Credit Cards/Chip and Pin/ATM withdrawls

Good point. Without placing some temporary insulation over the chip pins, I guess I cannot tell. I had just noticed that some private ATMs had a different card slot arrangement where you swipe the card vertically and dock it at the bottom into an obvious chip reader, and bank ATMs had not altered the card slot, and I jumped to conclusions. Obviously now you point it out I can see that the bank ATMs might well be configured to read the chip these days.

No, but it means that it is pointless making the door more secure than the window.

OTOH, if you are upgrading your security in stages, you may well upgrade the door first and the windows later, thus creating an apparently silly situation during the transition.

That has been covered. Brute force cannot be used, as the card will set an internal (and inaccesible to the outside world) flag that disables it after the 3rd incorrect attempt.

Anyone who has your card *automatically* has your signature.

Isn't that rather the point?

For chip and sig:

You can have your card stolen from you without any claim that you must have been complicit or negligent. It is then not your problem that the system insists on a signature on the card rather than say, having to sign a touch screen with a wand, and thus makes it available to the thief..

For chip and PIN:

You can have your card stolen from you without any claim that you must have been complicit or negligent.It is then very much your problem if it is used with the correct PIN. The argument will be that you must have been complicit or negligent.

The introduction of a new system could have been used to introduce a verification system which could have been based on personal information challenge/response and/or biometrics - thus making surfing/dummy pinpads/etc useless.

I find in hard to believe that they could have found a system which is less secure against 3rd party ATM withdrawals than a 4 digit PIN.

Incidently, would you protect a full access permission account to an important computer system, using just a 4 digit unchanging password - even if it locked out after 3 attempts?

At 17:00:55 on 21/12/2005, GSV Three Minds in a Can delighted uk.finance by announcing:

To what end?

"GSV Three Minds in a Can" wrote

As Cynic said, they have your signature because it's on the back of the card.

So they have it much more easily than for a PIN - the sig is already on the card for anyone to see. Except you, of course...

At 21:27:03 on 20/12/2005, GSV Three Minds in a Can delighted uk.finance by announcing:

Are you absolutely 100% sure that online PIN is not a valid CVM on that card?

At 17:22:37 on 21/12/2005, Cynic delighted uk.finance by announcing:

Bingo! They didn't alter the card slot because the physical dimensions of the cards haven't changed.

At 12:17:19 on 21/12/2005, Mark delighted uk.finance by announcing:

Why guess? The EMV specs are publically available. The PIN is stored in a private area on the card. It is never revealed by the card.

Only if those brute force techniques can get it in 3 attempts or less.

At 17:01:55 on 21/12/2005, GSV Three Minds in a Can delighted uk.finance by announcing:

Only if you use the same PIN for all, and the potential cracker knows that. Otherwise, there's just as much chance of them getting the PIN for the tenth card as there was for the first. i.e. 1 in 3320-something.

Bitstring , from the wonderful person Tim said

They have =a= signature, which may or may not resemble what I sign on credit card slips. Even if it does (and it doesn't by the way), merely because they have it doesn't mean they can reproduce it (well enough to convince a hand writing expert).

Still only 1 chance in 333. Nearly 10 times worse that getting a number playing roulette.

And *that* is the point wrt chip & PIN. Any assertion that you must have been negligent is not credible. A more secure system would give banks a better footing, but as it stands any assertion that knowlege of a PIN means that you must have been grossly negligent would not be accepted.

A better method IMO would be to keep the 4 digit PIN, but have the POS terminal ask you to enter two digits of that PIN, with the digits (1st, 2nd, 3rd or 4th) being selected at random.

So you are *relying* on the insecurity of checkout staff not checking the signature properly?

Do you ever get them rejecting it because your signature does not match?

No, but there are plenty of thieves out there who can reproduce it well enough to fool most people (including bank staff), but probably not a true handwriting expert.

You really need to go to more than 4 digits if only some are to be entered each time.

Only having to enter two digits gives too high a chance of guessing right.

In message , Cynic writes

Yes, there are loads of 'better' systems. a 10 digit pin for example.

The problem is public acceptance, and a balance needs to be achieved so that a universally acceptable standard could be adopted.. Yes 4 digit pin is flawed, but every system is flawed to some extent. C&P should work for a while because it substantially reduces the ability to clone cards. The PIN bit is a side issue.

The problem that many can not countenance in this thread is the loss of their C&P card which they do not realise is lost and dont ever realise it is lost until the bank tells them they are overdrawn because the thief has also obtained their pin.

In the short interim period before all ATMs will treat C&P cards as C&P cards and american magstrip cards as american mag strips cards and which will not think that UK C&S cards are really magstripe cards (and I understand this will not take much longer) then there is a small chance that there may be some fraud but in my direct and personal experience banks are generally pragmatic. (See my posts from 1997(?) to date)

On balance I think the fears quoted, ad nauseam, are grossly over exaggerated.

JB, can you confirm that when this happens, a C&P card whose magstripe has been cloned and then altered to say that it isnt a C&P card, will be rejected, e.g. it wont rely on what the magstripe tells it but will refer back to the central computer? AIUI, at present it will be allowed if the PIN is correct.

Judging from my conversations with the call centre drones I am not the only one requesting this feature. It's on their FAQ!

Mark