Chip and Pin

shillelagh · 11-02-2010, 21:24

just reading this on the bbc website .. its on newsnight tonight ..

BBC - Newsnight: Susan Watts: New flaws in chip and pin system revealed

they've found a flaw in the chip and pin system ..

A lot of people use the chip and pin system now .. it was feted that it was safer than using a signature by the banks ... and now look they've found a way to get round it ..

Neil · 11-02-2010, 22:16

I wonder if the banks will care. It took them years to do anything about the old swipe ones.

The non contact Barclay one on the adverts interests me. Has anyone got one? What do you do with it?

entwisi · 12-02-2010, 09:06

at the minute the Barclays contactless is only in real use for Oyster travel in London although the kit to make it useable for transactions under 15 quid is now available.

I have it on my Barclaycard and I noticed that Julies new Debit card has it as well ( theres a little logo that tells you )

The BIG difference for fraud etc on C&P was that in teh old days the people on teh tills rarely checked signatures and felt worried about challanging people if they thought it didn't match. The C&P system meant that every transaction was properly 'authenticated' and the cashier had no control over teh outcome.

When it comes to authentication nothing is impervious, it just takes time to crack. Security is there to make it harder to steal in the same way that your 60K new BMW has deadlocks, double glazed windows, you name it to stop it being stolen but throw some straps underneath and use a flat bed with a crane and lift it away, job done, take it where you have weeks to take your time to get into it/rob whatever you want.

Also the Banks do not control or design the C&P system. Its an agreed standard published by a coalition of VISA and Mastercard that all Banks have to meet. As such even if Barclays/HSBC had a fix for it they could not implement it as it would break teh rules in place.

Taggy · 12-02-2010, 10:03

I guess Cheques will be around for quite a bit longer then!!

Best Regards - Taggy

entwisi · 12-02-2010, 10:45

nope, end of life has been finalised

its still hugely more secure than is needed. Lets be honest the most insecure part of teh whole C&P system is the wobbly fleshy thing holding teh card. either they wrire down teh number because they can't remember it or at worst thief threatens to beat them senseless unless they tell him teh PIN

yerself · 12-02-2010, 11:05

I knew it wouldn't be the banks' fault or a software problem.

entwisi · 12-02-2010, 11:12

absolutely, its not,

in the same way that a lot of Banks "rules" are actually imposed on them by FSA and other external bodies ( SWIFT etc )

I actually know very well 2 guys who wrote the C&P side of Barclays ATMs and they were in constant battle with VISA/Mastercard as they were exposing flaws in their systems as they went along. They are 2 VERY clever guys ( ex UNI professors one who specialises in security and artificial inteligence, the other in low level CPU programming ) who happen to be really good blokes as well.