Hacker News new | ask | show | jobs
by Oletros 3111 days ago
I have been used cards with chips for years and now contactless payments and they are a lot quicker than swipping the card. In less than 5 seconds is done

At least in Spain

1 comments

I assume spain is chip and pin?

In the US it's chip and signature, and you can't sign until after the chip verification (either signing a paper receipt, or with a stylus on the terminal screen).

In addition chips are new and some terminals are painfully slow (30 seconds) to verify. I'm not sure I've ever seen one finish in under 5 seconds, though a few merchants have terminals that come close to that.

The sad fact is the terminals are painfully slow because US banks don't think US customers want or are capable of using PINs.

When you use a PIN you get a nice two factor signature from the card chip: it signs the current timestamp and the PIN you knew, and can do both as quickly as chip's processing capability and the bandwidth between the chip and terminal allows.

US banks came up with a dumb compromise just like most of their websites use Wish-It-Were-Two-Factor auth and secondary "Security Question" passwords, the chip cards in the US are doing their own Wish-It-Were-Two-Factor: sign a timestamp, wait some amount of wall clock time, sign a different timestamp.

Most of the wait in a chip purchase in the US is artificial just to make sure that two timestamps are "sufficiently" different. US banks should just give people PINs and stop this silliness.

> The sad fact is the terminals are painfully slow because US banks don't think US customers want or are capable of using PINs.

Is this conjecture, or do you have actual citations to back this up? Those same banks have been issuing debit cards with PINs for a couple decades.

It's a bit intentional hyperbole, but not by much.

Every chip card I've received to date from several different major US banks has included some variation of "Great news! You don't need to learn or use a PIN to use this card."

My personal reaction every time has been, "But what if I want to use a PIN?" and this far I've never seen a satisfactory answer in those same letters or on those banks' own websites.

Admittedly that is purely anecdotal, as far as citations go, but in my mind it seems pretty clear what these banks think about PINs for credit cards.

Why can't you though? I feel that is an implementation detail that is leaking out. The machine can do two things at once and only use the signature if the transaction is successful.
Yes, chip and pin, and for amounts smaller than 20 euro you don't even have to put the pin if you configure the card
Chip & signature sounds awful (and pointless!) Why would they not use PIN?

We now have contactless payments for under £30 in the UK, similar to Apple pay but you just place your card on the reader.