On: Hacker serving 5-year sentence invents ATM add-on ...

[orofino]

I'm sorry, but don't smart cards completely obviate the skimmer issue? Aren't they widely used in Canada and Europe?

I'm not terribly knowledgeable in this area, but I thought this was a solved problem being held up by corporate interest in the US.

[takluyver → orofino]

Yes, in Europe Chip-and-PIN cards are the norm - the card has an embedded microchip which the reader communicates with electronically. But they still have the magstripe as well, for backwards compatibility.

[kalleboo → orofino]

Yes but I have yet to see an ATM anywhere that uses a chip reader slot, they all pull in the card in the same manner as a magstripe ATM (if they use the chip internally, I do not know).

[mpyne → orofino]

The smart card I have requires only a PIN, and that PIN can be intercepted by suitable hardware can it not?

[dan-bell → mpyne]

I've heard of pinhole cameras being used in card skimming operations where PIN numbers are required.

[jonknee → dan-bell]

That doesn't do anything for a chip and pin card. You need the chip too.

[norse1 → jonknee]

Here in the uk they skim your card, create a replica and use a pinhole camera to get your pin.

[icebraining → norse1]

As far as I know, you can't skim the chip. In the EMV system, the private key is only accessible to the internal "CPU", not the reader.

[maxerickson → mpyne]

Isn't the whole point of the "smart" that the card is difficult to replicate and must be present?

[mpyne → maxerickson]

Yes that's true, I was thinking of the case where we assume the card is stolen.