Cambridge boffins rebuff banking industry take down request

Get out of jail free card revoked.

They aren't worried about people using this information to circumvent the technology.

They're worried that people might use it as evidence that they were actually scammed. This will mean that the banks have lost their get out of jail free card and wont be able to just blame the card holder for any loses.

They're crapping themselves that they might actually have to compensate customers.

No action

Having just read the thesis, I think it's disturbing that no action is seemingly being taken by the banks. The banks seem to be assuming (at least publicly) that fraudsters are too stupid to exploit this, a policy that I think is a little on the, well, naive side.

But also quite disturbing to me is the fact that this flaw doesn't seem to be reported more widely. It was published at the beginning of the year but I only heard about it today! Surely the Daily Mail and the like should be screaming loudly about our insecure debit cards by now, forcing the banks into action?

Fail because the whole thing smells pretty badly. Kudos to Cambridge for sticking up for its' researchers though.

Banks fail. Again.

You'd have thought the banks would be keen to avoid yet more bad publicity. Can there be an institution so shameless?

Perhaps the real reason for the take down request

is that the banks often claim that they have absolute proof that a card was legitimately used when the card's owner is adamant that they didn't use it. They then refuse to disclose how they "know" this, on the grounds that it would compromise security.

The user can't report it to the [UK] police as the law now says that the police can only get involved if the bank reports the fraudulent transaction to them, which of course the bank won't do, as it suits them to refuse to acknowledge that it was fraudulent and thus they can make the customer pay the bill instead of taking a loss.

Thus, anything which suggests that, in fact, it is possible that the card owner is telling the truth [because their system can be compromised] must be kept secret, as it contradicts the bank's public position that this sort of thing can't happen and that the customer is therefore responsible for the loss.

But.... but...

... you *CAN'T* go around telling people that Chip and Pin isn't perfect and wonderful and absolutely impossible to fiddle or defraud as we've been lyin^H^H^H^H telling people for ages now!

If you did that, then everyone who's been scammed with a C&P card and been told "too bad, the technology is perfect, it must have been your fault!" might get the idea that they don't need to be fobbed off like this and *can* get their money back from us!

WON'T SOMEONE THINK OF OUR PROFITS!!

- SIgned: The banks.

disgraceful

For institutions that have, over the years, made fortunes from a marginally secure process to complain in this way is pathetic.

'But we don't have the money to invest' (unless we raise our charges) will be the cry. "To do more at this time will impair our competitiveness" .... Enough!!!

Get a proper system, in place without further delay, that secures your customers funds and privacy or get out because you are incompetent. Do not pass Go, Do not collect a big fat golden goodbye!

If you are really as smart as you claim then your marketeers will be able to help you steal a march on your competitors by selling how good and secure your systems really are. A little bit of trust might be restored in the competence of the Banks.

Banks are a joke

Having having f**ked up the country and wondering how to reward themselves with multi-million pound bonuses, I guess insecure Chip-and-Pin are the least of their worries.

Frankly the country would be a lot better off without the current banking institutions and structure. We need to get rid of a bunch of half-arses and I am pretty sure there are a load of competent wannabees who will step into their shoes for less than half the price.

The simple fact

The simple fact of the matter is that the high street banks didn't bring in chip and PIN to make transactions more secure. They introduced it so that they could shift liability from the bank to the individual. The claim by the banks has always been that if you keep your PIN secure you cannot get scammed; therefore, if you are scammed it is your fault and the bank isn't liable. They want this taken down not to stop scamming, but because it would be strong evidence against them if a customer took them to court over the shift in liabilities. The British high street banks have always been very good at running this type of cartel. Look at what they did over unreasonable overdraft charges. The core problem in the UK is actually that the banks have had an effective monopoly position. Until recently, research has shown that people are more likely to get divorced or move house than change current account. Things are improving, but it will take at least another 10-20 years before the cartel is actually broken. Not really different to the length of time the BT monopoly is taking to break down.

Inaction by banks deserves exposure

Whilst Barclays is to be congratulated in closing this particular loophole, the bank cards association had plenty of time to remedy the defect yet all they wanted to do was to shut the info source down.

Lucky he didn't have Plod breathing down his neck, too.

Since the introduction of Pin and Chip the banks have adopted a harder attitude towards complaints of customers accounts being plundered, claiming that their new system prevents fraud when in actual fact it doesn't

This means they are defrauding / misleading / lying to the public whilst some parts of the banks know there are weaknesses. THIS is what is so DESPICABLE about the whole matter.

I never withdraw round amounts from ATM's (490 instead of 500) and I always scan those receipts that fade (so quickly) so in case of dispute I have all the records.

Brilliant Response

Prof Anderson's response is brilliant. Read it here...

http://www.cl.cam.ac.uk/~rja14/Papers/ukca.pdf

Verified By Visa / Mastercard SecureCode

Another pair of "Security Enhancements" that do nothing of the sort.

You have to choose a password that is between 5 and 10 characters that CANNOT CONTAIN NON-NUMERICAL CHARACTERS (!!!!!!)

So 2 of the 3 major Password Complexity rules already broken then - well done.

Also if you forget your password, you can simply reset it, with those incredibly secret pieces of information, your Date Of Birth and Postcode - like they're tough to get hold of.

So, someone nicks or copies your card - not hard, uses the UK Info Disk or similar to get your DOB and address (and postcode) then goes online and spends to their hearts content - really fucking secure that.

It's all as others have said, just a method of the banks getting out of paying disputes, because if the transaction was 'Verified by Visa' then it must have been you, or you gave out your password to someone.

The banks are nothing but a bunch of fucking lying thieving teflon-coated-shouldered arseholes. And that's me toning it down.

If the info...

has been public for that long, it's a bit of a lame research thesis, isn't it?

But UK banks are *too* big to fail

The UK Govt *says* so.*

* And they've handed them a *big* bag of cash to prove it.

Seriously what would be the *real* impact of UK high street bank failure.

Some top bankers *might* not get their last bonus.

Disarray as the loan and mortgage books get sold off and it's worked out who people should be making their payments to.

a bunch of bankers get shown up as f**k witted managers.

I'd call those *acceptable* losses.

thumbs up for the backbone in not giving in to these people who *still* have mostly appear to have done f**k all about it.

The BBC have censored the story.

Despite having surfaced at least 3 days ago (http://bit.ly/hc2ex3), there is still no mention of this story on the BBC news site.

Not that they're biased or anything. /sarcasm off

Someone has certainly complied with the censorship request...

Obvious answer?

Clearly the banks are uncomfortable with truth.

It is far better to live in a sublimely rich (and wealthy) fantasy world if the wealth created in that virtual & fantasy world eventually makes its way into the real world (and, of course, bankers' pockets (Q: do bankers use banks? If not why not?)).

Maybe this PIN thing is just what the banking industry needs to create next profits & bonuses in about 10 years time?

Readers may also wish to have a read of

Professor Anderson's work relating to "smart" meters.

Start at http://www.cl.cam.ac.uk/~rja14/ and follow the smart meter links. Or indeed any of his other excellent stuff that catches your eye.

Seasons greetings.

Another year another 'spectacular'

Here we go another brilliant PhD Researcher at this backwater of Cambridge University undermines the whole Security of the World Banking System by pulling a little stunt. I wish these guys would give it a break and concentrate on something else, they are as annoying as your average OCD afflicted Penetration Tester.

If you wish to expose the insecurity in Retail Banking it is easy, Banks leak information every day, they break their own Security Policies hundreds of times a day, Rules are broken as a matter of routine and members of IT teams, especially unvetted external contractors, have access rights which would make you faint.

Why you would bother to stick an electrical gadget up your sleeve with a wire connecting it to the terminal for a couple of cans of White Lightening is beyond me.

If you want to trash the Chip and PIN system, just move your Lab to Liverpool and set a few of the locals the challenge

How much Tax Payers money is being wasted on this 'Lab'?

As usual

The banks did nothing until they were forced to.

Have PIN transmissions been encrypted yet by the way?

Secure?

If the banks are that worried about fraud, why do they produce 'contactless' debit cards now, where you only have to swipe and don't even NEED a pin number!?

Ok, you can only do small transactions - but you can still work up quite a spend in a day....

"banks aren't payment processors."

Only in the most pedantic sense, where one wishes to distinguish between the organisation issuing the card (eg HSBC) and the (usually one of two) front organisations nominally processing the payments. (Readers may recollect the short-lived UK scam where some big UK retailers decided to nominally "in source" the "payment processing", with the sole purpose of dodging some of the VAT and keeping it for themselves. In a near-unique example of legal sensibleness this scam was ruled illegal. Please refer to Debenhams Retail plc vs HM Customs+Excise).

Who owns and (and is therefore responsible for) VISA? VISA is a publically quoted company but would anyone be stupid enough to think that it isn't controlled by the relevant banks? Same goes for Mastercard, which started life as the "Interbank Card Association".

UK banks seem to have had a collective falling out with Mastercard/Maestro. The alleged free market no longer provides a readily available debit card which will be widely acceptable in the countries where VISA Debit isn't (e.g. Germany prefers Maestro).

The Streisand effect at work.

Attempt to get document censored.

Gets it converted into official Technical Report issued by the University.

Priceless.