3 ms·
> But encrypted PIN blocks are useless to a hacker. You write them to a card and then you have a dupe that can be used in card-present credit card transactions
by nikcub 13y ago
> But encrypted PIN blocks are useless to a hacker.
You write them to a card and then you have a dupe that can be used in card-present credit card transactions. These dumps are all over the underground forums, they are easy to buy - that is, afterall, how Target found out about the hack.
- gergles 13y agoWhat? The encrypted PIN block isn't on the card; it's generated when you type your PIN in on a PIN pad and is unique by merchant & payment processor.
- cynwoody 13y agoNope. The PIN-block encryption scheme† is specifically designed to be secure against replay attacks. The same PIN will encrypt to a different PIN-block each time it's entered whether at the same POS terminal or a different one. †http://en.wikipedia.org/wiki/Derived_unique_key_per_transaction http://en.wikipedia.org/wiki/Derived_unique_key_per_transact...