3 ms·

Why isn't the PIN pad on a touch screen? Wouldn't that be more secure? Are people's hands just too filthy in the aggregate? I know those buttons feel pretty gri

Why isn't the PIN pad on a touch screen? Wouldn't that be more secure? Are people's hands just too filthy in the aggregate? I know those buttons feel pretty grimy. They have been giving away paper towels and glass cleaner since the dawn of time. Why not hand out screen cleaners too, and let people wipe down the touchscreen if it needs it? People could also use them on their phones and would be delighted. Or why not allow people to place their orders from their own screens? There is no competition for this equipment around UX because there is little competition at all in this space. Its a remarkably regulated product, from weights and measures to EPA checks. UX only has to be good enough for the seller to close the order, and they go in 2500 locations. People buy gas on price and location, not UX, so the theory goes. Who wants to disrupt gas pumps?

IshKebab 7y ago
It's not a touch screen. Robust touch screens are difficult.
ginko 7y ago
> Why isn't the PIN pad on a touch screen? Wouldn't that be more secure? You can't input a pin without looking with a touch screen. Plus you never know if your press actually registered.
- Digit-Al 7y ago
  Also, unless someone physically replaces the PIN pad, which is difficult and likely to leave visible indications of tampering, then one can reasonably sure that entering your PIN is secure. With a software touch screen you have no guarantee and no reasonable way of telling if the software is not harvesting your details and sending them off somewhere so your card can be cloned and used by criminals. [Edit typo]
nradov 7y ago
gloves
- reilly3000 7y ago
  Touché!
Digit-Al 7y ago
PIN pads are generally designed so other people can't shoulder surf your PIN. Having it on the touch screen would make it trivially ready for everyone to see exactly what you are entering.
joezydeco 7y ago
Why isn't the PIN pad on a touch screen? When working with credit cards and chip/PIN systems the entry of the PIN needs to be secure. This usually means the scanning lines from the keypad go directly to a security-hardened subprocessor inside the pump - the same one reading the PAN from the EMV chip or magstripe. Then the PIN/PAN block is encrypted and sent off to the application processor and/or bank to complete the transaction. If PIN entry was offloaded to the application processor, that processor would need to be audited to make sure of certain requirements (PIN isn't sniffable, it isn't held in RAM after deallocation, encryption isn't breakable, etc). At the end of the day it pretty much has to be as hardened as the little subprocessor attached to the EMV reader, except any change to the app now needs to be recertified like the subprocessor is. PCI is beginning to come around to allowing PIN entry on non-secure devices, see the following standard for more information: https://blog.pcisecuritystandards.org/new-pci-software-pin-entry-on-cots-standard https://blog.pcisecuritystandards.org/new-pci-software-pin-e... Or why not allow people to place their orders from their own screens? This exists. https://itunes.apple.com/us/app/exxon-mobil-speedpass/id668175318?mt=8 https://itunes.apple.com/us/app/exxon-mobil-speedpass/id6681... https://play.google.com/store/apps/details?id=com.webmarketing.exxonmpl https://play.google.com/store/apps/details?id=com.webmarketi...

IshKebab 7y ago

It's not a touch screen. Robust touch screens are difficult.

ginko 7y ago

> Why isn't the PIN pad on a touch screen? Wouldn't that be more secure? You can't input a pin without looking with a touch screen. Plus you never know if your press actually registered.

Digit-Al 7y ago
Also, unless someone physically replaces the PIN pad, which is difficult and likely to leave visible indications of tampering, then one can reasonably sure that entering your PIN is secure. With a software touch screen you have no guarantee and no reasonable way of telling if the software is not harvesting your details and sending them off somewhere so your card can be cloned and used by criminals. [Edit typo]

nradov 7y ago

gloves

reilly3000 7y ago
Touché!

Digit-Al 7y ago

PIN pads are generally designed so other people can't shoulder surf your PIN. Having it on the touch screen would make it trivially ready for everyone to see exactly what you are entering.

joezydeco 7y ago

Why isn't the PIN pad on a touch screen? When working with credit cards and chip/PIN systems the entry of the PIN needs to be secure. This usually means the scanning lines from the keypad go directly to a security-hardened subprocessor inside the pump - the same one reading the PAN from the EMV chip or magstripe. Then the PIN/PAN block is encrypted and sent off to the application processor and/or bank to complete the transaction. If PIN entry was offloaded to the application processor, that processor would need to be audited to make sure of certain requirements (PIN isn't sniffable, it isn't held in RAM after deallocation, encryption isn't breakable, etc). At the end of the day it pretty much has to be as hardened as the little subprocessor attached to the EMV reader, except any change to the app now needs to be recertified like the subprocessor is. PCI is beginning to come around to allowing PIN entry on non-secure devices, see the following standard for more information: https://blog.pcisecuritystandards.org/new-pci-software-pin-entry-on-cots-standard https://blog.pcisecuritystandards.org/new-pci-software-pin-e... Or why not allow people to place their orders from their own screens? This exists. https://itunes.apple.com/us/app/exxon-mobil-speedpass/id668175318?mt=8 https://itunes.apple.com/us/app/exxon-mobil-speedpass/id6681... https://play.google.com/store/apps/details?id=com.webmarketing.exxonmpl https://play.google.com/store/apps/details?id=com.webmarketi...