Tag Info

Hot answers tagged


I briefly read the papers you linked to and they expose several vulnerabilities allowing an attacker that can talk to the reader to make it sign transactions/login requests without requiring user consent. However, this isn't a big deal, for an attacker to "talk" to the reader your machine already has to be compromised and if that's the case, no amount of ...


While there are aspects of truth in what you say, you have to look at the bigger picture and look at where banks have liabilities and risks. Banks look to minimise the risk down to a certain level (eg there is a fraud appetite that is accepted by banks, as to try and reduce it further costs more and more, rapidly becoming unworkable) and many of these ...


Banks have real money losses, a significant amount of this comes from unauthorized access to bank accounts so they have financial incentives to make it harder for users to lose their password by storing it in the browser at their local internet cafe/library/etc.


Chip and pin (EMV) credit cards support online PIN verification, which means the PIN has to be stored somewhere (I don't know whether it's at a central location controlled by VISA/MasterCard or at the bank), I assume its hash is stored securely as VISA/MC are usually pretty up to date in terms of security, though it's still very easy to bruteforce a 4-digit ...

Only top voted, non community-wiki answers of a minimum length are eligible