Hacker News new | past | comments | ask | show | jobs | submit login

The card does sign the transaction, even without the PIN. As I understand it the chip believes that it's a non-PIN transaction, whilst the bank and merchant think it's a PIN transaction and that the PIN had been verified by the card, because the standard apparently didn't have any way to ensure that the chip and everyone else agreed on whether a PIN had been used. It's a really broken protocol.

The best part? In the UK, the cardholder is liable for the transactions because the bank thinks that the PIN was used.





This doesn't cover the issue, because the issuers assert that the customer has not been victim of a fraud - they claim that the customer made the transaction.

https://www.cl.cam.ac.uk/research/security/banking/nopin/oak...

(my comment edited for clarity)


Why doesn't it address the issue?

You're talking about something different to makomk, but again, not true, you're repeating another urban myth. It's rare for banks to do that, save for a handful of cases. Occasionally they contest it, but generally when they really think the customer is trying to pull a fast one.

If you believe you have a case, talk to the citizens advice bureau, they will help you. Otherwise stop trying to alarm people with a bunch of nonsense.


> Why doesn't it address the issue?

It is quite simple - the link you provide states that customers are not responsible for fraud, but that does not help if the issuer claims either that the cardholder authorized the transaction or was careless in protecting the PIN (that they can do this is also covered in your link.) If you were to read the link I provided, you would find cases in which issuers denied restitution for fraud on these grounds, even though they could not possibly have evidence that this happened (and there is plenty of circumstantial evidence that it didn’t). The reason they don’t have the evidence is that they chose to open an exploitable hole in their own protocol.

At least at the time of the article, the law allowed the issuers to act as if the protocol was as secure as it was intended to be, instead of how it actually was. If things have changed since then, I would be grateful if you could present evidence that actually shows that to be so.

Instead of being annoyed that I dare mention these inconvenient issues, you should spare your ire for the idiots who created this completely avoidable problem and who tried to brush it under the rug.

Edit: It is telling that the issuers didn't take this seriously until a case involving unissued cards arose - a case that cannot be blamed on the customer.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: