Hacker News new | past | comments | ask | show | jobs | submit login

> It's not like it's rocket science to have the reader application detail what the request is used for, and encoding it in the request/response

The reader application can, sure, but what ensures that that "reader application" is genuine and can't be subverted? The card's own processor is supposedly tamperproof, but all the display etc. is in the reader which is probably owned and controlled by whatever third-party you're identifying yourself to, or at best it's a random application running on your PC/phone with whatever malware you have.




This is already a more restricted type of attack than the common identify theft that's rampant right now in the US.

What you're describing requires the actual terminal you're interacting with to be malicious, and it can only be used to authorize individual transactions.

As things stand in the US, a much broader class of attacks are not only possible but common, in which the attacker takes over the identify of the victim and can authorize any number of transactions in their name.




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: