Hot answers tagged

5

So both of your scenarios rely on the attacker having root access to the phone. In security, it's generally considered that once an attacker has root access, it's game over. That said, there are still interesting things to be said about your question. You asked: Is there a situation where the secure element does offer a clear security benefit to this ...


5

Can an attacker get information off the card? Yes, at least some can, and the UK consumer group Which? mentioned in the question did it: Our researchers tested 10 cards (six debit and four credit, from volunteers) to assess security risks. Contactless cards are coded to 'mask' personal data, but using an easily obtainable reader and free software ...


4

I've never heard of just using the date of birth for authentication. It's a bad idea as a date of birth is non-revocable. Meaning if it is "compromised" you can't change it. If it is the only means of authentication for consulting account or transactions it's a REALLY BAD IDEA. But that brings me to my second point. It is, in general, not considered your ...


2

I've been doing professional pentesting for quite a while covering many of the banks having a permit here in Switzerland. Traditionally they were using username/password only. Then they switched to TAN (transaction authentication number) handed out on paper. I just know 2 remaining banks in Switzerland which are still doing this. There are two reasons: (1) ...


2

Anything you can do to mitigate the threat of usage after the physical-theft of the card is a great idea. Making them take longer by making them make mistakes and/or trying in multiple places is a solid idea. That is, aside from the ultimate mitigation of keeping your bank's phone numbers in your phone so you can contact them immediately to report card theft....


1

Your scheme isn't terribly likely to work because not all ATMs keep the card, many are swipe. Any thief that sees two pins will think only one is valid, and can easily bypass your scheme by just using an ATM that you swipe the card instead of the ATM taking it.


1

Most banks would ideally to use multiple stages of authentication. These are classified as: Something you know (password) Something you have (card / token / phone) Something you are (biometric) By asking for a DoB, your bank is restricting itself to only one source. Considering that once a password is known it is hard to assume that the attacker cannot ...


1

In the big picture it may actually be more secure. When we computer people talk about security we talk about bit of entropy, hash algorithms, brute force attempts and the like. It's easy to forget one simple, unavoidable rule. People are stupid! All of that goes out the window when a user writes down their password, pin number, and security question/...



Only top voted, non community-wiki answers of a minimum length are eligible