Eli5: How is a debit chip or tap to pay anymore secure than a mag strip with the same data on it?
In: 118
To expand a little more then some others are:
The data on the mag strip is just static, like text printed on a page. So if someone used a photocopier, they could reproduce that text and pretend to be you. This can be done by putting a hard to see device over the card reader, that can read your card as you swipe it.
The chip, however, is a little computer than can do a little calculation. The actual math it does is well out of ELI5 territory, but the idea is simple enough.
The chip has a secret number in it that, importantly, *never leaves the chip*. However, it can still prove that it has this number. It can do this by “multiplying”* this number by the random number the card reader gives it, and then giving back the result. So if the secret number was 5, the reader might give it 3, and it would return 15. The reader can them give the result to the bank (or whoever issued the card), who also know the secret number, who can verify that the result is accurate.
* In reality, these numbers are hundreds of digits long and the function isn’t multiplication, but something that is much more complex and that doesn’t have a way to reverse it, the way that division reverses multiplication. The math itself is far beyond ELI5 territory, though.
The nature of this math is such that the input and output appear to be essentially random and even if you could see hundreds of examples of input and output pairs, you still couldn’t feasibly figure out the secret number.
Because the number itself doesn’t leave the chip, the best you can do is intercept a few input-output pairs between the reader and the card, however since the card readers ask for the results with a random number (and these numbers are very large) the chance that you happen to have seen that number before are essentially 0.
Latest Answers