this post was submitted on 09 Feb 2026
684 points (99.6% liked)

Europe

10088 readers
1100 users here now

News and information from Europe 🇪🇺

(Current banner: La Mancha, Spain. Feel free to post submissions for banner images.)

Rules (2024-08-30)

  1. This is an English-language community. Comments should be in English. Posts can link to non-English news sources when providing a full-text translation in the post description. Automated translations are fine, as long as they don't overly distort the content.
  2. No links to misinformation or commercial advertising. When you post outdated/historic articles, add the year of publication to the post title. Infographics must include a source and a year of creation; if possible, also provide a link to the source.
  3. Be kind to each other, and argue in good faith. Don't post direct insults nor disrespectful and condescending comments. Don't troll nor incite hatred. Don't look for novel argumentation strategies at Wikipedia's List of fallacies.
  4. No bigotry, sexism, racism, antisemitism, islamophobia, dehumanization of minorities, or glorification of National Socialism. We follow German law; don't question the statehood of Israel.
  5. Be the signal, not the noise: Strive to post insightful comments. Add "/s" when you're being sarcastic (and don't use it to break rule no. 3).
  6. If you link to paywalled information, please provide also a link to a freely available archived version. Alternatively, try to find a different source.
  7. Light-hearted content, memes, and posts about your European everyday belong in other communities.
  8. Don't evade bans. If we notice ban evasion, that will result in a permanent ban for all the accounts we can associate with you.
  9. No posts linking to speculative reporting about ongoing events with unclear backgrounds. Please wait at least 12 hours. (E.g., do not post breathless reporting on an ongoing terror attack.)
  10. Always provide context with posts: Don't post uncontextualized images or videos, and don't start discussions without giving some context first.

(This list may get expanded as necessary.)

Posts that link to the following sources will be removed

Unless they're the only sources, please also avoid The Sun, Daily Mail, any "thinktank" type organization, and non-Lemmy social media (incl. Substack). Don't link to Twitter directly, instead use xcancel.com. For Reddit, use old:reddit:com

(Lists may get expanded as necessary.)

Ban lengths, etc.

We will use some leeway to decide whether to remove a comment.

If need be, there are also bans: 3 days for lighter offenses, 7 or 14 days for bigger offenses, and permanent bans for people who don't show any willingness to participate productively. If we think the ban reason is obvious, we may not specifically write to you.

If you want to protest a removal or ban, feel free to write privately to the primary mod account @EuroMod@feddit.org

founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] msage@programming.dev 7 points 21 hours ago (1 children)

I want to hear those war stories.

[–] Kushan@lemmy.world 5 points 13 hours ago

I'll give you a fun one.

A point of clarification before I begin though - when I talk about chip cards or smart cards, I mean cards equipped with an EMV chip in them. The USA was one of the last countries to adopt this technology, only doing so roughly in the last 10 or so years. The technology has existed since the 90's (when Europay still existed) and gets regular updates to add new encryption schemes and security gubbins, so while it's 90's technology, it has been updated since (Today's cards use AES and ECC).

Prior to that adoption, the USA basically refused to use them because of the cost (Cost of cards, cost of new terminals, cost of upgrading legacy infrastructure), however they wanted all the modern conveniences like contactless payments - so those first contactless cards were equipped with simple RFID chips. You know the kind, the ones that just spew out static data. Those are the ones the Mythbusters guys investigated and were forced to not air their findings because they're so dogshit insecure (and where the idea of someone walking down the street with a big RFID reader hoovering up credit cards comes from).

With an EMV chip card, you can't do that. Those chips are like mini computers, they don't just spew out static data like your card number, they do challenges and responses, they do encryption, MAC's, the works. They really are quite secure. A transaction works in such a way that the card doesn't trust the terminal and the terminal doesn't trust the card, they validate each other and at any time either of them can say "Nah fuck this, I want to talk to the Bank" - this is called "going online" and if that doesn't work, the transaction is aborted.

The point of all of this preamble is to say that it's actually really difficult to perform fraud on a proper chip card (And again I'm talking about EMV chips, not RFID chips). Not impossible, but very difficult to the point where it's usually not worth it.

So, to try and push adoption of the EMV standard in the USA, the big issuers (Your Mastercards and your Visas) tried to push what they termed the "Liability shift". To put it simply, they'd say something like "If you don't support EMV by November 15th, any fraud in your shop/bank/whatever will come out of your pockets, not ours". Meanwhile, they charged a fee (like 2%) on every transaction to cover fraud. So as a shopkeeper, you'd lose an extra 2% (or whatever it was) on every sale, but if someone came in and bought 10 big-assed TV's using a stolen or cloned card, you didn't lose that money.

The problem is, no shops or businesses were going to upgrade all their equipment any time soon and certainly not before their banks could support it. Likewise the banks didn't want to spend all that money and then tell their clients to buy all new equipment - they were afraid of losing customers because why would a customer spend thousands on a new terminal to stick with the same bank, they may as well shop around.

This weird stalemate meant that adoption was basically nill, so the issuers had to keep pushing back the liability shift over and over. Each time they got a little bit firmer, a sort of "Okay it's now October next year before you need to adopt EMV but this time we mean it for realsies!". This went on for YEARS and years until one day, Mastercard decided "you know what, fuck it, we're not going to bother at all". It turns out, those fees for protecting against fraud? They were lucrative. They made shitloads of money from it, way more than what the actual fraud was costing them.

We got told in advance that an announcement was going to go out - pushing back the liability shift "Indefinitely", which was a real bummer for us because we were about to make shitloads of money selling testing tools and equipment to every fucker who suddenly needed to adopt EMV. Then, literally like 4 days before that announcement was due, a miracle happened - Target got hacked.

Yes, that target hack from 2013 where like 40 million credit cards were leaked onto the internet. The hack that made national news for weeks, the one that rustled the jimmies of everyone who had ever set foot inside a target. There was the biggest credit card breach on record, costing hundreds of millions of dollars in fraud and untold bad blood for tens of millions of customers and Mastercard was about to make an announcement to the effect of "Hey we're going to cancel the one thing that would have prevented all this impending fraud from ever being able to happen".

Yeah, they didn't make that announcement. Instead, they put their foot down and suddenly the USA woke the fuck up and decided to finally adopt chip card technology.

(And of course they did a shit job of it, but that's another story for another day).