ATM fraud and C&P

Without a hint of irony, "rob." astounded uk.finance on 13 Nov 2004 by announcing:

I don't see why. Only debit cards were C&P in France.

Without a hint of irony, Alex astounded uk.finance on 13 Nov 2004 by announcing:

And places where mag stripe hasn't made it either (which vastly outnumbered those where it had).

Thanks for that. I can't say I'm filled with confidence though - phrases like "...achieved by encapsulating the security sensitive electronics in potting compound", even if there's anti-tamper provision, surely means we'll see criminals working carefully in their de-potting sheds. It only takes one to get at the "hidden" data......

I know - that's more-or-less the objection I raised with my banks. But given a PIN, you still need a card - nicked or cloned.

"Alex" wrote

Why can't you do that test, when the card is inserted into a different device?

If the two devices are connected, then the same situation should result. If the two devices *aren't* connected (and the test doesn't work) - then why would it need your PIN??!

That's dangerous - if the designer(s) overlooked a potentially unsecure aspect when designing something, they'd likely miss it again when looking at it later!!

"Alex" wrote

You can easily see that it's possible for other people to "shoulder-surf". That's the big insecurity in the implementation...

Without a hint of irony, Mike Scott astounded uk.finance on 13 Nov 2004 by announcing:

The only hidden data in an EMV transaction is that stored on the card, and at the bank. There is none on the terminal.

But you have been told not to use your card where someone might see your PIN, haven't you? So you are liable if you use card at pretty much any shop, since there isn't sufficient privacy for entering your PIN anywhere I have seen.

Self-destruct on tampering is not security by obscurity, just another layer to make the crooks' job harder.

Hey, I think that's a great way to help you remember how old your children are, or at least how to work it out.

Keeping a key secret is not what is meant by "obscurity" in this context. Obscurity is trying to keep secret how the system works.

You are correct about that usual meaning of "security by obscurity".

Jonathan Bryce must, however, use a different non-standard meaning, since he thinks that my speculations about whether a device can keep an internally stored key safe against physical attacks constitute "security by obscurity".

Can you talk me through that one please?

The chances of getting it right are 3/9999 for each card, I'm not quite sure how you end up with 63%?

Scripsit Guttorm Christensen

The assumption must have been that each of the 10,000 cards were tested with only one PIN. Then the chance of *failure* for each card is 0.9999, and the chance of failing for all 10,000 cards is

The chance that at least one of the attempts will be successful is therefore 1-0.3679 = 0.6321 = 63%.

That does not necessarily mean he's using a non-standard meaning.

A person with detailed knowledge of how the self-destruct mechanism works could make good use of that knowledge in attempting to defeat it.

Unless the mechanism is absolutely foolproof, there is a small chance of such an approach succeeding, given the appropriate inside knowledge.

Therefore hoping it never happens is relying on not many people having the necessary knowledge (or trusting those who have it not to use it).

Without a hint of irony, Ronald Raygun astounded uk.finance on 13 Nov 2004 by announcing:

In EMV, the only secret knowledge is kept on the card and at the issuing bank.

I wonder if any lawyers are rubbing their hands and thinking -"Unfair Contract Terms"? Could be an interesting case.

Scripsit Ronald Raygun

If knowledge of how the self-destruct mechanism helps an attacker, then it is clearly an entirely different beast from the kind of self-destruct mechanism I was imagining.

Well actually, no. Why - have you?

In fact, all the C&P literature tend to say "when paying at a C&P terminal, simply enter your PIN on the keypad" - I haven't seen any that say "don't enter your PIN if there is any chance that someone might spot it" !!

C&P card issuers *want* us to use C&P - they keep saying how "good" it is - so how could using it, in the manner in which they expect you to, possibly constitute "PIN negligence" ?

;-)