why are chips better than stripes?

On credit/debit cards, I mean. Why are the chips more secure? both stripes and chips need pins (at least for the debit card function). So what’s the benefit of chips’n’dips?

The main benefit is that your account number is passed to the device in an encrypted format - it’s harder to extract (and duplicate.)

Here’s an article from the New York Times suggesting that the chip-and-pin cards aren’t superior to magnetic-stripe cards, because the network provides the necessary security to magnetic-stripe cards, and can be upgraded more easily.

Probably not much, but its newer and therefore people haven’t learned to exploit it yet.

Are you sure about that?

There are credit/debit cards that use rfid chips? :confused:
All the cards I’ve seen need to be properly inserted into a card reader to work, and this is one of the reasons chips are more secure than the magnetic strips. With the magnetic strip a scammer can place a card reader on top of any legitimate equipment without interfering with the normal operation and copy any card that’s used, with the chip only one piece of equipment can read the card at the same time and in order to make a copy the scammer would have to completely replace the legitimate equipment.

The Chicago Transit uses RFiD chips and they are awful

The passes they sell with magnetic strips, I have never had issue with. I’ve even accidently put it through the laundry and it worked. (Of course a scratch will kill it)

But these RFiD chips don’t even last me six months, without having to pay another $5.00 to get a new card.

Up here in Canadia, the same devices are used for both stripes and chips. You have the normal stripe swipe for old cards which is on the side, and on the bottom you are supposed to insert chip cards so it’s a different process on the same machine. The thing is, most places are still just just using the swipe method for chip cards.

In Europe, thousands of readers where modified during manufacturing to transmit the data to an external source. They had to check every scanner.

Also there were a chain of gas stations with compromised readers, don’t remember what that method was.

This is a security issue with manufacturer, and it’s a Bad Thing regardless of the technology involved.
Also, cite please.

Since the gas stations(at least around here, and there has been skimming attacks here) still use the magnetic strips the answer is obvious.

:confused: Isn’t it also possible to encrypt the account number on a mag stripe?

As well as actually compromising the reader, a miniature TV camera was hidden in the ceiling to capture the customer keying in their PIN code.

Sure, but it doesn’t buy you much. Even if the number is encrypted the crooks just need to copy the encrypted account number and put it on a new magnetic stripe card. They don’t need to be able to decode it.

To be secure the card needs to authenticate the server and do end-to-end encryption. You need a real microchip to do that.

Yes it’s a bad thing regardless of the technology involved. It was just an interesting relevant story that illustrates how difficult it is to be truly secure.

Shell Chip and Pin

That was a story from four years ago.

Basically, the difference is this:

A magnetic strip is simply a number in a coded format. A reader reads the number and copies it down, and that’s pretty much it. If your card gets skimmed by a waiter or a modified ATM, they essentially have a copy of your credit card.

By comparison, chip (smart card) contains some intelligence, which means that the number read by the reader is a combination of the (encoded) card number, possibly your pin code and some secret values embedded in the card. In other words, the identity of the card can’t be replicated by simply scanning the value in the reader.

Smart cards aren’t perfect and are vulnerable to hardware analysis, but the cost/gain equation is such that performing a deep analysis of a smart card usually isn’t worth it.

[Payment Card Industry Qualified Security Assessor here]

Encryption of the PAN (Primary Account Number) is only part of the game. If there’s a skimmer on the point of sale (POS) unit, you’re hosed regardless of whether it’s chip or mag stripe. With chip’n’PIN, it’s a little more secure… but if I were going to install a skimmer, I’d also install a mechanism to capture the PIN. It takes about 3 minutes at most.

The card brands and merchants are trying to provide a level of security that doesn’t interfere with their profitability (strong security is expensive). They’re going through the motions of doing the right thing and are, in fact, raising the security level of their product. It ain’t perfect.

Are you saying that there are chip readers that can get all the relevant information by just having the chip pass by it(ie the device was stuck on top of the card slot)?

Fish and stripes?

Nah, that’ll never catch on ! :smiley:

The card would have to be used by the authorized person (or at least someone with the PIN). Once that transaction is completed, and EvilRat has captured the PIN… your ass is mine, as it were.

This can all be done with toys like WireShark, EtterCap, or whatever. It’s neither rocket surgery nor brain science.