PIN isn't particularly vulnerable to brute force anyway, as number of failed authorisation attempts is strictly limited to something like 3, and a fraudster has to risk capture by being physically present at each attempt or 'trying out' a stolen card, and having their face recorded on cameras.
I haven't seen any advantages for using 6-digit or larger "passwords" for that particular scenario. The largest practical security benefit seems to come from enforcing random PINs and not allowing to choose - since the banks that allow to choose are vulnerable to "dictionary attacks" of trying the user's birthday (obvious from other stuff in a stolen wallet) and stuff like 1234.
Now, checking "signature" instead of chip&pin, now that's an example of blind trust.
If even. I cannot find the original report, but there was a guy who tried all kinds of weird signatures including "I STOLE THIS CARD" and it only took purchasing 3 most expensive TVs and signing "NOT AUTHORIZED" for someone to question him.
Unoriginal report: http://www.getrichslowly.org/blog/2006/07/29/the-credit-card...
Under British law, a forged signature is never your fault, and the bank/merchant/card processor are liable (I can't remember exactly which, I think it depends). One of the reason that card issuers were so keen to switch to Chip&PIN/EMV is that the liability was turned over to the user. As they thought EMV was "unhackable", always a dangerous thought, it was always assumed that the user had told someone their PIN. It wasn't until relatively recently that the Cambridge University security research group showed that it was crackable, and the banks/etc started taking liability in some cases again.
Not really true. The main reason was the switch in liability to the merchant, if the merchant accepted a transaction without using EMV and PIN.
AFAICT the Cambridge research isn't really that relevant, it doesn't really give you practical attacks, and it's not so much a crack on the chip security itself as it is a piece of Man-In-The-Middle hardware (IIRC, haven't read it for a couple of years).
Under UK law, with a credit card (debit is different), the liability is never with the user. The bank may claim that it was obviously you that did it, or that you gave away your PIN, but where credit is concerned they legally have to refund you the money pending an investigation.
Debit is less strongly protected and comes under banking rules and guidelines, and if you report unauthorised activity as fraud they will usually still take your side.
--edit-- I'm not trying to say EMV is bulletproof, nothing is bulletproof, but the primary method anyone's going to use to get your PIN is still social engineering, or possibly some sort of compromised terminal hardware, which they'd have to make from scratch because accredited devices disable themselves if they detect they've been tampered with.
Not all of the research that has been done has been published, I've seen some very impressive demos!
In any case the published research absolutely does give you practical attacks e.g. http://www.cl.cam.ac.uk/research/security/banking/nopin/
or http://www.cl.cam.ac.uk/research/security/banking/intercepto...
I've had a read of the first paper there, the nopin one, and it reads like a really preventable flaw in the IAD, which (as it's issuer specific) could be very easily fixed without the involvement of terminal vendors. I agree with the conclusion that the TVR is a flawed concept though, I had always assumed (never having worked directly for an issuer) that there would be enough data in the IAD to marry up the terminal and card perspectives on what had happened.
And on the second one I'd be the first to agree that SDA and offline-plaintext PIN are a bad idea, I could have told you that when I did my first implementation in 2001!
--edit-- I had actually assumed that by now the cost differential between SDA/plaintext and DDA(or CDA)/encrypted cards would be so small that nobody would use the SDA cards any more. Guess I was wrong!
If the expected loss of funds for the user is lower, it is more secure - for the user.
With EMV the risk of an incident is much lower.
The risk of not being able to recover the money may be higher.
You're more secure.
--edit-- I say may be higher because AFAICT there are no good figures on this.
I signed it in front of them (which matched my passport signature BTW) but was politely declined as they'd seen the card unsigned.
Another example of security policy getting in the way of actual security.
You can't lock accounts only protected by a password and accessible by anyone (via internet) this way as this would invite for Denial-of-Service attacks (locking your account with three failed attempts).
It's quite annoying as none of the sites warned me about the impending account block after the first or second try. I guess it's an inconvenience that is worth it for the extra anti-brute-force security. Being locked out due to someone personally locking you out as you mentioned might also be annoying, but I honestly rather be locked out of my account and therefore alerted that someone is trying to gain access to my data than not.
Why these same sites limit my password to a specific number of characters and disallow special characters is beyond me though.
The Linux way sounds better, but the OpenBSD way is better. If you want people to use passwords, don't do petty nagging of them when they make a mistake.
On Linux when I mistype a password, I control-Z the "su" session and launch a new one instead of sitting around like a scolded schoolboy waiting for the binary to give me another chance.
Depends on how many people use a password in the top 100 most common vs. how many use one in the top 3. I would think it would be a sizeable difference.
GoDaddy does this. It's the main reason I left them (before all the more recent shenanigans)
Unfortunately it doesn't prevent them using them online as well. At least for my cards, if I lock out the PIN I can still use them for non-PIN purchases.
Also CVV needs the 16 digit card number, card holder name and expiry as well..
I'd almost guarantee that trying to brute-force a CVV number will get your card blocked real fast.
Is this not the case?
Also, there is a practical requirement to have it short; as physical merchants value quick processing, and having to type&re-type long passwords delays other people behind you - so they want long PINs to be unpopular.
Your card is not a service to be secured, it's part of multiple layers of security (that don't end with the code or the card).
If they didn't then password breaches would barely matter.