NatWest card reader

[Chris]

Just received magazine from NatWest which mentions they're bringing out card
readers for extra security on home banking (www.natwest.com/reader). The
site has 'Getting Started' etc., but nowhere (that I have found) does it
actually menetion connecting to your PC! I assume it's a USB device; the
question is, is there a chance it wouldn't work with Linux?

[Dejanews Fan]

Post by Chris
Just received magazine from NatWest which mentions they're bringing out card
readers for extra security on home banking (www.natwest.com/reader). The
site has 'Getting Started' etc., but nowhere (that I have found) does it
actually menetion connecting to your PC! I assume it's a USB device; the
question is, is there a chance it wouldn't work with Linux?

Hi Chris,

You sure this isn't a standalone device?

[Andy Burns]

Post by Dejanews Fan

Post by Chris
Just received magazine from NatWest which mentions they're bringing out card
readers for extra security on home banking (www.natwest.com/reader).

You sure this isn't a standalone device?

A friend has one already, it *is* completely standalone, like a small
calculator with a slot for your card to let it read the chip.

[Chris]

Post by Andy Burns

Post by Dejanews Fan

Post by Chris
Just received magazine from NatWest which mentions they're bringing out card
readers for extra security on home banking (www.natwest.com/reader).

You sure this isn't a standalone device?

A friend has one already, it *is* completely standalone, like a small
calculator with a slot for your card to let it read the chip.

Thanks to all. I did a search at work and found a couple of articles
(Computer Weekly, etc.) on the banks' plans for bringing these in. Yes,
they are stand-alone. According to CW, German banks have had a similar
paper-based system for many years, but I've never seen any site ask for
this sort of data (it's difficult enough finding any German site that
accepts cards at all!) Presumably it's only if you have a relevant bank's
card that it would ask for the digits - but how does it know if you have
such a device?

Talking to a colleague, according to him the banks have their own
implementations of the devices.

[Paul Cager]

Post by Chris

Post by Andy Burns

Post by Dejanews Fan

Post by Chris
Just received magazine from NatWest which mentions they're bringing out card
readers for extra security on home banking (www.natwest.com/reader).

You sure this isn't a standalone device?

A friend has one already, it *is* completely standalone, like a small
calculator with a slot for your card to let it read the chip.

[...]

Post by Chris
Talking to a colleague, according to him the banks have their own
implementations of the devices.

By the way, the devices are interchangeable - you could use a Nat West
one for Barclays and vice-versa.

[Dave Liquorice]

Post by Dejanews Fan

Post by Chris
Just received magazine from NatWest which mentions they're bringing out
card readers for extra security on home banking

You sure this isn't a standalone device?

It is. A small handheld device that reads your chip 'n pin card producing
an eight digit number you feed to the online banking website.

http://www.newsroom.barclays.co.uk/content/Detail.asp?ReleaseID=1013&NewsA
reaID=2

http://blog.jazzle.co.uk/why-i-might-leave-my-bank-the-natwest-card-reader

[Gordon]

Post by Dave Liquorice

Post by Dejanews Fan

Post by Chris
Just received magazine from NatWest which mentions they're bringing out
card readers for extra security on home banking

You sure this isn't a standalone device?

It is. A small handheld device that reads your chip 'n pin card producing
an eight digit number you feed to the online banking website.
http://www.newsroom.barclays.co.uk/content/Detail.asp?ReleaseID=1013&NewsA
reaID=2
http://blog.jazzle.co.uk/why-i-might-leave-my-bank-the-natwest-card-reader

If this reader has no connection to Natwest, how does the website know that
the (presumably random) number that its generated is correct?

[Tim Southerwood]

Post by Gordon

Post by Dave Liquorice

Post by Dejanews Fan

Post by Chris
Just received magazine from NatWest which mentions they're bringing out
card readers for extra security on home banking

You sure this isn't a standalone device?

It is. A small handheld device that reads your chip 'n pin card producing
an eight digit number you feed to the online banking website.

http://www.newsroom.barclays.co.uk/content/Detail.asp?ReleaseID=1013&NewsA

Post by Gordon

Post by Dave Liquorice
reaID=2

http://blog.jazzle.co.uk/why-i-might-leave-my-bank-the-natwest-card-reader

Post by Gordon
If this reader has no connection to Natwest, how does the website know
that the (presumably random) number that its generated is correct?

Hi,

Same way that your car knows that the random number that your radio keyfob
is sending is valid. Pseudo random sequence is one technique, where both
ends have the same algorithm - this stops replay attacks. There are
probably other ways too.

Cheers

Tim

[Nix]

Post by Tim Southerwood

Post by Gordon
If this reader has no connection to Natwest, how does the website know
that the (presumably random) number that its generated is correct?

[...]

Post by Tim Southerwood
Same way that your car knows that the random number that your radio keyfob
is sending is valid. Pseudo random sequence is one technique, where both
ends have the same algorithm - this stops replay attacks. There are
probably other ways too.

I presume this is a similar scheme to RSA SecureID (or even SecureID
itself: SecureID tokens are bloody expensive in small numbers but a bank
will be buying them in bulk), in which case there is a cryptographically
strong transform from the time of day (generally rounded to the minute)
and a secret key which varies per device; the host computer has access
to the same key and of course it knows the time, so it can tell what
number your device will display at a given moment.

One neat trick is that the host checks the value you enter against a
couple of possibilities on either side of the correct number temporally,
and if what you entered matches one of those it notes that your clock is
probably off and by how much and uses this time delta in future. So the
clocks don't need to be perfectly synchronized; as long as you sign in
at least every few months it should still work.

(OPIE is a similar scheme which uses the generated number as an index
into a lexicon like /usr/dict/words so you can type in English instead
of numbers.)

[Alex Butcher]

Post by Nix

Post by Tim Southerwood

Post by Gordon
If this reader has no connection to Natwest, how does the website know
that the (presumably random) number that its generated is correct?

[...]

Post by Tim Southerwood
Same way that your car knows that the random number that your radio
keyfob is sending is valid. Pseudo random sequence is one technique,
where both ends have the same algorithm - this stops replay attacks.
There are probably other ways too.

I presume this is a similar scheme to RSA SecureID (or even SecureID
itself: SecureID tokens are bloody expensive in small numbers but a bank
will be buying them in bulk), in which case there is a cryptographically
strong transform from the time of day (generally rounded to the minute)
and a secret key which varies per device;

I doubt very much that the time of day is included in the hash; that would
require that either a) the chip on the card was powered or b) that the
reader was powered (and stayed powered, even across a number of years,
and in transit to the customer) and the bank kept track of the ID of each
unit. The latter is made unlikely by the comment from Paul Cage later in
this thread that says that the Barclays and NatWest readers are
interchangeable. This suggests that the readers are just interfaces to
crypto functionality embedded on the card's chip. My guess is that it's a
challenge-response system that uses a key embedded on the card's chip
(which is necessary for chip-and-PIN authentication anyway).

Post by Nix
One neat trick is that the host checks the value you enter against a
couple of possibilities on either side of the correct number temporally,
and if what you entered matches one of those it notes that your clock is
probably off and by how much and uses this time delta in future. So the
clocks don't need to be perfectly synchronized; as long as you sign in at
least every few months it should still work.

That's the theory, but in practice, the variability of clocks can
sometimes cause operational difficulties.

Best Regards,
Alex.

[Tony Houghton]

Post by Alex Butcher

Post by Nix
I presume this is a similar scheme to RSA SecureID (or even SecureID
itself: SecureID tokens are bloody expensive in small numbers but a bank
will be buying them in bulk), in which case there is a cryptographically
strong transform from the time of day (generally rounded to the minute)
and a secret key which varies per device;

I doubt very much that the time of day is included in the hash; that would
require that either a) the chip on the card was powered or b) that the
reader was powered (and stayed powered, even across a number of years,
and in transit to the customer) and the bank kept track of the ID of each
unit. The latter is made unlikely by the comment from Paul Cage later in
this thread that says that the Barclays and NatWest readers are
interchangeable. This suggests that the readers are just interfaces to
crypto functionality embedded on the card's chip. My guess is that it's a
challenge-response system that uses a key embedded on the card's chip
(which is necessary for chip-and-PIN authentication anyway).

And let's not forget the banks aren't so interested in preventing fraud
as in shifting the blame to the customer. I wonder if that's why some of
them insist on Windows: "It wasn't our fault; the customer must have
been infected with a key logger."

[Ian Rawlings]

Post by Tony Houghton
And let's not forget the banks aren't so interested in preventing fraud
as in shifting the blame to the customer.

So far all their effort has been concentrated on hiding the amount of
fraud as it affects consumer confidence in the bank, so they'd rather
lose some cash than take the negative publicity. Trying to dump it
all on the customer doesn't seem like something they'd find
productive. Currently they hope you do OK but compensate you unless
you monumentally fuck up, e.g. leaving bags of cash lying around, even
leaving your credit card somewhere is covered by them.

[Tony Houghton]

Post by Ian Rawlings

Post by Tony Houghton
And let's not forget the banks aren't so interested in preventing fraud
as in shifting the blame to the customer.

So far all their effort has been concentrated on hiding the amount of
fraud as it affects consumer confidence in the bank, so they'd rather
lose some cash than take the negative publicity. Trying to dump it
all on the customer doesn't seem like something they'd find
productive. Currently they hope you do OK but compensate you unless
you monumentally fuck up, e.g. leaving bags of cash lying around, even
leaving your credit card somewhere is covered by them.

I read somewhere that shifting the blame was the real motivation behind
chip & pin.

[Ian Rawlings]

Post by Tony Houghton
I read somewhere that shifting the blame was the real motivation behind
chip & pin.

I read somewhere that elvis is alive and well and living on mars, and
that the 9/11 world trade centre was brought about by a cabal of
powerful jews, and that microsoft really created linux and apple to
avoid monopoly competition rules, etc etc

Chip and pin was to cut down on fraud because signature checks were so
laughable, the banks can't afford for people to go back to stuffing
money under mattresses. Those who just don't trust banks etc will
always view everything they do through cynical eyes however, but this
doesn't make them right. The banks' past behaviour doesn't fit in
with the idea of them trying to pass the blame onto the consumer, it's
just not good for their business.

The credit card companies are trying to pass the blame onto the vendor
however, or rather to extract cash from them to enrol them in useless
security schemes which are pretty much compulsory.

[Tony van der Hoff]

On 11 Jul at 14:29 Tony Houghton <***@realh.co.uk> wrote in message
<***@realh.co.uk>

[snip]

Post by Tony Houghton
I read somewhere that shifting the blame was the real motivation behind
chip & pin.

Whilst I no longer work in the security industry, I think that is an
excessively cynical interpretation of the situation.

Ithe motivation behind chip and pin was to increase security, as signatures
were too easy to forge, and too hard to verify.

At the same time, in order to make the scheme work, the responsibility for
ensuring the safety of the PIN was placed upon the customer, and the
responsibility for ensuring the safety of the equipment was placed upon the
retailer. Provided the customer and retailer fulfil their not very onerous
obligations, the issuer still takes responsibility for any fraud. This, to
me at least, does not seem unreasonable.

Previously, the issuers took all responsibility for any fraud, whether or
not the customer/retailer were grossly negligent.

I know we all like to complain about the banking industry (they're in the
same category as the government, estate agents, the health service, and the
weather), but in this instance it seems somewhat unwarranted.

On the previous topic, I have had, for over a year, a (largeish) keyring
device from LloydsTSB with a 6-digit LCD, which displays a pseudo-random
number when I turn it on. I have to enter this number, as well as my userid
and password to access my online banking accounts.

It doesn't read the card, and, of course, has to be carried around. However,
it sounds like it's a lot more portable than the Natwest/Barclays solution.
I hope LTSB don't follow their lead...

[Ian Rawlings]

Post by Tony van der Hoff
On the previous topic, I have had, for over a year, a (largeish) keyring
device from LloydsTSB with a 6-digit LCD, which displays a pseudo-random
number when I turn it on. I have to enter this number, as well as my userid
and password to access my online banking accounts.

That's odd, I've not seen those and have been banking with Lloyds
since was 17, and have been using online banking pretty much since it
was set up. I wonder why they've not pushed one of those onto me.
Perhaps I don't earn enough to be a juicy target ;-)

[Tony van der Hoff]

Post by Tony van der Hoff
On the previous topic, I have had, for over a year, a (largeish) keyring
device from LloydsTSB with a 6-digit LCD, which displays a pseudo-random
number when I turn it on. I have to enter this number, as well as my
userid and password to access my online banking accounts.

That's odd, I've not seen those and have been banking with Lloyds since
was 17, and have been using online banking pretty much since it was set
up. I wonder why they've not pushed one of those onto me. Perhaps I don't
earn enough to be a juicy target ;-)

http://www.lloydstsb.com/banksecurehelp/banksecurehelp.asp

They billed it as a limited trial; I got one, my wife didn't, and she still
has to use her "memorable phrase" (which is so obvious to anyone who knows
her closely that it's a waste of time :( ).

Interesting, though, I would have thought they would have completed the
trial by now!

[Ian Rawlings]

Post by Tony van der Hoff
Interesting, though, I would have thought they would have completed the
trial by now!

Well, I've got three similar devices on my desk, it's getting a bit much!

[Dave Liquorice]

Post by Ian Rawlings

Post by Tony van der Hoff
On the previous topic, I have had, for over a year, a (largeish)
keyring device from LloydsTSB with a 6-digit LCD,

That's odd, I've not seen those and have been banking with Lloyds
since was 17, and have been using online banking pretty much since it
was set up. I wonder why they've not pushed one of those onto me.

New customers only or opt in? I recently opened a new business account
with HSBC and was given the option of this 6 digit keyfob device.

What I want to know is can I use this "HSBC" keyfob with another bank
should they decide to use them or do I *have* to use their supplied fob? I
don't mind carrying *a* fob but I don't want to carry any more plus a
couple of card reading things...

[alexd]

Post by Dave Liquorice
What I want to know is can I use this "HSBC" keyfob with another bank
should they decide to use them or do I *have* to use their supplied fob? I
don't mind carrying *a* fob but I don't want to carry any more plus a
couple of card reading things...

Presumably the banks could share the serial of your fob; it's not in their
interest to keep paying RSA the not inconsiderable sum for fobs when they
don't have to. So, in answer to your question, yes you have to use their
supplied fob :-)

http://www.misco.co.uk/applications/SearchTools/item-details.asp?EdpNo=214756

[Ian Rawlings]

Post by Dave Liquorice
What I want to know is can I use this "HSBC" keyfob with another bank
should they decide to use them or do I *have* to use their supplied fob?

You'll have to have one for each service, otherwise the organisations
would have to share the key files for each fob, and that would allow
them to fake up a fob that produces the same number sequence as your
fob and so compromise all your accounts. Not a good idea.

[Dave Liquorice]

Post by Ian Rawlings
You'll have to have one for each service,

Sod that for a game of soldiers, I won't opt in if that is the case. Or be
accidentally getting them crushed under the wheels of my chair when the
tottering heap falls of the desk when I'm looking for the one I need...

[Andy Cap]

Post by Dave Liquorice

Post by Ian Rawlings
You'll have to have one for each service,

Sod that for a game of soldiers, I won't opt in if that is the case. Or be
accidentally getting them crushed under the wheels of my chair when the
tottering heap falls of the desk when I'm looking for the one I need...

I'm not sure about the 'opting in' bit. I'm being sent a Natwest one within
days, ouit of the blue. The only solution then, is to consolidate your banking
activities.

Andy

[Martin Gregorie]

Post by Andy Cap

Post by Dave Liquorice

Post by Ian Rawlings
You'll have to have one for each service,

Sod that for a game of soldiers, I won't opt in if that is the case. Or be
accidentally getting them crushed under the wheels of my chair when the
tottering heap falls of the desk when I'm looking for the one I need...

I'm not sure about the 'opting in' bit. I'm being sent a Natwest one within
days, ouit of the blue. The only solution then, is to consolidate your banking
activities.

Mine arrived today. It seems quite well put together and read my card
without a problem. There's probably no memory in it - at least nothing
battery backed - because the instruction sheet doesn't mention any
precautions (speed & so on) to take when you change the batteries.

Either additional functions will be implemented in future or, more
likely, its a generic smart-card reader/interface unit because it has 4
or 5 function keys on it that are not mentioned in the Natwest
instruction sheet.

Its made in China by Xiring, model XI6PA0040. Does this help anybody
tell us more about it?

[Alex Butcher]

Its made in China by Xiring, model XI6PA0040. Does this help anybody tell
us more about it?

I suspect something from their Xi-Sign range:
<http://www.xiring.com/en-GB/pageLibre00012b91.php>

Best Regards,
Alex.

[Joxroach]

If you really want to know how to deter card fraud and Identity theft.
Remove any liability issues from the cardholder AND the retailer (for
face to face or Online transactions) and scare the life out of
fraudsters then have a read of the following, from Marint Lewis's
Money Saving Expert Forum.

http://forums.moneysavingexpert.com/showthread.html?t=484305

And if you use the above system to protect yourself, you may also ask,
why would I need an ID card?

[David Aldred]

Post by Joxroach
If you really want to know how to deter card fraud and Identity theft.
Remove any liability issues from the cardholder AND the retailer (for
face to face or Online transactions) and scare the life out of
fraudsters then have a read of the following, from Marint Lewis's
Money Saving Expert Forum.
http://forums.moneysavingexpert.com/showthread.html?t=484305

I really don't see how that suggestion helps.

A key vulnerability of signature based cards is that the average cashier in
a supermarket, looking at a dodgy signature and faced with a potentially
aggressive customer, a long queue and a harassed supervisor, is likely to
accept the signature and thus the transaction. Chip & PIN removes the
personal decision from the equation.

Is it really likely that the said cashier will have the time and the
confidence to make a forensic-style examination of two thumbprints?

[Ian]

Post by David Aldred
Is it really likely that the said cashier will have the time and the
confidence to make a forensic-style examination of two thumbprints?

Any vaguely intelligent crook - and I realise that that rules out
quite a few - will have the sense to squidge his/her thumb round
slightly as they make the print, thereby smearing the print. Will your
harassed cashier have time and confidence to ask for a second
thumbprint? I doubt it.

Ian

[Martin Gregorie]

Post by Alex Butcher

Its made in China by Xiring, model XI6PA0040. Does this help anybody tell
us more about it?

<http://www.xiring.com/en-GB/pageLibre00012b91.php>

Possibly, but unfortunately it doesn't look like anything on that page
or anywhere else in the Xiring product list for that matter.

[Dave Liquorice]

Post by Andy Cap
I'm not sure about the 'opting in' bit. I'm being sent a Natwest one
within days, ouit of the blue.

I don't mind having one card reader and one fob, but that is all I want. I
don't want one for every different online "banking" service I use. I see
paypal/ebay is going the fob route...

Post by Andy Cap
The only solution then, is to consolidate your banking activities.

I've just been through that I now only have two current accounts, one
personal one business each with a different bank, rather than the 4 or 5 I
had previously. I guess any individual banks argument is that they offer a
"full range of services" so you only need to bank with them. Yeah, right,
eggs basket... Any number of reasons from the unlikely event of the bank
going tits up, to the far more likely their online banking service falling
over just when I must shift some money

[Andy Cap]

Post by Dave Liquorice
I've just been through that I now only have two current accounts, one
personal one business each with a different bank, rather than the 4 or 5 I
had previously. I guess any individual banks argument is that they offer a
"full range of services" so you only need to bank with them. Yeah, right,
eggs basket...

I absolutely agree with that view and refuse to get sent up that cul-de-sac.

'Keep on the move' that's my motto, but it does apparently now mean a desktop
covered with various keypads, like it ot not.

Andy

[Chris]

Post by Andy Cap

Post by Dave Liquorice

Post by Ian Rawlings
You'll have to have one for each service,

Sod that for a game of soldiers, I won't opt in if that is the case. Or be
accidentally getting them crushed under the wheels of my chair when the
tottering heap falls of the desk when I'm looking for the one I need...

I'm not sure about the 'opting in' bit. I'm being sent a Natwest one within
days, ouit of the blue. The only solution then, is to consolidate your banking
activities.

Another annoying aspect to this is that you have to take the reader with
you wherever you want to do some online banking (e.g. at work, when
abroad). This certainly seems like a real pain in the arse, esp. if you
forget the bloody thing at home!

So much for the convenience of online banking :-S

[Dave Liquorice]

Post by Chris
Another annoying aspect to this is that you have to take the reader with
you wherever you want to do some online banking (e.g. at work, when
abroad). This certainly seems like a real pain in the arse, esp. if you
forget the bloody thing at home!

Exactly, which is why I want to have just one fob thingy and one reader
thingy and I'm not happy about the size of the reader thingy.

I wonder how robust the fob thingy is? Will it take being on a bunch of
keys, some quite large and chunky, dropped, soaked, covered in mud etc...

[Joxroach]

This video on You Tube proves your point:

[Daniel James]

Post by Tony Houghton
I read somewhere that shifting the blame was the real motivation behind
chip & pin.

I don't think that's ever been the motivation, but it is to some extent a
side-effect.

The point of chip and PIN is that it removed the onus of checking the
signature on the payment slip from the shop staff. The shop doesn't really
care whether a transaction is fraudulent or not, they just want to shift
goods and receive payment; they have no incentive to perform the signature
check with any diligence. Some banks issued cards with the cardholders'
photos on them, for a while, but it became clear that shops didn't check
those either. A large part of what Chip and PIN does is to automate that
check by replacing the written signature with a PIN-entry that is
automatically verified by the Point-of-sale terminal (the other part
involves making the cards very significantly more difficult to falsify or
clone).

However, while C&P makes it harder to use someone else's card without
knowing the PIN, it does mean that if you have a stolen card and do know
the PIN there is almost no chance that anyone will challenge you when you
use it (even if, say, the fraud is obviously male and the name on the card
starts "Miss"). That means that the banks need to ensure that all
cardholders take good care that their PINs are not revealed, and that they
need to reserve the right to refuse to reimburse customers who are the
victims of fraud if they have any reason to believe that the fraud was made
possibly by negligence of complicity on the part of the customer.

It's not really a shift of the blame. There's been a shift of risk, and a
shift in the mechanisms for possible attacks, and the blame naturally lies
in a different place.

[Martin Gregorie]

Post by Daniel James

Post by Tony Houghton
I read somewhere that shifting the blame was the real motivation behind
chip & pin.

I don't think that's ever been the motivation, but it is to some extent a
side-effect.

I just had a thought while reading this post (snipped the rest).

Does anybody know if there's anything in the card reader that's locked
to the bank account, or can I use any Natwest card reader with my card
and generate a valid authorization code?

If the card reader is not account-specific then the activation process
boils down to a simple check can read your card and that it works
correctly. Even if this is the way it works there's a degree of improved
security because you are in effect supplying an 8 digit PIN rather than
a 4 digit one and also avoiding playback attacks.

I've always thought the 4 digit PIN is too short for comfort.

[Alex Butcher]

Post by Martin Gregorie

Post by Daniel James

Post by Tony Houghton
I read somewhere that shifting the blame was the real motivation behind
chip & pin.

I don't think that's ever been the motivation, but it is to some extent
a side-effect.

I just had a thought while reading this post (snipped the rest).
Does anybody know if there's anything in the card reader that's locked to
the bank account, or can I use any Natwest card reader with my card and
generate a valid authorization code?
If the card reader is not account-specific then the activation process
boils down to a simple check can read your card and that it works
correctly.

From reading Xiring's blurb it appears it works something like this:

- bank website produces a challenge (this could be an encrypted version of
some or all aspects of the transaction, such as the amount)

- you enter this challenge on the reader (if this was an encrypted version
of the transaction, it uses a key on the card's chip to decrypt and show
you the details of what you're signing)

- the chip on your card encrypts the challenge to produce a response. The
bank/card issuer knows the key on your card's chip, so knows what the
correct response should be.

- you enter the response in your browser and submit it, upon which it is
validated and the transaction is accepted or denied appropriately.

Best Regards,
Alex.

[Daniel James]

Post by Martin Gregorie
Does anybody know if there's anything in the card reader that's locked
to the bank account, or can I use any Natwest card reader with my card
and generate a valid authorization code?

I've seen it stated (I forget where) that the reader is a generic device.
You will certainly be able to use the same reader with different cards from
the same bank, and probably with cards from other banks.

Post by Martin Gregorie
If the card reader is not account-specific then the activation process
boils down to a simple check can read your card and that it works
correctly.

No, absolutely not. The reader is just an interface, the number that is
generated for you to use to authorize a payment (etc) comes *from* the
card, and will be generated by some secure cryptographic process inside the
card.

Post by Martin Gregorie
Even if this is the way it works there's a degree of improved
security because you are in effect supplying an 8 digit PIN rather than
a 4 digit one and also avoiding playback attacks.

You would never be asked to provide your PIN itself online -- there's far
too much chance of a keylogger or other malware snooping the value. The PIN
will be verified by the card but will not itself play any part in the
calculation of the dynamic password value. The fact that the cardreader
device is not connected to the PC in any way ensured that the reader can't
be infected, coerced or suborned in any way, so your PIN stays safe.

Note, too, that one could use the same reader with telephone banking: the
banking system could (digitally) 'speak' a number which you would enter
into the reader to generate a response, and the response could be entered
on the keypad of a tone-dialing phone and verified automatically by the
system (I don't know whether the banks propose to do this, but the idea
will not have escaped them).

Post by Martin Gregorie
I've always thought the 4 digit PIN is too short for comfort.

Unfortunately there are a very large number of ATMs and POS terminals
around the world that can't cope with anything longer (at least: not
without a ROM upgrade, which would be difficult to perform on a secure
tamper-resistent box).

Cheers,
Daniel.

[Martin Gregorie]

Post by Daniel James

Post by Martin Gregorie
Does anybody know if there's anything in the card reader that's locked
to the bank account, or can I use any Natwest card reader with my card
and generate a valid authorization code?

I've seen it stated (I forget where) that the reader is a generic device.
You will certainly be able to use the same reader with different cards from
the same bank, and probably with cards from other banks.

I thought so but haven't seen it said.

Post by Daniel James

Post by Martin Gregorie
If the card reader is not account-specific then the activation process
boils down to a simple check can read your card and that it works
correctly.

No, absolutely not. The reader is just an interface, the number that is
generated for you to use to authorize a payment (etc) comes *from* the
card, and will be generated by some secure cryptographic process inside the
card.

That's what I was getting at - the 'test challenge' used in the
activation process will not be correct if the reader isn't working
correctly, connecting correctly to the card, or the card is faulty.

Post by Daniel James
You would never be asked to provide your PIN itself online -- there's far
too much chance of a keylogger or other malware snooping the value.

Of course - but I HAVE been asked for the 3 digit reference code off the
back of the card, which only means that the purchaser has the card, not
that he's entitled to have it.

Post by Daniel James
Note, too, that one could use the same reader with telephone banking: the
banking system could (digitally) 'speak' a number which you would enter
into the reader to generate a response, and the response could be entered
on the keypad of a tone-dialing phone and verified automatically by the
system (I don't know whether the banks propose to do this, but the idea
will not have escaped them).

Yes, I'd spotted that. It will be nice if the same reader works with
Mastercard, but I'm not holding my breath.

Post by Daniel James

Post by Martin Gregorie
I've always thought the 4 digit PIN is too short for comfort.

Unfortunately there are a very large number of ATMs and POS terminals
around the world that can't cope with anything longer (at least: not
without a ROM upgrade, which would be difficult to perform on a secure
tamper-resistent box).

Sure, but why use such a short PIN in the first place? Six or eight
digits would be better or there really people who can remember their
phone number but not another, similarly sized, PIN?

[Folderol]

On Sun, 15 Jul 2007 21:53:14 +0100

Post by Martin Gregorie
Sure, but why use such a short PIN in the first place? Six or eight
digits would be better or there really people who can remember their
phone number but not another, similarly sized, PIN?

You would be surprised at the number of people who can't even remember
their age (a figure that rarely exceeds 2 digits) let alone a phone
number.

The situation appears to be getting worse, according to an article I
read recently. This postulates that with the reliance on electronic
aids kids are not learning how to remember effectively.

[Andy Cap]

Post by Folderol
On Sun, 15 Jul 2007 21:53:14 +0100

Post by Martin Gregorie
Sure, but why use such a short PIN in the first place? Six or eight
digits would be better or there really people who can remember their
phone number but not another, similarly sized, PIN?

You would be surprised at the number of people who can't even remember
their age (a figure that rarely exceeds 2 digits) let alone a phone
number.
The situation appears to be getting worse, according to an article I
read recently. This postulates that with the reliance on electronic
aids kids are not learning how to remember effectively.

Though to be fair I bet the average person now has to remember far more such
details than any previous generation. I have 137 passwords in my copy of
Password Corral and automatically remember quite a few of them. Still I
occasionally get in the garage and think " Which card is this " and have very
occasionally punched in the wrong pin.

Life is far more complex in this respect than ever before and now there's yet
another device about to arrive on the door mat....

Andy

[Graham Murray]

Post by Folderol
The situation appears to be getting worse, according to an article I
read recently. This postulates that with the reliance on electronic
aids kids are not learning how to remember effectively.

The other problem is that there are too many PINs, passwords,
passphrases, and memorable words which you have to remember.

[Daniel James]

... the 'test challenge' used in the activation process will not be
correct if the reader isn't working correctly, connecting correctly
to the card, or the card is faulty.

Of course. ... or if you inadvertently insert the wrong card ...

Post by Daniel James
You would never be asked to provide your PIN itself online -- there's
far too much chance of a keylogger or other malware snooping the value.

Of course - but I HAVE been asked for the 3 digit reference code off the
back of the card, which only means that the purchaser has the card, not
that he's entitled to have it.

That's used to provide an extra element of security, but it doesn't prove
much. Only that the person using the card has at some time seen the card,
or has seen a record of a transaction in which those extra digits were
recorded. A keylogger would get them for sure.

It will be nice if the same reader works with Mastercard, but I'm not
holding my breath.

I'd be prepared to bet that the reader is making use of some standard
functionality of Chip & PIN cards, and if so it would certainly "work with"
a Mastercard card ... whether Mastercard have any infrastructure in place
to make use of it is another matter.

Sure, but why use such a short PIN in the first place? Six or eight
digits would be better or there really people who can remember their
phone number but not another, similarly sized, PIN?

http://news.bbc.co.uk/1/hi/business/6230194.stm (apparently).

Chip & PIN *cards* that I've seen can handle a "secret code" of up to 8
binary bytes -- 16 packed BCD digits -- but many of the protocols used by
banks for handling PIN data work with just 4 digits. It would be possible
for a Chip & PIN card to have two PINs, one of 4 digits used in
conventional transactions using the magstripe and a longer one used when
working with the on-card chip. I expect the banks think that most people
would find having two different PINs for one card terminally confusing.

Cheers,
Daniel.

[Martin Gregorie]

Post by Daniel James

Post by Martin Gregorie
Sure, but why use such a short PIN in the first place? Six or eight
digits would be better or there really people who can remember their
phone number but not another, similarly sized, PIN?

http://news.bbc.co.uk/1/hi/business/6230194.stm (apparently).

Interesting, and it sounds like as good a reason as any for using such a
short PIN.

[Joxroach]

Post by Tony Houghton
I read somewhere that shifting the blame was the real motivation behind
chip & pin.

I don't think this was the motive either, but it certainly is a
reality.

The fatal flaw with Chip & PIN, is the PIN. A PIN used with a genuine
stolen Credit OR Debit Card can be used at any CHIP & PIN retailers or
a much more crook friendly ATM without the perpetrator ever being
challenged.A PIN used with a cloned card, then this can be used at
ATMs worldwide and at many ATM's in the UK. The attraction to he crook
is that they are never challenged at ATMs and retail staff don't give
a hoot how uses a Chjip & PIN card. As long as the correct PIN is
entered, the retailer is guaranteed their dosh.

There is an alternative way to elimate the liability issue for so
called PIN negligence.

Read the article in Martin Lewis's Money Saving Expert Forum:

http://forums.moneysavingexpert.com/showthread.html?t=484305

[Daniel James]

Post by Joxroach
The fatal flaw with Chip & PIN, is the PIN.

I tend to agree.

The biggest problem is that the customer is responsible for keeping his own
PIN secret, but has no say in the sorts of precautions that are available
for safeguarding that secret. Point-of-sale terminals with hard-to-conceal
keypads in plain view (sometimes right under security cameras) don't help
at all!

It would be nice if the card issuers could require the retailers to provide
a more easily securable environment for PIN-entry.

Post by Joxroach
A PIN used with a genuine stolen Credit OR Debit Card can be used at
any CHIP & PIN retailers or a much more crook friendly ATM without the
perpetrator ever being challenged.

Yes (I made that point) ... but ONLY if the perpetrator knows the PIN.

Post by Joxroach
A PIN used with a cloned card, then this can be used at
ATMs worldwide and at many ATM's in the UK.

To all practical intents and purposes the chip in a card cannot be cloned,
so Chip & PIN is actually quite secure against this sort of attack. The
problem lies in the fact that most ATMs read the magstripe and not the
chip, and magstripes are easy to copy. Unfortunately, there are still huge
numbers of ATMs (in particular) and POS terminals that can't read the chip,
so we're stuck with the copyable, insecure, magstripe for a long time to
come.

However, this is not a shortcoming of C&P, ATMs had been reading magstripe
cards, accepting PINs, and handing out cash for a long time before C&P came
in.

Post by Joxroach
There is an alternative way to elimate the liability issue for so
called PIN negligence.

There would be no liability "issue" if people managed to keep their PIN
secret.

You're talking about thumbprint biometrics ... that's not a complete
solution but it certainly has different problems. The biggest problem with
any biometric method is that it is imprecise; it's very difficult for a
human expert to look at two thumbprints and say that they definitely belong
to the same individual and much harder to teach a computer to compare the
digitized "edited highlights" of the same two prints and make the same
comparison.

Biometrics specialist talk about comparing the "insult rate" with the
"fraud rate" of any technique -- that is: comparing the proportion of
people who will be offended by being told incorrectly that they are
imposters with the proportion of people who will be mistakenly recognized
as someone that they are not. A lot of work goes into fine-tuning the
matching process to give an acceptable balance between the insults and the
frauds.

In order for any biometric technique to be acceptable at the point of sale
the "insult rate" must be essentially zero because neither customers nor
retailers will accept a mechanism that only accepts payment most of the
time.

The problem with thumbprints is that in order to get the insult rate low
enough to be acceptable the fraud rate has to be allowed to be quite high.
It would also be quite easy for a fraud to smudge his thumbprint enough
that the reader could not make a reliable authentication, and the retailer
would then be in the position of having to refuse the transaction or of
making the transaction with a paper voucher ... eliminating the security
that might have been achieved by the use of the thumbprint.

There have also been a number of quite well-documented studies in which
thumbprint readers have been fooled by false thumbprints (from simple
photographs of the thumbprint of the legitimate cardholder to gelatin films
bearing an impression of the cardholder's thumbprint being worn over the
fraud's thumb).

There is also considerable resistance to any method that uses fingerprints
because people associate the process of fingerprinting with criminal
investigation and feel that giving a fingerprint -- even for the purposes
of protecting access to their own money -- in some way demeans them. Such
resistance may be irrational, but it makes it hard for the banks to sell
thumbprinting to their customers.

Much better success rates can be achieved by biometrics based on the
recognition of patterns in the iris of the eye, and although some early
iris recognition devices could be fooled using photographs modern devices
are more reliable. I think iris recognition as a means of establishing
identity at point of sale is more likely to be workable than thumbprint
checking, but I don't think we'll see either for the next five years or
more.

Cheers,
Daniel.

[Tony Houghton]

Post by Daniel James
There have also been a number of quite well-documented studies in which
thumbprint readers have been fooled by false thumbprints (from simple
photographs of the thumbprint of the legitimate cardholder to gelatin films
bearing an impression of the cardholder's thumbprint being worn over the
fraud's thumb).

One of the most amusing was an episode of Mythbusters. An unnamed
security company submitted their "unbeatable" reader which was supposed
to be able to detect fake thumbs by measuring conductivity etc. IIRC
they defeated it by printing a copy of the thumbprint on plain paper and
licking it. An off-the-shelf reader connected to a laptop was rather
harder to crack, requiring something like a latex moulding.

OTOH the off-the-shelf reader would probably be more prone to the sorts
of "insults" you described.

[Robert Marshall]

Post by Daniel James
However, while C&P makes it harder to use someone else's card
without knowing the PIN, it does mean that if you have a stolen card
and do know the PIN there is almost no chance that anyone will
challenge you when you use it (even if, say, the fraud is obviously
male and the name on the card starts "Miss").

Having worked recently at a supermarket checkout - that was about the
only non-automated discrepancy one could pick up - and in this case I
had people assuring me that the reason for C&P was so that one's
partner/daughter/carer/gibbon could use one's card. :-(
Even had people paying for one purchase with one card and using
another - with a different name - on a second purchase

Robert

[Dick Georgeson]

We have evidence that on Sat, 14 Jul 2007 15:47:12 +0100, Daniel James

Post by Tony Houghton
I read somewhere that shifting the blame was the real motivation behind
chip & pin.

<...>

That means that the banks need to ensure that all cardholders take good
care that their PINs are not revealed, and that they need to reserve the
right to refuse to reimburse customers who are the victims of fraud if
they have any reason to believe that the fraud was made possibly by
negligence of complicity on the part of the customer.

A good part of the problem is that the banks make it pretty hard to avoid
revealing your PIN; there's only token shielding of the keypad -
particularly at my local Sainsbury where it's mounted vertically on a
stalk at about chest level and it's effectively impossible to ensure nobody
overlooks you as you type it in short of bringing along an enveloping
cloak. I reckon in most places I could usually read what's typed in if I
wanted to and you can be sure the crims would be much better at that than
me.

Given which, and the bignum of times you might type it in over the life of
the card (could be several times in a day) the banks' blanket insistence
that any failure of security is the fault of the user for not protecting
the PIN is indeed a major shift of blame.

It's not really a shift of the blame. There's been a shift of risk, and
a shift in the mechanisms for possible attacks, and the blame naturally
lies in a different place.

[Ian Rawlings]

Post by Dick Georgeson
Given which, and the bignum of times you might type it in over the life of
the card (could be several times in a day) the banks' blanket insistence
that any failure of security is the fault of the user for not protecting
the PIN is indeed a major shift of blame.

They don't do "blanket insistence" though, if you write the pin on the
card then you'll get taken out and shot, but this 100% customer is to
blame attitude that you seem to insist the banks have is just is a
figment of your imagination.

[Daniel James]

Post by Dick Georgeson
A good part of the problem is that the banks make it pretty hard to avoid
revealing your PIN; there's only token shielding of the keypad -
particularly at my local Sainsbury where it's mounted vertically on a
stalk at about chest level and it's effectively impossible to ensure nobody
overlooks you as you type it in short of bringing along an enveloping
cloak.

Yup. That's the point I was making (somewhere elsethread).

The problem, really, is that Sainsburys are free to buy whatever POS kit they
like the look of/matches their in-stroe colour scheme/they get the best
discount on and there is only token requirement for approval by the banks. If
the banks were to get together and design a spy-proof PIN pad and mandate it
for all POS applications a better level of security could be achieved .... and
all the shops would be up in arms because the kit would cost them five times
as much.

Post by Dick Georgeson
I reckon in most places I could usually read what's typed in if I
wanted to and you can be sure the crims would be much better at that than
me.

It's said that with practice a criminal can learn to read the PIN you're
entering just by watching the movement of your wrist -- he doesn't need to be
able to see you fingers or the keys.

Post by Dick Georgeson
... the banks' blanket insistence that any failure of security is the
fault of the user for not protecting the PIN is indeed a major shift of
blame.

IME the banks are quite pragmatic about that. They reserve the *right* to make
the customer liable for fraud that occurs because of PIN misuse, but they only
do so if they feel they have reason to suspect that the PIN was able to be
misused because of extreme carelessness or complicity on the customer's part.
That's still a problem, of course, because they won't always be right ... but
it's better than it might be.

Cheers,
Daniel.

[Chris Davies]

Post by Daniel James
It's said that with practice a criminal can learn to read the PIN
you're entering just by watching the movement of your wrist -- he
doesn't need to be able to see you fingers or the keys.

Reference? (Oh, no I forgot: this is usenet... ;-)

Does this mean that my using fingers on both hands to enter my PIN helps
(me) somewhat, then? What about that I use the knuckle of one of my
fingers, because folding that finger further obscures part of the keypad?

Curious,
Chris

[Ian Rawlings]

Post by Chris Davies
Does this mean that my using fingers on both hands to enter my PIN helps
(me) somewhat, then? What about that I use the knuckle of one of my
fingers, because folding that finger further obscures part of the keypad?

Personally I let off a smoke grenade when typing my PIN.

[alexd]

Post by Ian Rawlings

Post by Chris Davies
Does this mean that my using fingers on both hands to enter my PIN helps
(me) somewhat, then? What about that I use the knuckle of one of my
fingers, because folding that finger further obscures part of the keypad?

Personally I let off a smoke grenade when typing my PIN.

I have found that a chicken madras, channa rice and a few pints of real ale
the night before, has much the same effect.

[Geoffrey Clements]

Post by alexd

Post by Ian Rawlings

Post by Chris Davies
Does this mean that my using fingers on both hands to enter my PIN helps
(me) somewhat, then? What about that I use the knuckle of one of my
fingers, because folding that finger further obscures part of the keypad?

Personally I let off a smoke grenade when typing my PIN.

I have found that a chicken madras, channa rice and a few pints of real ale
the night before, has much the same effect.

It's a good job they've banned smoking in public places otherwise it could
be carnage!

[Ian Rawlings]

Post by Geoffrey Clements
It's a good job they've banned smoking in public places otherwise it could
be carnage!

Aargh! Rant mode!

It already is carnage, I don't smoke but this whole smoking ban thing
was a step too far IMHO, but not content with that, hospitals are
banning it on their premises, even outside. Even if you don't agree
with cigarette smoking (and I don't), I've seen people with saline
drips tucked under their arms wheeling themselves outside for a fag so
now to require them to go off-site during a time of heavy stress is
bad enough. To take it even further though, hospitals are hiring
extra security personell to enforce this extended ban because stressed
out patients, already coping with various illnesses, are refusing to
be jackbooted off the site so have to be forced. Meanwhile cash that
could be spent on something worthwhile gets blown on hiring gorillas
to manhandle patients around. They should have waited for at least a
year after the smoking ban came into force but the peaked-cap brigade
have been counting down the seconds to the introduction.

Then there's ID cards, CCTV, number plate tracking, the NERC bill,
fingerprinting kids in school on the pretence of tracking library
books or school meals, blimey! As if self-loathing wasn't enough, it
seems the british people are determined to turn on each other as much
as they can.

[Robert Marshall]

Post by Chris Davies

Post by Daniel James
It's said that with practice a criminal can learn to read the PIN
you're entering just by watching the movement of your wrist -- he
doesn't need to be able to see you fingers or the keys.

Reference? (Oh, no I forgot: this is usenet... ;-)
Does this mean that my using fingers on both hands to enter my PIN
helps (me) somewhat, then? What about that I use the knuckle of one
of my fingers, because folding that finger further obscures part of
the keypad?

Or maybe you should take the keypad out of the holder and turn it
upside down to enter the numbers?

Robert

[Daniel James]

Post by Chris Davies

Post by Daniel James
It's said that with practice a criminal can learn to read the PIN
you're entering just by watching the movement of your wrist -- he
doesn't need to be able to see you fingers or the keys.

Reference? (Oh, no I forgot: this is usenet... ;-)

I *think* I got that at a talk I attended, given by a fraud investigator
from the Met ... but my forgettery may be failing me on that one.

Post by Chris Davies
Does this mean that my using fingers on both hands to enter my PIN helps
(me) somewhat, then? What about that I use the knuckle of one of my
fingers, because folding that finger further obscures part of the keypad?

I'd say it probably does ... but I'm not an expert. I tend to hold my
wallet (from which I have just removed the card, so it's in my hand anyway)
over the PIN pad as I enter the PIN -- I'm sure that helps, but I'm not
sure how much.

Cheers,
Daniel.

[Dave Liquorice]

Post by Daniel James
It's said that with practice a criminal can learn to read the PIN you're
entering just by watching the movement of your wrist -- he doesn't need
to be able to see you fingers or the keys.

That is presumably why number keypads with security designed in don't have
the numbers in a fixed position. Each button is a display and the number
positions change for each use of the pad.

Now that would seriously confuse the public, I generally enter my PINs by
the pattern not the numbers. When C&P came in I had terrible trouble, I
could remember 2 pins but bung a 3rd in and one of the others had to go...

[Phil]

Post by Dick Georgeson
A good part of the problem is that the banks make it pretty hard to avoid
revealing your PIN; there's only token shielding of the keypad -
particularly at my local Sainsbury where it's mounted vertically on a
stalk at about chest level and it's effectively impossible to ensure nobody
overlooks you as you type it in short of bringing along an enveloping
cloak. I reckon in most places I could usually read what's typed in if I
wanted to and you can be sure the crims would be much better at that than
me.

They are designed to be removable, and are on a long flexible cable, Sainburys
certainly are. Take it out of the holder and use it so you can shield your
number and are comfortable.

Phil

[Nix]

Post by Alex Butcher

Post by Nix

Post by Tim Southerwood

Post by Gordon
If this reader has no connection to Natwest, how does the website know
that the (presumably random) number that its generated is correct?

[...]

Post by Tim Southerwood
Same way that your car knows that the random number that your radio
keyfob is sending is valid. Pseudo random sequence is one technique,
where both ends have the same algorithm - this stops replay attacks.
There are probably other ways too.

I presume this is a similar scheme to RSA SecureID (or even SecureID
itself: SecureID tokens are bloody expensive in small numbers but a bank
will be buying them in bulk), in which case there is a cryptographically
strong transform from the time of day (generally rounded to the minute)
and a secret key which varies per device;

I doubt very much that the time of day is included in the hash; that would
require that either a) the chip on the card was powered or b) that the
reader was powered (and stayed powered, even across a number of years,

Well, that's how SecureID tokens work, and a number of banks *have* given
such tokens out to customers.

[Alex Butcher]

[snip]

Post by Nix

Post by Alex Butcher

Post by Nix
I presume this is a similar scheme to RSA SecureID (or even SecureID
itself: SecureID tokens are bloody expensive in small numbers but a
bank will be buying them in bulk), in which case there is a
cryptographically strong transform from the time of day (generally
rounded to the minute) and a secret key which varies per device;

I doubt very much that the time of day is included in the hash; that
would require that either a) the chip on the card was powered or b) that
the reader was powered (and stayed powered, even across a number of
years,

Well, that's how SecureID tokens work, and a number of banks *have* given
such tokens out to customers.

Sure, but SecurID tokens are expensive, and the issues with clock
drift/synchronization can cause customer service issues. I expect the new
readers that leverage existing C&P technology are both cheaper for the
banks to buy and support, which is probably why they're beginning to be
used.

Best Regards,
Alex.

[Ian Rawlings]

Post by Alex Butcher
Sure, but SecurID tokens are expensive, and the issues with clock
drift/synchronization can cause customer service issues.

There's much more competition now, and the technology is cheap. I
doubt it's more expensive than a C&P reader and associated display,
you're talking about digital watch technology in the numeric token
cards.

Post by Alex Butcher
I expect the new readers that leverage existing C&P technology are
both cheaper for the banks to buy and support, which is probably why
they're beginning to be used.

There's probably more to it than that, a token card can authenticate
the user, but a card reader can pass on codes that can contain data
about which card has been inserted for example, perhaps they've got
their eyes on what can be done with such data? Also given the
userbase, mastering C&P has been a struggle for some of them so
perhaps it's best they stick with something fairly familiar!

Who knows, who cares ;-)

[Ian Rawlings]

Post by Alex Butcher
That's the theory, but in practice, the variability of clocks can
sometimes cause operational difficulties.

SecurID and a few others have been using time-based pseudo-random
cryptography for many many years so the issues can be gotten around.
The server knows what hashes you should have so when you enter one, if
it's one that is a hash or two ahead or behind the one the server is
expecting, the server updates its records to record the clock drift.
It works very well, despite what you might think.

Some banks use this method too, other ones appear to use a reader that
actually reads the card itself.

[Alex Butcher]

Post by Ian Rawlings

Post by Alex Butcher
That's the theory, but in practice, the variability of clocks can
sometimes cause operational difficulties.

SecurID and a few others have been using time-based pseudo-random
cryptography for many many years so the issues can be gotten around. The
server knows what hashes you should have so when you enter one, if it's
one that is a hash or two ahead or behind the one the server is expecting,
the server updates its records to record the clock drift. It works very
well, despite what you might think.

I used to work for an organisation that sold and supported SecurID. Clock
syncronization issues were probably the largest single cause of problems.

Best Regards,
Alex.

[Ian Rawlings]

Post by Alex Butcher
I used to work for an organisation that sold and supported SecurID. Clock
syncronization issues were probably the largest single cause of problems.

Ditto (although I didn't do support directly having moved out of that
arm thankfully), and the problems weren't difficult to overcome and
were very far from being show-stoppers.

[Alex Butcher]

Post by Alex Butcher
I used to work for an organisation that sold and supported SecurID.
Clock syncronization issues were probably the largest single cause of
problems.

Ditto (although I didn't do support directly having moved out of that arm
thankfully), and the problems weren't difficult to overcome and were very
far from being show-stoppers.

My point was primarily that this drives up support costs in a way that I
imagine C&P readers don't.

Best Regards,
Alex.

[Ian Rawlings]

Post by Alex Butcher
My point was primarily that this drives up support costs in a way that I
imagine C&P readers don't.

Possibly, but I reckon C&P readers will have a whole load of other
support costs, what with them being more complicated devices with
buttons, keypads, card contacts that token cards just don't have, and
of course there's the user issue of never quite figuring out which way
to put the card in, and the readers being wrecked by kids etc etc.
You and I both know what IT professionals are like when it comes to
support calls, you get some real idiots, but they're not a patch on
the idiots you get when you have to talk to the unselected masses.

[John Taylor]

Post by Gordon

Post by Dave Liquorice

Post by Dejanews Fan

Post by Chris
Just received magazine from NatWest which mentions they're bringing out
card readers for extra security on home banking

You sure this isn't a standalone device?

It is. A small handheld device that reads your chip 'n pin card producing
an eight digit number you feed to the online banking website.
http://www.newsroom.barclays.co.uk/content/Detail.asp?ReleaseID=1013&NewsA
reaID=2
http://blog.jazzle.co.uk/why-i-might-leave-my-bank-the-natwest-card-reader

If this reader has no connection to Natwest, how does the website know that
the (presumably random) number that its generated is correct?

A number of years ago, I used to use a similar device to log in to a
secure network. The card is synchronised with the base system, and part
of the number was fixed. The number displayed used to change every
minute or so. I assume that the system uses a combination of the time,
and a random seed to generate a unique hash that can be calculated by
both devices.

[Ewan Mac Mahon]

Post by Gordon

Post by Dave Liquorice

Post by Dejanews Fan

Post by Chris
Just received magazine from NatWest which mentions they're bringing out
card readers for extra security on home banking

You sure this isn't a standalone device?

It is. A small handheld device that reads your chip 'n pin card producing
an eight digit number you feed to the online banking website.

If this reader has no connection to Natwest, how does the website know that
the (presumably random) number that its generated is correct?

The NatWest site says that you enter an 'authorisation number' into the
cardreader, and it then generates another number, which you enter into the
site, which makes it look like a challenge-response arrangement. If the
response generated based on the 'authorisation number' and the data from
the card matches what the bank has generated from the same starting point
then it proves that you have both the authorisation number (which stops
replay attacks) and access to the card.

Or, in an alternative way of looking at it, it /is/ connected to NatWest
through a low bandwidth, serial, digital link :-)

Ewan