PCI certification has been withdrawn from two older PIN entry devices from Ingenico following concerns they were vulnerable to manipulation by cybercrooks. In a leaked memo, Visa says PCI certification has been withdrawn from two previously approved products from Ingenico - the i3070MP01 and the i3070EP01 - as a "precaution", …
My mother's new Visa...
Her old Switch/Maestro was replaced by a Visa card. Made a few purchases online (Amazon, etc) and was never asked for the "security code" on the back, nor the bank's online service password. This is supposed to be "secure"?
By contrast, my bank has given me a Mastercard tha only works where I am able to physically offer a PIN. For anything else, I create a virtual card authorised to a specific amount for a specific length of time. Not foolproof, but seems somewhat less scammable.
PS: Scare quotes as the definition of what security is differs depending on who you ask and how much they've actually thought about it.
How many more decades until the credit card industry implements cryptographically secure transactions?
We need to get away from static numbers to approving payments. We can blame poor security at the merchant as much as we want, but it doesn't excuse the fact that credit cards today are fundamentally insecure.
Regardless of whether a merchant is trustworthy or not, they simply should not be able to access someone else's credit merely by copying a short number.
If a digital signature is only good for a single transaction, then there would be no underground market for copied credit card numbers in the first place. Sure, the cards could still be physically stolen, but at least the card holder would know right away whether the credit card was in their possession and could immediately report it.
Makes you wonder though
When they made cars more secure, we suddenly had more violent carjackings. I wonder if there might be a similar unintended consequence if we made it impossible for shady types to copy the cards/numbers?
Just a thought.
MasterCard did this in April: http://www.posdata.com/documents/Notification-PCI-De-lisitng-of-POS-%20PIN-Entry-Device-update.pdf
pci dss is a Joke
If you actually read the standards, it is a complete joke.
I always chuckle when I see the ads for chip and pin tech.
Given that all the massive breaches I have read about in the last 12 months have been on the side of the major processing companies
So the terminal at the vendor end is fine, but the crooks just target the lightly secured data systems of the central processors and skim literally millions of numbers.
The latest chip and pin stuff is complete bollocks, and more a way for visa to try and push the cost of fraud to the vendors and users. What they should be fixing is their core systems first.
it's all a sham
PCI is like global warming for the credit card industry. You gotta face it Visa/MC do very little other than expose their brands and "compete" with one another?
We don't need to anonymously provide banking transactions as that permits alot of potentials for abuse.
The problem today is businesses are being permitted into the debit card networks "pin-based" however they aren't actaully capturing a pin.
My insurance company & paypal are both members of the debit program that requires a pin however no pin is requested and the transactions are processed as "pin".
So this kind of activity needs to stop but it won't.
Just to give you an idea of how dangerous this is anyone that knows my card # "checking account" could run transactions that immediately come out of my bank account. There is no dispute process since the transactions are seen as you being physically in a location or you providing your pin. I guess you could dispute faulty goods but as far as theft is concerned it would have to be very difficult to convince them that you in fact didn't use your pin.
You can't continue to have those that cause the problems also come up with the solution.
What "change of strategy"?
The key word in there for a retailer is "maintain", which implies that occasionally he might have to do something other than sit on his arse and carry on as he is. Visa have withdrawn PCI certification from these devices, if a retailer continues to use one, he has not not maintained PCI compliance and is no longer protected.
We need a better method altogether
What we really need is a better, more robust method for authenticating credit and debit card transactions.
How about a complex hand gesture that could be learned by the cardholder, so they could perform it in a matter of seconds? If they perform this gesture while holding a pen, then the pattern of ink left behind would be recognisable.
Anyone could copy such a gesture, it is true; but without the benefit of learning and reinforcement, they would take much longer than the cardholder, and the conscious effort of will required would be evident. For this reason, a comparison sample could even be present on the card itself with no compromise to security: even if the card with comparison sample is stolen, the holder is likely to report it as such rather sooner than the thief can master the gesture to the required standard.
The special pen-holding gesture would just have to be performed in the presence of a human being, who could then make a judgement call based on accuracy and fluency; and in case of any doubt, call for assistance from a supervisor and/or request additional identification.
Sigs were never a secure way to validate the card user. Way too subjective. How do you ensure that everyone applies the same care and attention in checking it, and how do you guarantee it's an accurate enough representation? You can't. Sigs can also easily be replaced with your own making forging one unnecessary. It also takes us backwards, to a place where the physical card details alone are sufficent to clone it.
C&P makes the verification much simpler - it's either right or it's wrong - but it is still flawed. 2 factor would appear to be one of the better options with PIN + PRNG token. It wouldn't fix physical theft, but as you say yourself you'd likely become aware of that fairly swiftly, and you may even have the brains to keep card and token seperately (say bag and pocket).
The most important change however would be to internet payments. As it stands card details can be compromised and used to shop on t'internet/clone it sans chip. 2 factor solves that issue nicely. Ofc until *everyone* uses C&P/2 factor there's always the age old fallback mode hack that has been used to compromise a variety of systems. Folk in the 2nd/3rd world still on sigs could still abuse your card details.
The issue with this at the moment is that the banks/processors DO NOT CARE. Not one jot. The lass had her account siphoned a cpl of years back. Took ages to get it sorted. I went in to the Halifax and said I want all foreign transfers on my account blocked to make sure I was as safe as I could reasonably manage. "No can do". Protecting us isn;t their aim, unless it makes them more money than it costs them :o(
Of course this could never happen
Go to make the complex pen holding gesture, only to find the reference version of the complex pen holding gesture is either missing from a new card or is very badly faded and useless for varification. The owner of the card then fills in the reference copy of the complex pen holding gesture and hands it over to the sales assistant who compares the reference and "actual" complex pen holding gestures, sees that they are identical and lets the transaction go through.
And that never happened to me twice.
Pot, Kettle, Black
All you have to do to see how much Visa cares about security is change the password on the "Verified by Visa" crap.
There that was REALLY difficult wasn't it?
Visa and security in the same sentence doesn't work. At all.
- Apple's spamtastic iBeacon retail alerts launch with Frisco FAIL
- Submerged Navy submarine successfully launches drone from missile tubes
- Cache in the Attic El Reg's contraptions confessional no.2: Tablet PC, CRT screen and more
- Developer unleashes bowel-shaking KILLER APP for Google Glass
- Pix Astroboffins spot HOT, YOUNG GIANT where she doesn't belong