0

Imagine a scenario where a 4-digit pincode needs to be delivered securely to an end-user. Several possibilities exists:

  • Pin mailer (this seems to be standard according to ISO 9564-1)
  • SMS
  • Email
  • Email a unique link, which can be used to view the PIN in the browser

All of them seem pretty insecure (letters, SMS, emails can all be intercepted), but still many banks use one of the above for usability reasons.

Question:

  1. Is any of the four listed above more insecure than the rest, and if so, why?
  2. Do other options exist?
  • 1
    The idea usually isn't absolute security, but rather out of band delivery. Anyone controlling or monitoring one means of communication shouldn't be able to get what's delivered through another. – a CVn Feb 29 '16 at 15:23
  • Yes. QKD ))) – Deer Hunter Feb 29 '16 at 17:04
2

In an ideal world, the PIN would never have to be transmitted to the user; instead, the user would choose it.

Experimentally, for banking cards, I encountered two methods:

  1. The bank chooses the PIN and sends it as a letter, with some printing gimmicks to prevent reading the PIN with a lamp, by abusing the paper transparency.

  2. A temporary PIN is awarded by the bank, given directly to me over the counter by the clerk, and I immediately change it through either a payment terminal (on the counter) or with the ATM (which is in the same room).

This world is not ideal so the situation often forces a remote transmission of a PIN, selected by the organization, and sent to the user. In that case, since there is no really secure channel to communicate with the user, the idea is channel separation: the PIN is transmitted in a way which is distinct from the way the complementing information is sent.

Emails are notoriously poor at security. They are, by default, unauthenticated, and may travel as plain text. They get stored on the reception server, with uncontrolled retention time, and often lots of backups. SMTP servers through which the email transits will also store a copy on some storage medium for amounts of time that are not easily measured, let alone configured. An email is a really bad storage place for a secret value.

SMS are somewhat better. When they go over the air, they get encrypted along with the normal mobile phone mechanisms. When they have been acknowledged by the receiving phone, they are removed from the distribution servers -- the SMS model is built around device-based storage, contrary to emails where the normal resting place of an email is the email server. There still will be a lot of potential for leakage, notably when the phone is synced up with some cloud-based storage system. In fact, the best thing that can be said about SMS, when compared with emails, is that phone malware is still for the moment less prevalent than desktop malware.

You could use a phone call, with an actual human, or a robot system. A voice-based transfer makes it less likely that unwanted copies will be retained on some server. It is also compatible with users who do not have a phone capable of receiving SMS (yes, there are still a few persons in that case).

Paper-based mails are not very secure at all, but intercepting such a letter requires physical presence near the recipient's home. Depending on your context, this may be distinct enough from whatever the PIN is supposed to protect to achieve good security. The bad situation is when the PIN is for a credit card, and the credit card and the PIN are sent as letters. Then, an attacker who can intercept the PIN can also intercept the card. In such a situation, banks are likely to require an explicit activation with a phone call, where the user will be authenticated through the knowledge of "secret values" (birth date, mother's maiden name... high-quality secrets, as you can imagine).


Take care that the security model may vary. Banks, for example, do not try to achieve perfect security for all users; what they want is to make money. Thus, they will strive to achieve the best compromise, i.e. the method that minimizes the overall costs. They can tolerate a bit of fraud, if other safer methods would be more expensive to operate or would alienate a non-negligible proportion of potential customers. It shall be remembered that the bank's security is about protecting the bank, not the user (regardless of what they may claim in their ads).

2

I've heard of some banks that send two pin mailers instead of a single one but I think that's two halves of a complete pin number. You can't have more than one pin numbers for a debit or credit card.

-1

Humans are not able of generating random numbers. Human generated PIN is predictable. If you use PC to generate the PIN it will also be predictable. This is why, card issuing solutions rely on special HSM devices able to generate real random numbers. Such devices are required by the PCI regulation. This is one of the reasons PIN should be delivered, not set (however, this can open a whole new discussion). However, you are right, PIN mailer is not secure. The main question is is it more secure than something else. Well.. depends what.

Every PIN delivery channel you mentioned has its own vulnerabilities. SMS risk is mainly related to the low security of the communication between the bank and SMS provider (mostly within the provider itself, I'm not talking about IPsec tunnel) and highly depends and varies between different providers. Using SMS aggregators for sending clear text PIN is probably worst you can do. Other part of the SMS risk is related to the smartphones (i.e. Android) in which untrusted applications can access SMS messages. Therefore, sending confidential SMS to Android phone is a bad idea. Using internet as a delivery channel allows you to use better end to end encryption, so this vulnerability is lower. However, because internet is wide open network, there are numerous other vulnerabilities such as man in the middle attacg based on proxy server between the client and server. And one more thing, if designed right, card production systems are not able to decrypt the PIN so you can't read it. And at the end, card holder has to protect it the best way he can ;)

  • 1
    Stanko, welcome to Information Security. Please do not include marketing spam in your answers - that might actually get you banned. (I rescued this answer because it actually has genuine content, aside from the spam.) – AviD Mar 16 '16 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.