4 ms·

Signing is working in your interest. You can ask to see the receipt that you signed in case of fraud. With PIN, the burden of proof is on you - the bank will s

by zurn 9y ago

Signing is working in your interest. You can ask to see the receipt that you signed in case of fraud. With PIN, the burden of proof is on you - the bank will say you were careless with the PIN and let other people see it, abrogating their responsibility. Even if it's a security vulnerabilty in their system. (Not a theory, this is how it goes in Europe - see Ross Anderson's group's work on this)

avar 9y ago
Do you mean this 2010 paper: https://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf https://www.cl.cam.ac.uk/research/security/banking/nopin/oak... Here's their blog post about it at the time (but the YouTube video is down, unfortunately): http://www http://www. lightbluetouchpaper.org/2010/02/11/chip-and-pin-is-broken/ From the paper: "Because stolen cards can be used without knowing the PIN, by our definition, Chip and PIN is broken. We do not believe that the system is broken beyond repair, but neither is it the case that a simple fix will suffice, due to the unmanageable complexity of EMV."
- zurn 9y ago
  They have been doing a lot of work in the area, I think 2009-2015 at least. There are several publications, and more than one attack.
mseebach 9y ago
Is there any evidence that the Ross Anderson attack has happened in the wild? Someone using a stolen card and the bank just washing their hands of it because PIN?
- zurn 9y ago
  Looks like there is is some evidence quoted in the background section of this paper: http://sec.cs.ucl.ac.uk/users/smurdoch/papers/oakland14chipandskim.pdf http://sec.cs.ucl.ac.uk/users/smurdoch/papers/oakland14chipa... I haven't followed closely, there may be more / better evidence. Edit: this article has more on the french case quoted in the above paper: https://arstechnica.com/tech-policy/2015/10/how-a-criminal-ring-defeated-the-secure-chip-and-pin-credit-cards/ https://arstechnica.com/tech-policy/2015/10/how-a-criminal-r...
0xffff2 9y ago
>You can ask to see the receipt that you signed in case of fraud. I understand that's how it's supposed to work, but what does the signature accomplish in practice? If anything, a "signature" that even contained recognizable letters, much less anything that looked like my name, would be a sure sign of fraud, because I never enter anything that resembles a real signature.
- zurn 9y ago
  Most justice systems have a practice of verifying signatures of documents. I believe it's generally based on comparing the disputed signature to a body of your regular signatures and, in contentious cases, handwriting experts. I'm not sure how it would play out in court if you intentionally make random unattributable scribblings each time. Sounds like something that might be seen as intentional obfuscation.

by zurn 9y ago

avar 9y ago

Do you mean this 2010 paper: https://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf https://www.cl.cam.ac.uk/research/security/banking/nopin/oak... Here's their blog post about it at the time (but the YouTube video is down, unfortunately): http://www http://www. lightbluetouchpaper.org/2010/02/11/chip-and-pin-is-broken/ From the paper: "Because stolen cards can be used without knowing the PIN, by our definition, Chip and PIN is broken. We do not believe that the system is broken beyond repair, but neither is it the case that a simple fix will suffice, due to the unmanageable complexity of EMV."

zurn 9y ago
They have been doing a lot of work in the area, I think 2009-2015 at least. There are several publications, and more than one attack.

mseebach 9y ago

Is there any evidence that the Ross Anderson attack has happened in the wild? Someone using a stolen card and the bank just washing their hands of it because PIN?

zurn 9y ago
Looks like there is is some evidence quoted in the background section of this paper: http://sec.cs.ucl.ac.uk/users/smurdoch/papers/oakland14chipandskim.pdf http://sec.cs.ucl.ac.uk/users/smurdoch/papers/oakland14chipa... I haven't followed closely, there may be more / better evidence. Edit: this article has more on the french case quoted in the above paper: https://arstechnica.com/tech-policy/2015/10/how-a-criminal-ring-defeated-the-secure-chip-and-pin-credit-cards/ https://arstechnica.com/tech-policy/2015/10/how-a-criminal-r...

0xffff2 9y ago

>You can ask to see the receipt that you signed in case of fraud. I understand that's how it's supposed to work, but what does the signature accomplish in practice? If anything, a "signature" that even contained recognizable letters, much less anything that looked like my name, would be a sure sign of fraud, because I never enter anything that resembles a real signature.

zurn 9y ago
Most justice systems have a practice of verifying signatures of documents. I believe it's generally based on comparing the disputed signature to a body of your regular signatures and, in contentious cases, handwriting experts. I'm not sure how it would play out in court if you intentionally make random unattributable scribblings each time. Sounds like something that might be seen as intentional obfuscation.