5 ms·

Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when

• morsch 12y ago
  It's secured by a four digit password and self destruction after three consecutive invalid PIN entries. Which is plenty secure against brute force. Or is that just the way it works around here?
  • eyko 12y ago
    Unless you buy online, in which case you just need the "last 3 digits on the back of your card".
    • nraynaud 12y ago
      it's not a password, and it doesn't give the same insurance. There were some proposal of at home card readers in the 2000, but it never got very far, it was not really practical to secure either. I think the current trend of scratch credit card could be onto something for online buying, it's a temporary credit card number valid just for a few hours, and then it's deleted from the bank system.
    • raesene3 12y ago
      That's different to the PIN. CVV is for cardholder not present transactions, PIN is for one's where you're there. Also CVV needs the 16 digit card number, card holder name and expiry as well.. I'd almost guarantee that trying to brute-force a CVV number will get your card blocked real fast.
      • smackfu 12y ago
        I got an email from my credit card after a single CVV failure, because the guy at the Apple store entered it wrong.
  • crashandburn4 12y ago
    I actually rely on this self destruction, I have a scrap of paper in my wallet with "Pin Numbers" written on it along with 3 random four digit numbers, gives me minor peace of mind that if my wallet is lost and found by someone that wants to try and use them, hopefully they'll lose them to an atm rather than using them online.
    • krzrak 12y ago
      Awesome idea :)
    • omh 12y ago
      I like that idea. Unfortunately it doesn't prevent them using them online as well. At least for my cards, if I lock out the PIN I can still use them for non-PIN purchases.
      • crashandburn4 12y ago
        Ah, in the UK it is standard for the machine to keep your card after three incorrect pin attempts. (at least I think it's the standard?)
        • omh 12y ago
          I'm in the UK as well. I was actually thinking of Chip & PIN transactions, but you may be right about cash points.
          • crashandburn4 12y ago
            Good point. wasn't thinking about that.
  • oneeyedpigeon 12y ago
    A tiny number of digits combined with the standard, visible input system is a recipe for 'shoulder surfing' attacks. I'm not proposing a superior system, just pointing out that brute-force attacks are not the only thing to beware.
• chopin 12y ago
  Cards are way different. They combine something you have (the card) with something you know (the PIN). After three false attempts to enter the PIN you have to unlock the card going a different route. In such a scenario, 4 digits are fine. You can't lock accounts only protected by a password and accessible by anyone (via internet) this way as this would invite for Denial-of-Service attacks (locking your account with three failed attempts).
  • koyote 12y ago
    I have had quite a few sites block my account for three bad password attempts and I had to actually call the company to unlock the account (this was always a financial services company). It's quite annoying as none of the sites warned me about the impending account block after the first or second try. I guess it's an inconvenience that is worth it for the extra anti-brute-force security. Being locked out due to someone personally locking you out as you mentioned might also be annoying, but I honestly rather be locked out of my account and therefore alerted that someone is trying to gain access to my data than not. Why these same sites limit my password to a specific number of characters and disallow special characters is beyond me though.
    • kalleboo 12y ago
      > I have had quite a few sites block my account for three bad password attempts and I had to actually call the company to unlock the account (this was always a financial services company). GoDaddy does this. It's the main reason I left them (before all the more recent shenanigans)
    • jordanthoms 12y ago
      It's always annoyed me how people set the lockout after n attempts value to ~3 or 4. Why not 100? It makes almost no difference in your chances at brute forcing a password, but means that the real user trying all the passwords they might have used won't get locked out mid way.
      • NateDad 12y ago
• eximius 12y ago
  Mine is 10 digits. I thought the 4 digit limit was just a societal assumption? (I'm being serious, I thought it was (near) universally allowed to be longer, people just didn't bother.) Is this not the case?
  • crashandburn4 12y ago
    Great, now I need to change all my pin numbers. :)
  • casualbob_uk 12y ago
    I believe some cash machines in the UK don't require you to press 'enter' after typing in your code, they just 'go' after 4 have been entered.
  • PeterisP 12y ago
    It's not the case, it depends on the issuing institution. Also, there is a practical requirement to have it short; as physical merchants value quick processing, and having to type&re-type long passwords delays other people behind you - so they want long PINs to be unpopular.
  • relix 12y ago
    Not common, and using anything other than 4 digits is not wise if you want universal support especially when travelling - 6 digit cards are not 100% compatible with every ATM/card machine because some (most?) only allow 4 code entry. I've never heard of 10 digits and the compatibility must be even more limited. Where do you live and what happens if you try to use your card at ATM's abroad?
  • huhtenberg 12y ago
    Mine was 8 until I came to visit certain European country where every single terminal has PIN length capped at 6. The best vacation I ever had.
• PeterisP 12y ago
  Well, it's not like my card is hooked up to the internet for everybody to try and log in. PIN isn't particularly vulnerable to brute force anyway, as number of failed authorisation attempts is strictly limited to something like 3, and a fraudster has to risk capture by being physically present at each attempt or 'trying out' a stolen card, and having their face recorded on cameras. I haven't seen any advantages for using 6-digit or larger "passwords" for that particular scenario. The largest practical security benefit seems to come from enforcing random PINs and not allowing to choose - since the banks that allow to choose are vulnerable to "dictionary attacks" of trying the user's birthday (obvious from other stuff in a stolen wallet) and stuff like 1234. Now, checking "signature" instead of chip&pin, now that's an example of blind trust.
  • penguat 12y ago
    No need to be physically present anywhere except where the card is, and as for cameras, I see none on a PINSentry: https://www.google.co.uk/search?q=pinsentry&source=lnms&tbm=isch&sa=X&ei=pMRoU_-TPMW4O4elgdAF&ved=0CAgQ_AUoAQ&biw=1858&bih=995 https://www.google.co.uk/search?q=pinsentry&source=lnms&tbm=...
  • praptak 12y ago
    > Now, checking "signature" instead of chip&pin, now that's an example of blind trust. If even. I cannot find the original report, but there was a guy who tried all kinds of weird signatures including "I STOLE THIS CARD" and it only took purchasing 3 most expensive TVs and signing "NOT AUTHORIZED" for someone to question him. Unoriginal report: http://www.getrichslowly.org/blog/2006/07/29/the-credit-card-prank-crazy-signatures/ http://www.getrichslowly.org/blog/2006/07/29/the-credit-card...
    • swimfar 12y ago
      https://web.archive.org/web/20130120184305/http://www.zug.com/pranks/credit_card/ https://web.archive.org/web/20130120184305/http://www.zug.co...
    • danpalmer 12y ago
      Interestingly, the signature could be argued to be better in some cases: Under British law, a forged signature is never your fault, and the bank/merchant/card processor are liable (I can't remember exactly which, I think it depends). One of the reason that card issuers were so keen to switch to Chip&PIN/EMV is that the liability was turned over to the user. As they thought EMV was "unhackable", always a dangerous thought, it was always assumed that the user had told someone their PIN. It wasn't until relatively recently that the Cambridge University security research group showed that it was crackable, and the banks/etc started taking liability in some cases again.
• Dylan16807 12y ago
  Losing passwords is bad because they get reused. 4-digit pin not so much, debit card is basically the only thing that uses it.
  • SideburnsOfDoom 12y ago
    You don't have to re-use passwords. In fact, don't re-use passwords. Keeping them in a password manager helps a lot with this. I have over 50 unique passwords which are all long, generated random strings. But there are a few websites, including British Gas, which get shitty weak passwords because they pull dumb crap like this in the name of "security".
    • Dylan16807 12y ago
      People shouldn't but they do. If they didn't then password breaches would barely matter.
  • oneeyedpigeon 12y ago
    Not true; the password on iOS devices is a 4-digit pin; in my experience, plenty of people either reuse their bank PIN, or just use their DOB.
• Nursie 12y ago
  The standards allow for up to 12. Not that people always implement them properly, but that's what you're supposed to support if (like me at the moment) you make credit-card terminals.
  • madeofpalk 12y ago
    Cards issued by Commonwealth Bank in Australia actually don't come with a PIN - you set it yourself, up to 12 chars, online when you activate.
• bowlofpetunias 12y ago
  No, limited transactions on your bank-account are secured by a physical token (i.e., your debit card) and a 4 digit "password". Your card is not a service to be secured, it's part of multiple layers of security (that don't end with the code or the card).
• weavie 12y ago
  You get contact-less now which doesn't need any pin at all, just tap the card on the machine and your purchase is complete.