Hacker News new | ask | show | jobs
by elric 1835 days ago
I agree that the pandemic has been a big driver of contactless payments. I dislike them myself. NFC terminals get confused as hell if there are multiple contactless cards nearby (there are 6 in my wallet, none of which I use..). Inserting a card in the terminal and entering my pin is only a few seconds slower and it feels more secure.

We used to have a chip-without-pin payment scheme for small amounts, called Proton, but it never really caught on and got scrapped a few years back.
1 comments
rjmunro 1834 days ago
What do you mean by using your PIN "feels more secure". It's more secure for the retailer, but it's less secure for you.

Any time you have to enter your PIN you are putting yourself at risk of someone seeing it. It could even be a fake PIN pad, so covering with your other hand won't help. If they can then steal the card from you, they can spend freely at merchants and withdraw cash at any ATM up to 2X your daily limit (once at 23:59, once at 00:01).

If they steal your card without a PIN, they can use it contactlessly only for small transactions up to the contactless limit, and only for a limited amount before the card will stop working (if you make too many contactless transactions in a row, the bank will refuse one and demand a PIN transaction). (At least in the UK), you are not liable for the contactless transactions made after your card was stolen.

link
elric 1834 days ago
You raise a good point about the limits -- although the contactless limits have been raised here due to the pandemic. But I think you're underestimating the physical security of the payment infrastructure. Card terminals (here at least) are extremely secure. They are highly tamper resistant; they cannot access the network if they've been tampered with.

These NFC terminals on the other hand, I have my doubts about many of them. Especially the ones that are basically glorified phones.

Stealing a PIN and a card would be a targeted attack (or an extremely lucky break). When that happens, depending on the bank, taking out money might even be dumbest course of action. Many banks have online services that can be accessed using a card reader (and the card, and the pin). Limits there tend to be much higher, and there won't be an ATM camera filming you.

link
rjmunro 1833 days ago
The tamper resistance is less important if you don't have to enter your PIN. The protocols are secured from the card to the bank - the card has a CPU on board.

Tampering with the NFC reader doesn't really get you anything. Tampering with a PIN pad does let you copy someones PIN.

link