2 ms·

I was always under the impression that the microprocessor on the chip should not allow a payment to be processed without the correct PIN. Apparently, based on t

I was always under the impression that the microprocessor on the chip should not allow a payment to be processed without the correct PIN. Apparently, based on the behaviour you described, my assumption is very wrong and the authorization is not made offline on the card itself.

apenwarr 8y ago
The standard allows for both options (and that switchability has led to security holes in the past[1]). Nowadays I think most of them validate the PIN on the server side rather than on the chip, which is better in some ways. [1] https://apenwarr.ca/log/20110222 https://apenwarr.ca/log/20110222