<story><title>Why are McDonald’s Self Service Kiosks so hackable?</title><url>https://ghuntley.com/mcdonalds/</url></story><parent_chain><item><author>Gigachad</author><text>I&amp;#x27;m surprised the stripe is still added to cards these days. The chip broke on my mums card around 10 years ago and although the card readers had strip readers, they would often refuse to use it. Seem to remember some requiring a few failed chip uses before allowing magnetic strip.</text></item><item><author>charles_kaw</author><text>&amp;gt; the secrets we were protecting are symmetric and printed on the card for anyone to see.&lt;p&gt;On the magstripe and plastic, yes, but that is very rarely used today in stores. A modern chip card doesn&amp;#x27;t really expose secrets.</text></item><item><author>__MatrixMan__</author><text>I worked at a POS vendor who did this kind of thing internal to the device.  We had a bunch of robots (they looked like 3d printers with a stylus instead of a print head) testing the payment flows because none of the android test tools could interface with that part of the device.&lt;p&gt;It was kind of impressive, but also kind of funny because the secrets we were protecting are symmetric and printed on the card for anyone to see.</text></item><item><author>wronglebowski</author><text>I was involved with the card reader upgrades at McDonald’s in the US. Essentially the card readers were stripped out of the main network and all buildings were rewired With a physically segregated network for cashless transactions.&lt;p&gt;Registers placed orders to the main routing Server in the back which passed the information to each individual station for fulfillment. The only time the card reader is involved is when the register makes a request to the cashless processing appliance in the back office then it reaches out to the card reader on the segregated network.</text></item></parent_chain><comment><author>avianlyric</author><text>Depends in what part of the world you’re in. In Europe I wouldn’t really expect anyone to accept magstripe on card with a chip, but in the US it’s more common.&lt;p&gt;Additionally terminals can be configured to detect dodgy chips and automatically fall back magstripe, or a more basic form of processing. But your bank may block these transactions, because they can’t perform chargebacks on them, they’re considered as “secure&amp;#x2F;good as” Chip and PIN transactions by the card network for merchants in some parts of the worlds (e.g. the US). So if a fraudulent transaction was performed that way, the bank would have to eat the entire cost themselves.</text></comment>
<story><title>Why are McDonald’s Self Service Kiosks so hackable?</title><url>https://ghuntley.com/mcdonalds/</url></story><parent_chain><item><author>Gigachad</author><text>I&amp;#x27;m surprised the stripe is still added to cards these days. The chip broke on my mums card around 10 years ago and although the card readers had strip readers, they would often refuse to use it. Seem to remember some requiring a few failed chip uses before allowing magnetic strip.</text></item><item><author>charles_kaw</author><text>&amp;gt; the secrets we were protecting are symmetric and printed on the card for anyone to see.&lt;p&gt;On the magstripe and plastic, yes, but that is very rarely used today in stores. A modern chip card doesn&amp;#x27;t really expose secrets.</text></item><item><author>__MatrixMan__</author><text>I worked at a POS vendor who did this kind of thing internal to the device.  We had a bunch of robots (they looked like 3d printers with a stylus instead of a print head) testing the payment flows because none of the android test tools could interface with that part of the device.&lt;p&gt;It was kind of impressive, but also kind of funny because the secrets we were protecting are symmetric and printed on the card for anyone to see.</text></item><item><author>wronglebowski</author><text>I was involved with the card reader upgrades at McDonald’s in the US. Essentially the card readers were stripped out of the main network and all buildings were rewired With a physically segregated network for cashless transactions.&lt;p&gt;Registers placed orders to the main routing Server in the back which passed the information to each individual station for fulfillment. The only time the card reader is involved is when the register makes a request to the cashless processing appliance in the back office then it reaches out to the card reader on the segregated network.</text></item></parent_chain><comment><author>lmm</author><text>It&amp;#x27;s only a few years ago that we started seeing cards without embossed numbers for taking impressions by rubbing.</text></comment>