Comment Irvine is wrong on most counts (Score 1) 317
Jerry Irvine is wrong on most of the points he makes. Just to correct some of them:
1. The PAN (the primary account number) is not enciphered on a chip card.
2. If you have a chip reader and easily-found software, you can recover the card PAN easily and quickly.
3. Cards do not provide support for "unlimited number of transactions" - as almost all cards have amount and velocity limits.
4. Most transactions will go online to the card issuing bank for authorization - allowing for lost and stolen cards to be blocked.
5. Each purchase with a chip card does not "create a separate token". He appears to be confusing tokenization with cryptography, though it's hard to know exactly what he means.
6. Issuing banks do not create tokens. Instead, they are created by a Token Service Provider, usually an independent third-party.
7. A partial EMV implementation would have mitigated against certain segments of the Target fraud. A full implementation, with PCI, industry-wide, would have mitigated against much more.
8. Mobile payment systems, in general, today, do not provide higher levels of security than chip cards.
Documentation on most of the above is freely available from EMVCo's website at http://www.emvco.com/
Mr Irvine's four minutes are, as a whole, inaccurate and unhelpful.
