3 ms·

The pin isn't the security, your physical card is. Pins are usernames, cards are passwords.

ceejayoz 2y ago
My bank has more than 10k customers, despite four digit PINs.
kstrauser 2y ago
I think that’s exactly opposite. The card is the unique identifier assigned by the bank. We could all share the same PIN.
- ramesh31 2y ago
  >The card is the unique identifier assigned by the bank. The account number is the unique identifier assigned by the bank. Your card is the physical "key" (password) to said account, and the PIN is your self chosen identifier (username). Think of it this way: I can tell you my pin number and my bank account number all day long, it doesn't matter if you don't have my card. But if you had my card, you'd have a reasonable shot at guessing the PIN and gaining access. The card is the password.
  - kstrauser 2y ago
    The card is a physical representation of your account number, readable with a magstripe scanner. It's analogous to a username written on a scrap of paper. Despite the misnomer, a PIN can't really be an identifier if you and I have the same one.
    - ramesh31 2y ago
      >Despite the misnomer, a PIN can't really be an identifier if you and I have the same one. Sure it can, the namespace is just within your account. I am logging into account X (account number) as Person Y (PIN) with authorization Z (card)
      - kstrauser 2y ago
        Except my wife and I can both have the same PIN, so it's still not a unique identifier. A PIN is a password, not a username.
      - GrinningFool 2y ago
        Person Y and Person Z on account X could use the same PIN with different cards. A PIN is not an identifier.
    - iggldiggl 2y ago
      > The card is a physical representation of your account number, readable with a magstripe scanner. Which is no longer true for EMV cards, though. There, the chip contains some additional data which cannot be easily copied and which helps identify the card as a bona fide real card issued by a bank. https://www.emv-connection.com/contact-chip-card-online-authentication/ https://www.emv-connection.com/contact-chip-card-online-auth... (there's also some alternative authentication method that would work offline, i.e. just between the card and the payment terminal)
      - kstrauser 2y ago
        True, but for analogy purposes, it still maps back to a specific account somewhere.
  - ianburrell 2y ago
    Still doesn't make the PIN the username. You can have two passwords. The PIN is closer to the MFA code. Or more like PIN is that password, and the card is the token.
mortehu 2y ago
A more sensible way to break it down is by "something you have" (phone or YubiKey), "something you know" (password) and "something you are" (face or fingerprint). Username and password are both something you know, so they count as just one factor. A card on the other hand is something you have, so combined with the PIN that's two factors.

My bank has more than 10k customers, despite four digit PINs.

I think that’s exactly opposite. The card is the unique identifier assigned by the bank. We could all share the same PIN.

ramesh31 2y ago
>The card is the unique identifier assigned by the bank. The account number is the unique identifier assigned by the bank. Your card is the physical "key" (password) to said account, and the PIN is your self chosen identifier (username). Think of it this way: I can tell you my pin number and my bank account number all day long, it doesn't matter if you don't have my card. But if you had my card, you'd have a reasonable shot at guessing the PIN and gaining access. The card is the password.
- kstrauser 2y ago
  The card is a physical representation of your account number, readable with a magstripe scanner. It's analogous to a username written on a scrap of paper. Despite the misnomer, a PIN can't really be an identifier if you and I have the same one.
  - ramesh31 2y ago
    >Despite the misnomer, a PIN can't really be an identifier if you and I have the same one. Sure it can, the namespace is just within your account. I am logging into account X (account number) as Person Y (PIN) with authorization Z (card)
    - kstrauser 2y ago
      Except my wife and I can both have the same PIN, so it's still not a unique identifier. A PIN is a password, not a username.
    - GrinningFool 2y ago
      Person Y and Person Z on account X could use the same PIN with different cards. A PIN is not an identifier.
  - iggldiggl 2y ago
    > The card is a physical representation of your account number, readable with a magstripe scanner. Which is no longer true for EMV cards, though. There, the chip contains some additional data which cannot be easily copied and which helps identify the card as a bona fide real card issued by a bank. https://www.emv-connection.com/contact-chip-card-online-authentication/ https://www.emv-connection.com/contact-chip-card-online-auth... (there's also some alternative authentication method that would work offline, i.e. just between the card and the payment terminal)
    - kstrauser 2y ago
      True, but for analogy purposes, it still maps back to a specific account somewhere.
- ianburrell 2y ago
  Still doesn't make the PIN the username. You can have two passwords. The PIN is closer to the MFA code. Or more like PIN is that password, and the card is the token.

mortehu 2y ago

A more sensible way to break it down is by "something you have" (phone or YubiKey), "something you know" (password) and "something you are" (face or fingerprint). Username and password are both something you know, so they count as just one factor. A card on the other hand is something you have, so combined with the PIN that's two factors.