<story><title>Secret Service Warns of Chip Card Scheme</title><url>https://krebsonsecurity.com/2018/04/secret-service-warns-of-chip-card-scheme/</url></story><parent_chain><item><author>ChuckMcM</author><text>That is the &amp;#x27;non US&amp;#x27; view sadly. You see we didn&amp;#x27;t get &amp;quot;chip AND PIN&amp;quot; in the US. We got &amp;quot;chip to send the magnetic stripe&amp;quot;. If you use a US chipped credit card in a terminal it doesn&amp;#x27;t ask for a pin, it just wants an unintelligible signature and you&amp;#x27;re done.&lt;p&gt;I&amp;#x27;m more than a bit irritated with this since without the pin you can &amp;#x27;skim&amp;#x27; chip cards just as easily as you can magnetic cards.</text></item><item><author>drbawb</author><text>&amp;gt;The reason the crooks don’t just use the debit cards when intercepting them via the mail is that they need the cards to be activated first, and presumably they lack the privileged information needed to do that.&lt;p&gt;I guess I&amp;#x27;m a little confused as to how this works. In the case of my two card issuers &amp;quot;activating&amp;quot; the card means performing at least one fully online transaction at a chip-enabled merchant. (e.g: card present, chip used, pin entered.) If the card&amp;#x27;s chip were replaced in transit then I wouldn&amp;#x27;t be able to activate the new card. I&amp;#x27;m guessing they are targeting card issuers that have a different activation scheme; but I&amp;#x27;m a bit surprised that my extremely small midwestern bank is actually ahead of the curve on card security.</text></item></parent_chain><comment><author>ajross</author><text>&amp;gt; without the pin you can &amp;#x27;skim&amp;#x27; chip cards just as easily as you can magnetic cards.&lt;p&gt;Uh... no?  Not sure what you&amp;#x27;re saying.  The PIN authenticates the human user, so without the PIN you can use &lt;i&gt;steal&lt;/i&gt; a card.  &amp;quot;Skimming&amp;quot; is a MitM attack, something expressely designed against in the chip design.</text></comment>
<story><title>Secret Service Warns of Chip Card Scheme</title><url>https://krebsonsecurity.com/2018/04/secret-service-warns-of-chip-card-scheme/</url></story><parent_chain><item><author>ChuckMcM</author><text>That is the &amp;#x27;non US&amp;#x27; view sadly. You see we didn&amp;#x27;t get &amp;quot;chip AND PIN&amp;quot; in the US. We got &amp;quot;chip to send the magnetic stripe&amp;quot;. If you use a US chipped credit card in a terminal it doesn&amp;#x27;t ask for a pin, it just wants an unintelligible signature and you&amp;#x27;re done.&lt;p&gt;I&amp;#x27;m more than a bit irritated with this since without the pin you can &amp;#x27;skim&amp;#x27; chip cards just as easily as you can magnetic cards.</text></item><item><author>drbawb</author><text>&amp;gt;The reason the crooks don’t just use the debit cards when intercepting them via the mail is that they need the cards to be activated first, and presumably they lack the privileged information needed to do that.&lt;p&gt;I guess I&amp;#x27;m a little confused as to how this works. In the case of my two card issuers &amp;quot;activating&amp;quot; the card means performing at least one fully online transaction at a chip-enabled merchant. (e.g: card present, chip used, pin entered.) If the card&amp;#x27;s chip were replaced in transit then I wouldn&amp;#x27;t be able to activate the new card. I&amp;#x27;m guessing they are targeting card issuers that have a different activation scheme; but I&amp;#x27;m a bit surprised that my extremely small midwestern bank is actually ahead of the curve on card security.</text></item></parent_chain><comment><author>oneplane</author><text>But then what&amp;#x27;s the point? The whole signature scheme is not making much sense anyway, and pretending that no change is better because it is cheaper just gives you technical debt in the long run.&lt;p&gt;Would probably be better if at some point it was decided that using a signature is stupid and a deadline for using a PIN was set. But then again, the US hasn&amp;#x27;t been able to fix the date naming scheme, the measurement system or the temperature system (and it&amp;#x27;s just 4% of the world that is still using the old ones). I doubt this will ever be fixed.</text></comment>