Posted on: 22-10-09 14:24:09
Quote:
Originally posted by web2000
What extra security (Other than PIN) the chip card provides? Even if the encryption is strong and it is not using unsymmetrical keys(I don't think so) then how to avoid 'Man in the middle attacks'?
The chip stores the info in an encrypted form and transmites it in an encrypted form. So even if the merchant gets a hold of the info from the card, it's of no use, unless they can decrypt it.
But until all merchants get switched over, we still carry the risk in our pockets. Visa and MC have imposed a deadline of around 2012 for all banks and merchants to switch over, after that they get penalized. So till such time cards will have both mag stripes and chips.
-----------------------------------------------------------------
SS
Reiki Grand Master
Quote:
From what I have read and heard, is the merchant swipes the card in 2 different machines. One is the genuine one for your transaction and the 2nd is the fake one just to collect the info from the mag stripe.
Thanks sharing it. In that case it won't be a problem in super markets, as you can see what cashier is doing. Giving CCard to waiters is always scary/risky.
Quote:
Originally posted by sudesingh
Quote:
Originally posted by web2000
What extra security (Other than PIN) the chip card provides? Even if the encryption is strong and it is not using unsymmetrical keys(I don't think so) then how to avoid 'Man in the middle attacks'?
The chip stores the info in an encrypted form and transmites it in an encrypted form. So even if the merchant gets a hold of the info from the card, it's of no use, unless they can decrypt it.
Why the merchant wants to decrypt it? Isn't it possible if he can create a duplicate card with the encrypted info on a newly installed chip?
From the posts, I can see that; banks acted promptedly, credited the account at earliest, tried to close any known loopholes, created additional security features etc.
Does any one recollect any action on the terminal where the fraud took place, even after zeroing it correctly; like sending an under the cover customer, keeping an eye on their account and sale etc. I think that way many future frauds can be checked.
-Ben
Quote:
Originally posted by benparsad
From the posts, I can see that; banks acted promptedly, credited the account at earliest, tried to close any known loopholes, created additional security features etc.
Does any one recollect any action on the terminal where the fraud took place, even after zeroing it correctly; like sending an under the cover customer, keeping an eye on their account and sale etc. I think that way many future frauds can be checked.
-Ben
I would highly doubt that the tampered terminals would be used for more than 2-3 days since bank would have zeroed in to the store where it happened. It is up to the card holders and banks to file a police report.
-----------------------------------------------------------------
Give free food http://www.thehungersite.com ||
At least the Banks insure against such fraud ... I hope they do so in India also ... otherwise I would have stuck to conventional bills .... the typical Indian way 
-----------------------------------------------------------------
Fido.
Even the chip card does not provide any security (Except PIN). It is just another way of making money by the chip reader creaters.
Whether the information is encrypted or decrypted, it does not matter. Even the PIN can be stolen while on wire.
