Text 31140, 40 rader
Skriven 2009-04-11 09:31:24 av Robert Bashe (2:2448/44)
  Kommentar till text 31102 av Dan Ceppa (1:138/666.0)
Ärende: Bank Security
=====================
Dan Ceppa wrote to Robert Bashe on Thursday April 09 2009 at 18:03:

RB>> Migawd, you sure are trying to wriggle out of this one. Why not just
RB>> admit that an ATM PIN is numeric (four or possibly five digits) and
RB>> can NOT be changed without replacing the card? What's the big deal?

DC> But it can be changed without having to have a new card issued.

DC> All you need to do is go to your bank, show the proper IDm and the
DC> strip can be re-set with your chosen PIN number.  I've done it before.

And this applies not only to your bank card but to VISA/MASTER? As I wrote in
another message today, Dan, if that is true, it's a security hole as big as a
barn door, as the magnetic stip can be manipulated, as demonstrated many times
in the past.

BUT why should an ATM PIN be in the magnetic strip? Look at the SIM card of a
GSM phone. No magnetic strip, yet the phone number is stored on it, and the
amount of credit on the chip as well. There's enough storage space that can be
written to and read for that. But I've never seen any exploit involving hacking
of the electronics of a GSM SIM card - if that were feasible, you'd see hacked
SIM cards with changed phone numbers and altered credit amounts on the
"underground" websites in the Internet. But there are none.

All of whichg leads me to think that - assuming we're _both_ right - you're
talking about simple bank cards with the PIN stored on the magnetic strip (and
easy to hack) and I'm talking about hardcoded ATM PINs in the electronics of
the card, similar to those in the GSM SIMs - which cannot be changed without
changing the SIM.

At any rate, you can NOT change the ATM PIN on either a bank card or a
VISA/MASTER in Germany, so I assume the PIN is hardcoded into the electronics -
which is naturally the most secure method.

Cheers, Bob

P.S. Perhaps this is even a difference between debit and credit cards?

--- GoldED+/W32 1.1.5-0613
 * Origin: Jabberwocky System - 02363-56073 ISDN/V34 (2:2448/44)