Hacker News Reader

Comment by lifeisstillgood | Hacker News Reader

Apparently (urban myth time) the bank issued pin is a hash of your bank account number plus some other details that are known without an expensive core database lookup.

This way your pin can be verified without needing to call back to the central bank core - the ATM cloud can just move straight on to transactions.

It may save a lot of cash it may be a myth - anyone got details?

View on HN

I worked at a bank, I did code for generating PINs. I can tell you the urban myth is incorrect. Perhaps a single bank did it, but it sure isn't industry standard.

Did you filter out terrible combinations like 1111?

We did some sensible things to prevent non-sensible things. I don't think talking about the secret sauce would be appropriate though.

The fact that you can change it disproves it.

If enough people never bother to change their PIN, it might still be worth it.

Yeah, but then you have to make the lookup anyway, to check if they did change it. You might as well just authenticate. Unless the original PIN always works, which is not secure.

You are both kind of right: http://en.wikipedia.org/wiki/Personal_identification_number#...

I think the changed PIN is stored on your card as an offset. When you enter your pin, both the offset and the code you entered are transmitted, so they always validate agains the original, non changed, PIN.

My ATM won't complain about an invalid pin until it actually communicates with the bank, at the very end of the transaction (after choosing checking/savings and the amount).

Every ATM in the UK I've used in 1.5 years did that. Makes sense. Why send 2 requests (confirm PIN -> initiate transaction) if you can combine it into one without losing anything?

Reply on news.ycombinator.com