Tag Info

New answers tagged

-1

The biggest problem with services like Sofort is that because YOU have entered your banking details THEY are indemnified against chargebacks and indeed any kind of claim that the transaction was fraudulent. Which lowers their business cost because they have zero fraud (that they are responsible to pay for). However the responsibility for fraud lands on YOU ...


0

Banks are normally very large, bureaucratic organizations driven by policies written by people that were well meaning, but can't respond very well to changing threats. Are Phishing attacks worse than compromised machines where the password is stolen? I'm not sure, but it's a valid discussion. Saving the password locally is easy to understand, and for ...


3

While there are aspects of truth in what you say, you have to look at the bigger picture and look at where banks have liabilities and risks. Banks look to minimise the risk down to a certain level (eg there is a fraud appetite that is accepted by banks, as to try and reduce it further costs more and more, rapidly becoming unworkable) and many of these ...


2

Banks have real money losses, a significant amount of this comes from unauthorized access to bank accounts so they have financial incentives to make it harder for users to lose their password by storing it in the browser at their local internet cafe/library/etc.


4

I briefly read the papers you linked to and they expose several vulnerabilities allowing an attacker that can talk to the reader to make it sign transactions/login requests without requiring user consent. However, this isn't a big deal, for an attacker to "talk" to the reader your machine already has to be compromised and if that's the case, no amount of ...


0

Treat your personal PC as your banking PC and keep it patched. Never read Email on that PC. Only install Office, Chrome, flash, java on your VM. Redirect all USB drives to that VM. Don't use USB if possible on your PC, or disable it via GPO Re #4 - I have no comment on this one...


1

Chip and pin (EMV) credit cards support online PIN verification, which means the PIN has to be stored somewhere (I don't know whether it's at a central location controlled by VISA/MasterCard or at the bank), I assume its hash is stored securely as VISA/MC are usually pretty up to date in terms of security, though it's still very easy to bruteforce a 4-digit ...


0

Just like store password. Your PIN will be one-way-hashed, salted, and then stored in HSM in an encrypted format. Internal staff would be restricted (using access control policy) to get your PIN info. Even there is a way to get your PIN, it is hashed and hard to get your original PIN number. By this means, your bank would be able to associate your hashed ...


0

New visa debit card will the pin be the same? also read this answer it is same as you: A second bank card arrived with the same PIN They are probably stored encrypted, for local employees etc, but for an engineer working there it won't be a big problem to get the PIN out of the database. The only place where PIN records are stored is HSM.



Top 50 recent answers are included