Timeline for In a "card not present" transaction, is the credit card number, expiry date & CVV considered as a "What you have" or a "What you know"?
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 31, 2017 at 10:14 | comment | added | Antzi | You are supposed to blackout the CVV, as well as you are supposed to destroy the paper with your pin infomations. | |
| Jan 31, 2017 at 9:49 | comment | added | Qsigma | @BgrWorker great point: a short PIN is much more secure if the network, or the chip itself (as mine claims to do), blocks PIN access after a small number of attempts. | |
| Jan 30, 2017 at 22:44 | comment | added | iheanyi | @HorusKol sure, but most don't. So, it should not be relied upon as a general security practice for a debit card. Also, allowing for 12 digits and requiring a minimum of 12 digits are two different things (in other words, it doesn't matter how many digits they allow if most people still just use 4). | |
| Jan 30, 2017 at 22:41 | comment | added | HorusKol | @Qsigma - my bank and card issuer allows up to 12 digit pins | |
| Jan 30, 2017 at 21:30 | comment | added | PwdRsch | It is not generally accepted that 'type' labels for authenticators only apply if a choice is resistant to theft, disclosure, etc. If there's a requirement for copy resistance, then it is a situational preference and not an inherent trait of 'what you have' authenticators. So 'what you have' authenticators are everything from easily cloneable objects to highly copy resistant objects. We then evaluate objects from that list and tend to prefer the choices that better balance uniqueness, integrity, usability, affordability, etc. | |
| S Jan 30, 2017 at 17:34 | history | suggested | psmears | CC BY-SA 3.0 |
Improve grammar and wording
|
| Jan 30, 2017 at 17:17 | review | Suggested edits | |||
| S Jan 30, 2017 at 17:34 | |||||
| Jan 30, 2017 at 16:48 | comment | added | BgrWorker | @Qsigma a 4 digits (5 in some cases) code IS secure if the bank blocks the card after a few incorrect attempts. Mine does. | |
| Jan 30, 2017 at 16:21 | history | edited | Steffen Ullrich | CC BY-SA 3.0 |
added 422 characters in body
|
| Jan 30, 2017 at 15:34 | comment | added | Qsigma | I meant that my suggestion would make it more complicated for the OP to follow, but it might be useful as it is a common case of 2FA with only a credit card. Add it if you want, but I upvoted you anyway. | |
| Jan 30, 2017 at 12:37 | comment | added | Steffen Ullrich | @Qsigma: I don't think how this complicates the answer: I already said that it can be considered what you have only if it is not (easily) cloneable. | |
| Jan 30, 2017 at 11:49 | comment | added | Qsigma | Consider adding a subtle complication to this answer: the credit card could be considered the what you have if (and only if) it is a chip and PIN card and the chip secret is used to generate the OTP. The idea is that the card's chip is not easily cloned. (In this case, what you know is the card PIN, so it is not a particularly strong second factor as it is only 4 digits.) | |
| Jan 30, 2017 at 6:00 | history | answered | Steffen Ullrich | CC BY-SA 3.0 |