3 ms·

Couple of things. First, I suppose I should have assumed it, but I didn't know botnets had nice admin panels! :) Secondly, this is at least part of what chip-a

Couple of things. First, I suppose I should have assumed it, but I didn't know botnets had nice admin panels! :) Secondly, this is at least part of what chip-and-pin was supposed to solve, and here in the US we ended up with chip and signature, which is almost as useless. (Not that it helps much with online transactions, although I'd be more scared of mail fraud charges than anything...) I wonder if card companies ever go darknet and try to bot the bots, to proactively close and replace those compromised cards?

detaro 10y ago
> First, I suppose I should have assumed it, but I didn't know botnets had nice admin panels! :) Since selling botnets and access to them has become a large business, they have to be user-friendly. And have features like license checks, reseller-accounts etc, like you'd expect from a proper SaaS package.
ianmiers 10y ago
From what I understand, this is exactly what chip and signature solves and adding a PIN does little. The "credit card numbers" a chip produces are one time use, so skimming them is worthless. And if the POS system is really and truly owned, it still gets to see the PIN. The only thing a PIN protects against is stolen cards. But it also creates the presumption that any stolen card that is used was the users fault because she gave up the PIN. This is problematic especially if coupled with a liability shift. There is a long line of work by [0] about these problems in England. [0] https://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf https://www.cl.cam.ac.uk/research/security/banking/nopin/oak...
- joe_the_user 10y ago
  The ideal thing would be having a pin you enter into a little keyboard on the card itself, meaning physically stealing the card wouldn't be easy. Then have an interface that would let these cards to be used over the net. Then stolen credentials would be hard to do.
  - e12e 10y ago
    Note that, if you could dust the card, and be highly likely to get the 4 numbers needed for a typical 4 digit pin, with 3 guesses, you'd have a ~13% chance of guessing the pin for a card ( 1/4! + 1/(4!-1) + 1(4!-2) ). [ed: obviously there are (at most, for 4 different digits) 24 possible combinations, so you'd need 12 tries at 2 guesses/try to be certain you found the correct code]. This does assume you can figure out which digits are in use, but I'd be surprised if you couldn't...
    - joe_the_user 10y ago
      Well, if the card could require you to enter first a random code and then your pin, the key board might be kept such that each key was hit equally often. I'm sure there are plenty more bugs to work out in such a system but if such things were reasonably widespread, it would make overall security much higher.
- hluska 10y ago
  Does the US implementation of chip and pin include a dynamic credit card number?? The Canadian version does not.
Cyph0n 10y ago
They are actually very well designed, especially those of higher end botnets.

detaro 10y ago

> First, I suppose I should have assumed it, but I didn't know botnets had nice admin panels! :) Since selling botnets and access to them has become a large business, they have to be user-friendly. And have features like license checks, reseller-accounts etc, like you'd expect from a proper SaaS package.

ianmiers 10y ago

From what I understand, this is exactly what chip and signature solves and adding a PIN does little. The "credit card numbers" a chip produces are one time use, so skimming them is worthless. And if the POS system is really and truly owned, it still gets to see the PIN. The only thing a PIN protects against is stolen cards. But it also creates the presumption that any stolen card that is used was the users fault because she gave up the PIN. This is problematic especially if coupled with a liability shift. There is a long line of work by [0] about these problems in England. [0] https://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf https://www.cl.cam.ac.uk/research/security/banking/nopin/oak...

joe_the_user 10y ago
The ideal thing would be having a pin you enter into a little keyboard on the card itself, meaning physically stealing the card wouldn't be easy. Then have an interface that would let these cards to be used over the net. Then stolen credentials would be hard to do.
- e12e 10y ago
  Note that, if you could dust the card, and be highly likely to get the 4 numbers needed for a typical 4 digit pin, with 3 guesses, you'd have a ~13% chance of guessing the pin for a card ( 1/4! + 1/(4!-1) + 1(4!-2) ). [ed: obviously there are (at most, for 4 different digits) 24 possible combinations, so you'd need 12 tries at 2 guesses/try to be certain you found the correct code]. This does assume you can figure out which digits are in use, but I'd be surprised if you couldn't...
  - joe_the_user 10y ago
    Well, if the card could require you to enter first a random code and then your pin, the key board might be kept such that each key was hit equally often. I'm sure there are plenty more bugs to work out in such a system but if such things were reasonably widespread, it would make overall security much higher.
hluska 10y ago
Does the US implementation of chip and pin include a dynamic credit card number?? The Canadian version does not.

Cyph0n 10y ago

They are actually very well designed, especially those of higher end botnets.