3 ms·

From what I understand, this is exactly what chip and signature solves and adding a PIN does little. The "credit card numbers" a chip produces are one time us

From what I understand, this is exactly what chip and signature solves and adding a PIN does little. The "credit card numbers" a chip produces are one time use, so skimming them is worthless. And if the POS system is really and truly owned, it still gets to see the PIN. The only thing a PIN protects against is stolen cards. But it also creates the presumption that any stolen card that is used was the users fault because she gave up the PIN. This is problematic especially if coupled with a liability shift. There is a long line of work by [0] about these problems in England. [0] https://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf https://www.cl.cam.ac.uk/research/security/banking/nopin/oak...

joe_the_user 10y ago
The ideal thing would be having a pin you enter into a little keyboard on the card itself, meaning physically stealing the card wouldn't be easy. Then have an interface that would let these cards to be used over the net. Then stolen credentials would be hard to do.
- e12e 10y ago
  Note that, if you could dust the card, and be highly likely to get the 4 numbers needed for a typical 4 digit pin, with 3 guesses, you'd have a ~13% chance of guessing the pin for a card ( 1/4! + 1/(4!-1) + 1(4!-2) ). [ed: obviously there are (at most, for 4 different digits) 24 possible combinations, so you'd need 12 tries at 2 guesses/try to be certain you found the correct code]. This does assume you can figure out which digits are in use, but I'd be surprised if you couldn't...
  - joe_the_user 10y ago
    Well, if the card could require you to enter first a random code and then your pin, the key board might be kept such that each key was hit equally often. I'm sure there are plenty more bugs to work out in such a system but if such things were reasonably widespread, it would make overall security much higher.
hluska 10y ago
Does the US implementation of chip and pin include a dynamic credit card number?? The Canadian version does not.

joe_the_user 10y ago

The ideal thing would be having a pin you enter into a little keyboard on the card itself, meaning physically stealing the card wouldn't be easy. Then have an interface that would let these cards to be used over the net. Then stolen credentials would be hard to do.

e12e 10y ago
Note that, if you could dust the card, and be highly likely to get the 4 numbers needed for a typical 4 digit pin, with 3 guesses, you'd have a ~13% chance of guessing the pin for a card ( 1/4! + 1/(4!-1) + 1(4!-2) ). [ed: obviously there are (at most, for 4 different digits) 24 possible combinations, so you'd need 12 tries at 2 guesses/try to be certain you found the correct code]. This does assume you can figure out which digits are in use, but I'd be surprised if you couldn't...
- joe_the_user 10y ago
  Well, if the card could require you to enter first a random code and then your pin, the key board might be kept such that each key was hit equally often. I'm sure there are plenty more bugs to work out in such a system but if such things were reasonably widespread, it would make overall security much higher.

hluska 10y ago

Does the US implementation of chip and pin include a dynamic credit card number?? The Canadian version does not.