Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Which really doesn't matter since credit cards can be used online

Don't you need the printed CVV for that? Which isn't stored on either the magstripe nor the chip.

edit: 3DSecure would also help if banks cared to push it harder (for instance my bank now disallows all online debit card charges that don't use 3DSecure)



No, you really don't need the printed CVV for that. And several cards have actually had the CVV on the chip.

Also, in many cases the chips actually contain enough information to replicate the magnetic stripe. (Which is well, bad.)


EMV tag 57 [1] generally contains the "Track 2 Equivalent Data", and 5A the account number (PAN) [2]

[1] http://www.emvlab.org/emvtags/show/t57/ [2] http://www.emvlab.org/emvtags/show/t5a/


That's not the same CVV.

Edit: Even having the track 2 data won't do you any good in reproducing an EMV card. The only way reproducing a mag stripe EMV card is useful, is if it is used at a non-EMV terminal and mag stripe is the only option.

I believe Europe has complete banished mag stripe now.


CVV2/CVC2 (visa/mastercard) generation on the back of the card is COMPLETELY different than the CVV on the chip.

http://en.wikipedia.org/wiki/Card_security_code Skip down to Types of Codes


Yes, you need the CVV printed on the back of the credit card to make an online purchase.

And the CVV on the back, is different than the CVV stored on the magstripe/chip.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: