3 ms·

I believe such a system is Safer to use for the average customer because the law is on his side. A routing number is (as far as I know) not considered a secret

I believe such a system is Safer to use for the average customer because the law is on his side. A routing number is (as far as I know) not considered a secret and very judge will rule that it's the banks fault for authorizing the transaction, not the user's. If the user were to use any kind of authentication (such as typing a pin in a card reader), the bank can claim that it's the user's fault because he used his code carelessly and they are often right, people write the code on cards directly or use their birthdates but even if the pins are random, they can still be easily "cracked" (some people are super skilled in reading them from a distance while others have implemented key loggers in those readers). So you can't really use a password/pin for authentication either (because it is not that secure after all). In my country, debit cards are quite common and debit cards never use a signature – they use a 4 digit pin instead. If your debit card was stolen, and somebody went shopping with it, you have to pay the bills because you did not protect your pin enough and it's not the bank's fault — they had enough proof for authentication. (I know quite a few people who had bills from $300-2000 after their debit cards were stolen and I can tell you for sure that some protected their PIN properly). If you have to authenticate a withdraw in any way, the bank will have a better chance to win a fraud case because they had enough reason to believe the transaction was authentic and it is your fault not for protecting your pin or password enough. The bank might voluntarily rebook the transaction but why even bother if they had to do that anyways (even without a pin). The consumer is not the victim here, the bank who has to get the money back is. So why would you want to fix a system that works in your favor.

gambler 10y ago
This is an interesting point. The article complains about checks being zero-factor authentication. Well, in practice, traditional chip-less credit cards are also zero-factor authenticated. The notion that our card numbers are supposed to be "secret" is plain stupid, since we give it to every single vendor we interact with. PIN-based cards are authenticated, but the practical security around those PINs is laughable. So would you rather have obviously insecure but resilient system, or unobviously insecure and fragile system? ... Making checks secure is relatively "easy". Simply have a mechanism for the person to review and authorize every credit/withdrawal via SMS or email. The problem, however, becomes keeping that mechanism secure, especially in the age of easily stealable and hackable mobile phones.
- Matt3o12_ 10y ago
  I want to have a system which protects me from money loss (through my own fault, a malicious third party, or my bank's fault). I don't care how as long as I'm protected. With Chip-and-PIn cards, I'm not protected because I have to proof that it was not my fault (which can be incredible difficult to do). So, I personal prefer cards that require a signature. It doesn't matter to me if it has a chip or not (the chip has nothing to do with the pin, there are also chip-and-signature cards and cards that support both. The chip makes it hard to physically clone the card). If you are interested in the downsides of the new pin card, checkout this video: https://youtu.be/Ks0SOn8hjG8 https://youtu.be/Ks0SOn8hjG8 So, if zero authentication means that I am not liable for financial damages, I'm happy with it but I wouldn't bother to use a pin if I had the same liability. Unfortunately, the pin adds laughable authentication which makes me liable for many types of fraud (see the video).

gambler 10y ago

This is an interesting point. The article complains about checks being zero-factor authentication. Well, in practice, traditional chip-less credit cards are also zero-factor authenticated. The notion that our card numbers are supposed to be "secret" is plain stupid, since we give it to every single vendor we interact with. PIN-based cards are authenticated, but the practical security around those PINs is laughable. So would you rather have obviously insecure but resilient system, or unobviously insecure and fragile system? ... Making checks secure is relatively "easy". Simply have a mechanism for the person to review and authorize every credit/withdrawal via SMS or email. The problem, however, becomes keeping that mechanism secure, especially in the age of easily stealable and hackable mobile phones.

Matt3o12_ 10y ago
I want to have a system which protects me from money loss (through my own fault, a malicious third party, or my bank's fault). I don't care how as long as I'm protected. With Chip-and-PIn cards, I'm not protected because I have to proof that it was not my fault (which can be incredible difficult to do). So, I personal prefer cards that require a signature. It doesn't matter to me if it has a chip or not (the chip has nothing to do with the pin, there are also chip-and-signature cards and cards that support both. The chip makes it hard to physically clone the card). If you are interested in the downsides of the new pin card, checkout this video: https://youtu.be/Ks0SOn8hjG8 https://youtu.be/Ks0SOn8hjG8 So, if zero authentication means that I am not liable for financial damages, I'm happy with it but I wouldn't bother to use a pin if I had the same liability. Unfortunately, the pin adds laughable authentication which makes me liable for many types of fraud (see the video).