Comment by Sanddancer | Hacker News Reader

Comment by Sanddancer | Hacker News Reader

The lack of security surrounding Chip and PIN doesn't surprise me. A friend of mine is dyslexic, and one of the symptoms is that she has a real hard time remembering arbitrary sequences of numbers, like PINs tend to be. As such, she's one of the few people on chip and sign, and has no PIN attached to her card. Even with that, she /still/ has to deal with fraud departments every few years saying that someone used her card and "PIN" in some obscure location, and this is obviously all her fault. It takes quite a bit of frustration for her before the fraud department finally comprehends that there is no pin to clone there.

Of course, me being stateside, I still have to deal with antiquated magstrips and /their/ various faults. I've got cards with chips in them, but no one is taking them yet, and the bank I'm with (Wells Fargo) isn't even planning on rolling out chips on their debit card line until the end of the year, and even then, by request only. The whole financial security system is just ridiculous.

On the other hand, with Chip & PIN, if someone uses the Chip and PIN they will claim that they don't have to protect you from fraud.

I recall reading a few years ago about auto insurance companies denying claims on stolen cars because it was "impossible" for the car to be stolen due to the new key tech at the time. They were ignoring that the dealerships help the master keys, and car thieves would just attack that as the weak point (i.e. get an insider to cut the keys, and give you the address for the owner). The real reason that the insurers were denying claims is that they want to just push all of the risk onto the consumer, while still taking their money to 'insure' them.

That's not been true since 2009.

http://en.wikipedia.org/wiki/Chip_and_PIN#Banks.27_liability

> A friend of mine is dyslexic, and one of the symptoms is that she has a real hard time remembering arbitrary sequences of numbers, like PINs tend to be.

Are the PINs assigned by the card issuer and unchangeable, or can the user change the PIN?

If the user can change them, couldn't she change the PIN to something that isn't arbitrary to her?

The PINs are typically changeable.

For her, it's remembering and being able to put in any number sequence, so in this case, she really can't.

WF is issuing EMV-enabled debit cards as of yesterday. Just call and ask for one.

I was just in a wells fargo branch yesterday and asked about it and was told they were planning on rolling them out later this year. Probably one of those left hand not knowing what the right hand is doing situations.

AFAIK, no US bank is actually offering true "chip-and-pin" cards. USAA used to, but they re-ordered the CVMs on cards issued since last June. Now their cards prefer signatures over PINs, just like most other American EMV cards.

It seems like many places in the US that accept chipped cards don't even ask for a signature. I put in the card, it asks to verify the amount, and then processes it. I've had some large (>$100) transactions get approved with just a card, no PIN or signature.

I can't recall a single time I've had to enter a PIN or sign for an EMV transaction.

Isn't Barclaycard issuing Chip-and-PIN cards, albeit signature priority, that work in PIN-only situations?

Yes, they are.

Out of interest, how does Chip and Sign work at an ATM?

For now, banks are only doing chip+sig on credit cards. I imagine chip+pin on debit cards for ATMs is a 2016 issue.

I don't know for sure, but debit cards already follow the chip&pin model, except it's magstripe&pin. So I would imagine it would read the chip, and you would enter your ATM pin.

Reply on news.ycombinator.com