Hacker News Reader

Comment by Tortoise | Hacker News Reader

"The default PIN is the last four digits of your registered mobile phone number. Please call Shift support at 800-897-0717 to reset your Shift Card pin."

That's a terrible idea. This isn't a library card. You're PIN shouldn't be known by anyone who knows your phone number.

View on HN

That's pretty horrendous. Should be inactive until you activate it, or randomly generated and displayed to you securely in some way.

The card actually is inactive until you activate it once it arrives

but if someone intercepts your mail, then they know your address and could possibly know your phone number. How secure is the activation process?

Why dont you send the card and PIN out separately like a bank?

> but if someone intercepts your mail, then they know your address and could possibly know your phone number. How secure is the activation process

Every "normal" credit and debit card I've received in the mail has used this same procedure -- call a number on a removable sticker stuck to the card to activate it where the only verification is the phone number you're calling from (and caller ID is easily faked).

How is this any worse than how every other card activates?

And how do you propose they get around the mail interception problem? Have a courier deliver it to you and place it in your hand?

I was wondering why they think their system is more secure than the traditional method of issuing cards and PINs through the post.

Half of the cards I remember activating were based on the originating phone number (which I think you could still possibly spoof) which should have been tied to your account when you signed up. If the phone you're calling from isn't the same one on your account, there's likely some additional information you provide or maybe go through a CS rep to finish activation. Unfortunately, like you say, there are also many bank's systems who ignore or simply don't care about the call ID number.

As for interception, I guess you could require a signature for delivery but that's a pita. You just have to weigh the risks in that situation and the convenience of not requiring a signature obviously outweighs the risks of theft.

EDIT: grammar

Holy shit, that’s horrible.

Where I am, PIN and Card arrive in different letters, and the Card letter is only sent once you confirmed via your online banking interface (which uses 2FA) that you received the PIN letter. And you need to confirm online in your banking interface to have received the card to be able to use it.

For credit cards in the US you virtually never use a PIN. Debit cards only

That's changing as of this month. Most banks have already issued new chip cards, which require a PIN. If a merchant is still using the old swipe and sign system, now they'll be liable for any fraudulent transactions if the customer has a chip card.

The system in the US is not chip-and-PIN, it's chip-and-signature.

All of the new chip cards in the US I've read about are signature only. It was decided that the US consumer would dislike the added complication of needing to use PIN.

I'd like a chip card that requires a PIN (and that is accepted widely in the US) because such a card would make unauthorized charges less likely after the card is lost or stolen, but was not able to find one.

I have a US chip card where I've set a PIN for transaction purposes, so it's not signature only, but it'll still accept both. That said, all of the chip card readers that I've used (few and far between still...) seem to have been configured for signature only, so I haven't been prompted for my PIN yet.

Thanks for clarifying. I agree that my "signature only" was inaccurate.

Incorrect. The new cards are chip and signature. No pin involved.

Debit cards are chip and pin now, granted

Well, even then.

Require the customer to verify that he/she received the card in their online banking interface.

Mark it as invalid/stolen/whatever before that.

This may seem foreign to most people here, but there's still a TON of people who don't do online banking or have an account setup/bookmarked for all their financial institutions online sites.

Well, in those cases you can go to the next branch.

Which is itself horrendous on a different axis.

How so? It means you need access to the online account, to the 2FA device, and to both letters to abuse the card.

If the attacker already has access to the online banking account, then he/she can do much worse things anyway.

Different axis aka not security. The security is much better. But it's slow and inconvenient.

How is it inconvenient? It’s not like you get a new card every day.

And it only delays the process by 2 days. At maximum.

Rare inconvenience may be more easily tolerated, but it is no less inconvenient.

The fact that you can even say "well it's only 2 days delay" seems insane to me.

I opened an account at Metro Bank (in London), in a branch. They verified my id, then printed a debit card — this took about 10 minutes — and let me set its initial PIN in the bank.

I don't know if this is now normal in the UK. The previous time I opened an account in-branch was 2004, when the chip card arrived by post a few days later, with the PIN in a separate letter.

Similar situation here in Germany – but some banks, as I mentioned, require you to verify online that you received the letters, if you enabled this security feature.

In fact, I’ll go next friday to the bank to get a new debit card, as my existing one stopped working a few months ago.

Metro Bank are a newcomer to the market who've focused heavily on streamlining their customer enrolment because of that. I don't think other banks offer this.

> (and caller ID is easily faked)

It's been a long time since I was into telephony stuff, but IIRC caller ID is easily faked but ANI is not. Do verifications use CID or ANI?

they use ANI, as they're toll free numbers you're dialing (which means they're already capturing ANI for billing purposes[1].)

this is also why caller ID blocking (as provided by your telco) doesn't work when calling toll-free numbers.

1: https://en.wikipedia.org/wiki/Automatic_number_identificatio...

False: the card is inactive until someone activates it.

that is terrible, especially for a company in the bitcoin space which should be encouraging best practice for security at all times.

The bitcoin industry has a long and chequered history when it comes to best practices.

Part of the appeal of bitcoin to many is "Banks are so unnecessarily expensive to transmit value", the bitcoin industry has slowly and painfully been learning one disaster after another that maybe some of that cost isn't unnecessary after all.

What disasters are you talking about? It is possible to transmit value securely and safely with bitcoin so Im not sure what point you are trying to make other with this sort of vague statement.

The mtgox débâcle springs to mind.

EDIT: My point is that a financial service is more than just the protocols used. Actually the protocols are the least important thing to the average customer. The more important thing is trust. I trust that my money in the bank will stay there and that transactions made using my bank will go to the person I say they should. Part of the reason for my trust is in the regulation around the banking industry. E.g. the savings guarantee here in the UK(/EU?). The bitcoin industry (not the protocol but the services around it) have yet to provide me that level of trust coupled with comparative ease of use.

But that was not a disaster for bitcoin, that was a case of fraud and theft. Not much different to someone embezzling fiat from a firm e.g.secure investmen, and that wasn't a disaster for fiat currencies or the traditional banking system.

I think that many people hold bitcoin and bitcoin businesses to a higher standard than they would companies that operate outside this sphere.

They clearly said "the bitcoin industry" so their comment stands.

> I think that many people hold bitcoin and bitcoin businesses to a higher standard than they would companies that operate outside this sphere.

I hold them to exactly the same standard as traditional financial services. I can see you point in that for many people bitcoin is just voodoo (on the other hand for many people traditional financial services are voodoo and people trust them with their pensions).

If someone stole 5% of all the world's fiat currency from an unregulated, uninsured financial institution (Which in that sense was no different from any other BTC exchange... So it's not like anyone had better options.) with customers not getting any recourse, that would be a disaster for fiat currencies.

At least, it would be an unmitigated disaster for the Wild West style of regulating fiat currencies.

People hold BTC businesses to a higher standard because after your BTC is stolen by 'hackers' in an ex-Soviet republic, you have absolutely zero recourse. They hold BTC to a higher standard because no individual in the fiat world siphoned off a trillion dollars into his accounts last year. They hold BTC to a higher standard because the companies operating in the space absolutely refuse to properly protect their customers.

I would note that siphoning off massive amounts of money does happen in the fiat world despite regulation (but because off ineffective implementation of regulation) e.g. the Madoff case.

Have a look at secure investment, they split with $130 million dollars in fiat.

What about the $1bn stolen from moldovan banks?

There has been no customer recourse there.

Trillion? Really? That is an order of magnitude grater than bitcoins total market cap.

The MT.Gox disaster included the theft of ~7% of all BTC.

Depending on how you want to measure the amount of fiat currency in circulation, 7% of that would be close to a trillion dollars.

Yes there is a savings guarantee in the US/UK/EU however if funds are stolen from your bank account you are as unlikely to get them returned as you are to get stolen bitcoin back. The difference is that the government is covering (with taxes) the loss incurred by the bank (if necessary) but that doesn't mean you are automatically covered by this insurance in the case of a theft.

In terms of theft. It depends upon the manner of the theft. If one follows the banks required precautions then one is usually covered (in the UK at least). If one does not then one is not covered -- although I'd agree that banks are increasingly not covering people if they can avoid doing so.

I was more thinking of institutional theft (i.e. embezzlement). I'm almost certain my bank won't just vanish the money I have lent them through my savings account. Of course the same cannot be said of "Random Investment Company Name" who was recommended to me on a forum/down the pub. As yet (and I hope that this changes) non of the bitcoin service companies have risen above this level of trust (for me personally).

EDIT: Added fact that my assessment of trust is my personal subjective opinion and shouldn't be taken as a fact.

I've had my credit card and debit card stolen several times. One time, the person who got it took out over a thousand dollars from an ATM in another country. I got it all back (from Chase) within 5 days every time, which would never happen with Bitcoin.

"Banks are so unnecessarily expensive to transmit value"

.. which isn't really true in the EU ("Faster Payments"). It's only true in the US because the regulation is fragmented and reflexively in favour of the capitalist over the consumer. It's the banking equivalent of Comcast.

That is the default security of my library card. How universal is this?

You have a library card with a settable PIN? Every one I've gotten has been an auto-incrementing ID with no security.

Santa Clara county librarybhas a settable PIN.

I hope you live in a place where everyone leaves their doors unlocked, children walk to school and play freely in the streets, and the police actually serve and protect the public.

Are you from Iceland?

Well, it does say "default" PIN. Still not good, but you can at least change it, presumably.

Reply on news.ycombinator.com