Chip n'pinday

[Softus]

However, from what you're saying, the first PIN change is recorded on the card, whereas all subsequent ones, of which there can be many, are not. I can't conceive of a reason for designing it to be like that. Can you?

I admit i'm guessing hence the question mark above but I believe that you only get one change of pin? hence my assuming it's WORM

Indeed. But why make any assumption? And if you have to make one, why make that particular one?

 

[kendor]

However, from what you're saying, the first PIN change is recorded on the card, whereas all subsequent ones, of which there can be many, are not. I can't conceive of a reason for designing it to be like that. Can you?

I admit i'm guessing hence the question mark above but I believe that you only get one change of pin? hence my assuming it's WORM

Indeed. But why make any assumption? And if you have to make one, why make that particular one?

because the assumption was made in the form of a question and i was hoping someone with more technical knowledge of the system might be able to clarify how it works.
I'm now interested to find out how the system works on a more technical level as this may point out how secure the system really is ( or perhaps not as it may let those more devious get an understanding? )

 

[2scoops0406]

yes but after that first time changing it the memory is "burnt" by using a higher voltage that basically destroys the links on the matrix and thereby leaves the desired connections intact ie the memory addresses are loaded with their relevant information on a permanent basis.
Isn't that Write Once Read Memory in it's electronic form?

You seem to be saying: it behaves like WORM, and this is how WORM works, therefore surely it's WORM.

If you say the memory on the card is WORM, then, leaving aside the technical description of how it works, which I understand, I don't have enough knowledge to disagree with you.

However, from what you're saying, the first PIN change is recorded on the card, whereas all subsequent ones, of which there can be many, are not. I can't conceive of a reason for designing it to be like that. Can you?

I admit i'm guessing hence the question mark above but I believe that you only get one change of pin? hence my assuming it's WORM

Nope, and an unfortunate acroynm if I may add.

 

[kendor]

yes but after that first time changing it the memory is "burnt" by using a higher voltage that basically destroys the links on the matrix and thereby leaves the desired connections intact ie the memory addresses are loaded with their relevant information on a permanent basis.
Isn't that Write Once Read Memory in it's electronic form?

You seem to be saying: it behaves like WORM, and this is how WORM works, therefore surely it's WORM.

If you say the memory on the card is WORM, then, leaving aside the technical description of how it works, which I understand, I don't have enough knowledge to disagree with you.

However, from what you're saying, the first PIN change is recorded on the card, whereas all subsequent ones, of which there can be many, are not. I can't conceive of a reason for designing it to be like that. Can you?

I admit i'm guessing hence the question mark above but I believe that you only get one change of pin? hence my assuming it's WORM

Nope, and an unfortunate acroynm if I may add.

Must only be certain banks then ? i know my bank only allowed one change.

 

[2scoops0406]

Have you tried in an ATM as well, you can't change your PIN in an off line PIN pad, leads to PIN mismatches.

 

[kendor]

Have you tried in an ATM as well, you can't change your PIN in an off line PIN pad, leads to PIN mismatches.

Not sure what you are getting at? I'm just saying that the bank allowed just the one change so in effect it is like WORM isn't it? Or do you know different?what wrong with the WORM analogy?

 

[Softus]

Sorry Softus but you are making a lot of assumptions about what i'm thinking

However:

I'm now interested to find out how the system works on a more technical level as this may point out how secure the system really is ( or perhaps not as it may let those more devious get an understanding? )

So, in what way have I made an assumption, in reading the above and then asking you the following questions:

Okaaay, so you assumed that a particular piece of memory technology was used, in order to attract the attention of someone who knows more about the technology? Do you feel that your ruse worked?

The rest of what I wrote is one of the following:

(a) my knowledge;
(b) my opinion;
(c) a question for you.

I made no assumptions. However, I'm in danger of assuming that you find it impossible to be open, honest and straighforward on this topic.

...and i'm not thinking any of that apart from the fact that to burn a pin into a card reliably and for that matter a technology that uses flash as opposed to volatile Ram one must assume that it is WORM

OK - you go ahead and assume something that it makes no sense for anyone to assume. FYI, flash memory and WORM are two distinct types of technology, are not the same, and do not offer the same features. It's getting increasingly obvious how little you know about anything to do with this subject at all.

 

[kendor]

Indeed. But why make any assumption? And if you have to make one, why make that particular one?

because the assumption was made in the form of a question and i was hoping someone with more technical knowledge of the system might be able to clarify how it works.
I'm now interested to find out how the system works on a more technical level as this may point out how secure the system really is ( or perhaps not as it may let those more devious get an understanding? )

Okaaay, so you assumed that a particular piece of memory technology was used, in order to attract the attention of someone who knows more about the technology? Do you feel that your ruse worked?

While you're pondering on that one, it's not very likely that the knowledge you seek is going to posted here for all to see. We're talking about software knowledge from the financial IT industry that would be potentially useful to criminals in cracking stolen cards and PINs.

Specifics aside, it's obvious how it works. Given that the PIN is stored on the card, in encrypted form, verification of the PIN involves using something similar to what is now run-of-the-mill software PKI technology to authenticate what equates to a 4-character digital signature. The retailers' EPOS machines, the banks' servers, and the connections between them, all represent a trust heirarchy.

Maybe you're worried about precisely what encryption method is used? Maybe you want to know whether the PIN is decrypted at the EPOS terminal or at the bank? Or how strong the PIN encryption is, and how easily/quickly someone could crack a stolen card? This information isn't generally distributed, and if you became someone who has that knowledge that you would also become someone who is automatically a suspect when a fraud occurs.

The bottom line is, as long as you act responsibly in protecting your card and your PIN, you're not liable for any loss.

Sorry Softus but you are making a lot of assumptions about what i'm thinking and i'm not thinking any of that apart from the fact that to burn a pin into a card reliably and for that matter a technology that uses flash as opposed to volatile Ram one must assume that it is WORM

 

[2scoops0406]

Maybe you're worried about precisely what encryption method is used? Maybe you want to know whether the PIN is decrypted at the EPOS terminal or at the bank? Or how strong the PIN encryption is, and how easily/quickly someone could crack a stolen card? This information isn't generally distributed, and if you became someone who has that knowledge that you would also become someone who is automatically a suspect when a fraud occurs.

It can't be decrypted, it is one way encryption. It cannot be cracked, full
stop. Actually when I say canot, I mean it cannot be cracked with other than diminishgly small probability.

Specifics aside, it's obvious how it works. Given that the PIN is stored on the card, in encrypted form, verification of the PIN involves using something similar to what is now run-of-the-mill software PKI technology to authenticate what equates to a 4-character digital signature. The retailers' EPOS machines, the banks' servers, and the connections between them, all represent a trust heirarchy.

No there is absolutely no trust heirarcy. And it doesn't work like that anyway really.

 

[Softus]

Have you tried in an ATM as well, you can't change your PIN in an off line PIN pad, leads to PIN mismatches.

Not sure what you are getting at? I'm just saying that the bank allowed just the one change so in effect it is like WORM isn't it? Or do you know different?what wrong with the WORM analogy?

Jesus H. Christ! Why are you making such a meal out of WORM?

1. Just because something could be implemented using WORM memory, it doesn't mean that it has been.

2. It's not very likely that you're right about the one PIN change. For you to be right, a forgotton PIN would mean that the whole card has to be re-issued.

3. Do you actually need to change your own PIN, or are you going on and on and ON about this for another reason?

 

[2scoops0406]

I'm guessing that was aimed at kendor. The WORM acroynm is only unfortunate 'cos to many people it may smack of viruses, trojans, worm etc. Anyhoe if it was a Write once Read many, how come you can change it once? wouldn't that make it a write twice, read many WTRM?

 

[Softus]

It can't be decrypted, it is one way encryption.

Anything that is encrypted may be subsequently decrypted.

It cannot be cracked, full stop. Actually when I say canot, I mean it cannot be cracked with other than diminishgly small probability.

In other words, it can be cracked.

No there is absolutely no trust heirarcy. And it doesn't work like that anyway really.

I believe you took me too literally. I said that a trust heirarchy was represented. I don't actually care for the details of the workings to be published here.

 

[Softus]

Sorry Softus but you are making a lot of assumptions about what i'm thinking and i'm not thinking any of that apart from the fact that to burn a pin into a card reliably and for that matter a technology that uses flash as opposed to volatile Ram one must assume that it is WORM

1. You're not sorry.
2. I haven't made any assumptions, I've just asked you questions.
3. The assumption that it's WORM is yours, not "one's".
4. Flash and WORM are different technologies with different features.
5. It isn't WORM.
6. If you say that it's WORM, then you're wrong.
7. If you assume that it's something that it isn't, and for no good reason, then you're stupid.

 

[kendor]

Sorry Softus but you are making a lot of assumptions about what i'm thinking and i'm not thinking any of that apart from the fact that to burn a pin into a card reliably and for that matter a technology that uses flash as opposed to volatile Ram one must assume that it is WORM

1. You're not sorry.
2. I haven't made any assumptions, I've just asked you questions.
3. The assumption that it's WORM is yours, not "one's".
4. Flash and WORM are different technologies with different features.
5. It isn't WORM.
6. If you say that it's WORM, then you're wrong.
7. If you assume that it's something that it isn't, and for no good reason, then you're stupid.

all hail softus! as you are being exceedingly stupid by not reading my posts properly and again making assumptions then for all intents and purposes the debate with yourself is over, goodbye!

 

[Steve]

To try and move on from Kendor And Softus' dispute . . .

I thought you could have as many PIN changes as you like.
The new PIN must therefore be written to the chip as many times as you need. As well as being stored on the bank's computer.

Someone mentioned the PIN is on the magstripe too - think it was woodyoulike - though i may have misunderstood him. Dont think this is true - only the "front of card" details are on here, think there's 3 rows of numbers. PIN on card has to be encrypted - magstripe cant hold enough data for encription

The magstripe will also tell the card machine/till whether it is a chip card. Usually if a chip card is swiped, the till will tell the operator to insert the card into the chip reader - unless you're in Tesco, of course - obviously theirs do it by design.