8 ms·
Banks here in the UK use your chip & pin based card as a second factor (or rather, as the two factors - the chip you have, the pin you know) - they give you a l
by Latty 9y ago
Banks here in the UK use your chip & pin based card as a second factor (or rather, as the two factors - the chip you have, the pin you know) - they give you a little card reader that can use the card and pin to provide a 2FA token for logging in or sign requests to send money.
It's a much better system. Of course, some banks don't use it to it's full potential - many use it only for signing money transfers, but it's still pretty good. The readers are also cheap and standardised, so you can use any one of them for any account, which is useful.
- joering2 9y ago> It's a much better system. Sure and much more inconvenient one, because you have to carry this device with you everywhere. Even much better system would be a living being at each ATM machine checking your credentials.
- deleted 9y ago[deleted]
- Veratyr 9y agoWhat credentials? In what way can you authenticate that you are the owner of a bank account to a human better than a smart card reader and PIN?
- zyx321 9y agoIt's the old military-grade 4 factor authentication: Something you know, something you have, something you are, and someone who shoots you if you try anything funny.
- hocuspocus 9y agoYou don't need it everywhere. One card reader at home plus one at your workplace and you've covered most use cases. When you travel for long period of times it's not hard to carry one in your luggage.
- Latty 9y agoExcept it's not because they are very small, cheap devices that everyone has, generally a couple of. I have one at home, one at work, one in my bag, and everyone I know has one I could borrow if I needed one. Essentially all security is a trade off against convinience, this is, in my eyes, a no-brainer. It's barely any more effort and much, much more secure.
- robk 9y agoWhat? I can't think of a single person who uses this and I have lived here ten years. I once got one for a corporate account and it was atrocious with required plug-ins for ie
- robertlagrant 9y agoYou must be thinking of something else. This is just a card reader that you type a number into that your bank tells you to type, and that in combination with typing your PIN in (and having your card inserted) spits out a number on a little screen, which you type back into your bank's website. Takes about 1 minute to do, and you don't need it for every action. E.g. you use it for adding a new account payee and for making a first (or very large) payment to a payee.
- Latty 9y agoYou are clearly thinking of something else. These things are ubiquitous in the UK now. All the UK banks provide them freely with accounts and it's all easy to use and standard, no plug-ins or craziness, just an HTML form. Picking two at random: http://www.nationwide.co.uk/support/security-centre/internet-banking-security/card-reader-and-security-questions#xtab:what-is-a-card-reader http://www.nationwide.co.uk/support/security-centre/internet... http://personal.natwest.com/personal/ways-to-bank/online-banking/do-more-with-online-banking/card-reader-how-to-use-your-card-reader.html http://personal.natwest.com/personal/ways-to-bank/online-ban...
- 0xfeba 9y agoIn the US they have finally started rolling out chip-based cards. However, there's no PIN needed if you run the card as credit, defeating much of the security.
- alasdair_ 9y ago>defeating much of the security. In many ways, this is better, since a skimmer can't grab my pin and credit cards have rules where they must immediately refund fraudulent purchases, while debit cards are often much more difficult to reverse.
- bkor 9y agoYour PIN being skimmed is refunded in The Netherlands without any problem. They usually use the combination of the magnetic swipe and your PIN. Restricting bank cards to just EU reduced this fraud to around 15% of the original amount. See https://www.rtlnieuws.nl/nieuws/binnenland/skimmen-met-80-procent-gedaald https://www.rtlnieuws.nl/nieuws/binnenland/skimmen-met-80-pr.... This was implemented around 2012.
- rocqua 9y agoIn the Netherlands, magnetic swipe has basically been phased out. You are now supposed to use the chip (and obviously still PIN). I think this happened around 2014, basically, the 'swipe' part of almost all readers is now blocked by a sticker that instructs you to use the chip. I'm not sure if the sticker can be moved in case you really want to swipe. Tap-payment is also being rolled out quite rapidly. It's about 1.5 years old and I'd say I now tap for 70% of all transactions. The move
- nawgszy 9y agoI just moved to the States from Canada. Surprised me how far behind payment technologies are here. Swiping is at least as common as the chip readers. I have been to two places that accepted tap and it blew the employee's mind both times that I had a card capable of doing that. I find this an especially entertaining juxtaposition with the transit systems. In Canada, you swipe on the bus and tap in the stores; in the US, swipe in store, tap on the bus.
- snthd 9y agoChip Authentication Programme (CAP) vulnerabilities https://www.cl.cam.ac.uk/research/security/banking/emvcap/ https://www.cl.cam.ac.uk/research/security/banking/emvcap/ http://sec.cs.ucl.ac.uk/users/smurdoch/papers/fc09optimised.pdf#page=8 http://sec.cs.ucl.ac.uk/users/smurdoch/papers/fc09optimised....
- Latty 9y agoA quick skim still makes this look much more secure than any alternative I've seen. Sure, it's not perfect, but a lot of those flaws are due to particular implementations, and most apply equally (or worse) to other systems.
- inyorgroove 9y agoI have always been curious, do those devices work on linux?
- icebraining 9y agoI don't know about that particular implementation, but I can use my citizen card (also a smartcard) to login to government sites on Linux. The site uses a Java applet, which connects to libpcsclite to use the reader.
- blibble 9y agothey don't attach to the PC at all they are a simple standalone device you put your card into they look like this: http://l7.alamy.com/zooms/04452dfd35964790b44ee6514745de5c/nationwide-building-society-digital-banking-card-reader-with-visa-byep9y.jpg http://l7.alamy.com/zooms/04452dfd35964790b44ee6514745de5c/n... to transfer money you enter your PIN, then the target account number and amount to transfer, and it gives you a code you type into the browser
- dagw 9y agoThe Swedish one used to have Linux support, but apparently so few people where using it they couldn't justify the cost and so they stopped supporting it a few upgrades ago. They also seem to be trying in general to move everybody off the USB reader and smart card solution to a smartphone app based solution, so that the total number of people using the USB reader approach is down substantially.
- Doxin 9y agoThey work perfectly fine. From the browsers POV all that's going on is a input field. Since you manually type in the number from the device there's no need for OS support either.
- Latty 9y agoThey aren't devices that connect to your computer. They are standalone things (a little like a calculator) with a screen that shows you a token to type in, like a 2FA app. Works with any web browser supporting a form with a text input.
- wnkrshm 9y agoMy bank in Germany offers a similar system - of course, there are limits to the security as well but there is no public infrastructure, radio transmission or an OS involved. Edit: I also don't need to make transactions often enough for it to be cumbersome - if I was travelling a lot for business and needed to make a lot of transactions, I'd worry about losing the device and being unable to do anything without it.
- Natanael_L 9y agoThere's one bank I know here in Sweden that does the same with cards + reader, ICA Banken. Most others use dedicated hardware tokens.