3 ms·

Chip: "something you have" factor. The card has a tamper-resistant chip, that holds cryptographic keys and does the signing. Pin: "something you know" factor.

Chip: "something you have" factor. The card has a tamper-resistant chip, that holds cryptographic keys and does the signing. Pin: "something you know" factor. Card owner enters a PIN code on the POS terminal's keypad. The card only allows the transaction after the correct PIN entry, and blocks in case of multiple errors. No signatures required in this scheme. Except for the cryptographic ones, of course. It works like this: you insert the card, type in[1] your PIN code that is supposed to be secret and then the purchase is authorized. Requirement to enter the PIN lessens the fraud possibility in case of lost or stolen cards, and requirement to have the chip combats skimmers (if terminal is capable and card has a chip, swiping the magstripe instead of using the chip should result in rejection). ______ [1] If prompted. Depending on the bank, infrequent low-cost low-risk purchases may not require a PIN code. Card keeps a list of recent purchases in the EEPROM and is probably capable of starting to ask the PIN code after number of purchases is over some threshold (but I'm not exactly sure how they're programmed).

ars 9y ago
That's the same interface as Chip and Signature, except you enter a PIN instead of scribbling on the screen. Terretta made it sound like there was a large difference.
- drdaeman 9y ago
  Well, card's MCU cannot validate the signature, but it can (and does) validate the PIN code. With chip+sign, if you lost the card, anyone can use it. They'll just draw something remotely resembling the signature on card (if there's any) and that's it. With chip+PIN, this isn't possible. I think that's a significant difference.
  - ars 9y ago
    That is a difference, but it's not what I asked (because I already know about the security difference). He made it sound like there was a UI difference especially as regards transaction speed and convenience.
    - Terretta 9y ago
      There is. You insert card, type pin, hit enter, in one step. All that back and forth and waiting around in your UX discussion is for signatures done at a different step. This is most obvious when the chip reader doesn’t have a stylus and you’re waiting for bits of paper and signing those instead. It’ll really hit home in European cafes vs US restaurants.

ars 9y ago

That's the same interface as Chip and Signature, except you enter a PIN instead of scribbling on the screen. Terretta made it sound like there was a large difference.

drdaeman 9y ago
Well, card's MCU cannot validate the signature, but it can (and does) validate the PIN code. With chip+sign, if you lost the card, anyone can use it. They'll just draw something remotely resembling the signature on card (if there's any) and that's it. With chip+PIN, this isn't possible. I think that's a significant difference.
- ars 9y ago
  That is a difference, but it's not what I asked (because I already know about the security difference). He made it sound like there was a UI difference especially as regards transaction speed and convenience.
  - Terretta 9y ago
    There is. You insert card, type pin, hit enter, in one step. All that back and forth and waiting around in your UX discussion is for signatures done at a different step. This is most obvious when the chip reader doesn’t have a stylus and you’re waiting for bits of paper and signing those instead. It’ll really hit home in European cafes vs US restaurants.