Chip & Pin

[devonwoody]

Anyone on the forum with any inside info regarding chip and pin security?

Is it working for its customers or only for the finance companies?

My gripe is that there is no privacy at many outlets when entering pin numbers, in fact I now watch customers inserting the pins and endeavour to work out what the numbers could be.
Top row left.
2nd row one left one Right
Bottom row middle.

Hows zat?

 

[RogerS]

This is a good thread, John :wink:

On the Which forums there has been a vigorous discussion about the :

- demerits
- lack of security (the banks adopted the cheapie option)
- general bs given by those with vested interest
- the ostrich like stance of Which who jumped on the pro-Chip'n'PIN bandwagon but are now silent in the light of much publicised criticism of the system and horror tales

- the fact that the onus now seems to be on the customer proving their innocence in the light of any fraud (even though the banking code says that it is the banks responsibility to prove the customer has been negligent .....most banks adopt the other view ie you MUST have given your PIN number to the crook therefore we are not going to reimburse you as our systems are foolproof (thinks of a word rhyming with rowlocks)

OK - will get off my soapbox now

Note to self - get organised and get your cards changed to CHIPnSignature and stop faffing around

 

[dedee]

Why was the idea of a photo on the credit card dropped? I seem to remember it being trialed quite a few years back.

Andy

 

[BrianD]

Hi there,
the photo will not work as the fraudsters will just print their own.

The real issue under all this is the quest for absolute security. How do attain this without Big Brother controlling this?

In practice, even using your DNA can be faked. The fraudsters get a sample and replicate what the banks/security folk do.

It really comes down to two things, IMHO.

The cost of process of verification and validation vs. the risk. If we want to be sure every time it's going to cost (maybe too much?)

AND

Who controls the key source of information?


Depending on the viewpoint of the individual; this ranges from the Totalitarian State to Anarchy (we do not know you at all). [Mind you both seem to function]

IMHO, the issue centers around the lack of common decency and faith in humankind; for these are just attempts to "regulate and enforce" my lack of Trust in you.

:roll: 'nuff said.

Cheers.

 

[Paul Chapman]

Is it working for its customers or only for the finance companies?

All this stuff, ATMs, debit cards, credit cards were introduced primarily so that banks could reduce costs and increase profits - we all end up paying more and getting a lot of aggro. I think banks have their own unique definition of "customer" - I think it's spelt "sucker" :wink:

Paul

 

[Les Mahon]

I think alot of this debate is down to what we as consumers have become used to.

I remember moving to the Uk from Luxembourg to go to Uni and be appaled that the switch card depended on signature as the security for the transaction - it seemed to me that haveing the only physical security for the transaction written on the back of the card was nuts - but then in Luxembourg the pin had been in use in shops since the intorduction of the cards.

Here in Ireland they are just starting to get sorted out with chip and pin now, my own card still has a signature only and I would say that in 95% of cases nobody looks at my signature before handing the card back - and I have left a copy of the signature in the till with the retailer so if they pinch the data off my card they have all they need to use my accout without any need for cameras or "shoulder surfing" to get my PIN.

I do alot of work with computer security in my profesional life, and most systems require change of password every 60 days - if people are really worried about protecting the PIN number, change it evry few weeks - something that can never be done with a signature!

I have to say that I am a serious convert to the idea of Chip and PIN it puts the security in my hands.

Les

 

[devonwoody]

Les, you wait until you become a pensioner and try to remember a pin number you only use occasionally and then change it every 60 days.
memory loss comes to everyone eventually its like the other thing that eventually arrives.

 

[Les Mahon]

DW

wait until you become a pensioner and try to remember a pin number

That's a fair point - yet more reason for me to keep in mind the importance of getting feedback from as wide a potential user base as possible when designing systems!

Les

 

[Paul Chapman]

That's a fair point - yet more reason for me to keep in mind the importance of getting feedback from as wide a potential user base as possible when designing systems!

Seriously, do banks and other financial institutions ever do any true customer research before introducing systems? I've had a bank account for most of my life and I've never been asked what I think. Seems to me that they simply impose systems on customers :wink:

Paul

 

[devonwoody]

Les, I nearly lost my thread.

With the signature the credit card company were responsible if it was not your signature, my query was now we have a pin number can the bank always insist it was the customers fault because he has allowed his pin number to be somehow compromised ?

 

[RogerS]

Les, I nearly lost my thread.

With the signature the credit card company were responsible if it was not your signature, my query was now we have a pin number can the bank always insist it was the customers fault because he has allowed his pin number to be somehow compromised ?

The answer is 'Yes...they do insist it is the customers fault'...there are many articles in the press on precisely this point and also the subject of a very vigorous exchange on the forum at Which.

However, my understanding is that the banks ARE supposed to prove your negligence rather than the other way round...but try telling that to the banks.

Check this website out

 

[devonwoody]

I think someone (not me of course) should sue a supermarket for lack of privacy when being asked to enter your pin number.

I now make it a practice to read everyones pin number when they are in front of me at a check out, some entries could be seen by a baby and others could be worked out by someone with a very trained eye for this kind of thing.

 

[RogerS]

DW...our posts crossed and you may have missed the link to a website dedicated to chip'n'Pin fraud.

Re privacy...maybe we need the equivalent of the Maxwell Smart Zone of Silence :lol:

 

[devonwoody]

OK Roger I have done a save of that site, going back out the shed.

BTW how are you geting on with your new toys, I mean tools.?

 

[RogerS]

BTW how are you geting on with your new toys, I mean tools.?

Thanks for asking, DW...

Assembled one of the Record heavy duty mobile bases and managed to get the bandsaw onto it. The hernia operation is scheduled for next week. The base flexes a bit ...time will tell if it flexes too much under use.

Had a moments panic that the bandsaw had suffered more traumatic in-transit damage than I first thought as I couldn't keep the blade on the wheels. But a bit of first principles and blade tension got it running by hand pretty well.

I tried to fire up the bandsaw but it wouldn't....which is what I expected as the guy selling mentioned that fact. Turned out to be a slightly misaligned bar on the cover causing the interlock to stay 'locked'. Fired up the bandsaw briefly...beautiful slow start...but frightening at full speed ...actually the lower of the two...not plucked up courage to run it at top speed. Managed to single-handed lift the cast iron table on to it....jeez...that weighed a ton...the fence is so solid I reckon it would stop a tank. BUT nothing cut yet ...to busy on other things.

Faffed around with a temporary electrical supply 16A commando socket style and checked out the table saw ...which ran fine..

and also the spindle moulder....ran fine as well....although I discovered that you have to keep your finger on the ON switch while it gets up to speed...a safety feature??

Basically I'm taking my time over using these in anger as I don't want to lose any of my soft bits....

 

[RogerS]

And just when you were convinced that e-passports were secure

...http://www.theregister.co.uk/2006/08/04/e-passport_hack_attack/

 

[devonwoody]

Thanks for posting Roger, I have just found this posting, my o/e never informed me of this thread reply. Perhaps it also happened to other users.

 

[engineer one]

everyone including the banks know that the thieves will find a way round whatever security is put in place. often it is done without a thought for
profit rather to prove their skill.

remember many of microsoft employees wer originally hackers,
so what is the incentive to be right??

since shell don't take chip and pin after their problems, and i know certain
branches of waitrose have stopped, how do the banks reconcile their pitch
about security.

frankly we will never be safe, but the banks don't care, if you keep
knocking at their doors eventually they will pay you off, since basically
it does not cost them anything.

it's not just ob2s who forget their chip and pin numbers.if youhave more than 4 cards, credit debit etc, how the hell can you remember all the numbers, and more to the point how do you remember the right number at the right time without writing it down??
:?
paul :wink:

 

[RogerS]

how the hell can you remember all the numbers, and more to the point how do you remember the right number at the right time without writing it down??
:?
paul :wink:

I use the same number for all of them. I don't need to write it down. I can't see the point of using a different number for each card. I think that the 'advice' to use different numbers for each card is born out of ignorance but, as per usual, am willing to learn otherwise.

 

[devonwoody]

Roger,
I have a naughty habit of trying to read the pin number being used by the person in front of me at checkouts. This is not being done for any personal gain only to proove to myself how dangerous this new system is for the pin user.

If the same is being done to me it must be very easy for this type of fraud to be a problem in the future.
Pickpoctets can relieve you of your wallet with all cards and it could be many hours before you are aware it has happened, the real nasty would be if they put your wallet back before you went into the supermarket again.

You would have a hell of a job with the credit card company :wink: