
    Jan 24, 2014 at 8:37
  • You could check an ID, but the cashier has no knowledge that a signature is valid or that it belongs to the person. Jan 27, 2014 at 15:40
  • Unfortunately, EMV (the Chip & PIN protocol) has numerous flaws which historically meant the card is sufficient. For instance, the "PIN okay" response form the card can be trivially subjected to a MITM attack, since the reply "all OK" 0x9000 signal from the chip to the PIN entry device is not authenticated (source: cl.cam.ac.uk/~sjm217/papers/oakland10chipbroken.pdf). I have lost track of the current state of vulnerabilities in EMV such as these, but the banks have historically been reluctant to fix them. (Cheaper to pay-out in the handful of successfully challenged cases.) Jun 17, 2015 at 23:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .