3

Is it secure to ask a user to enter their debit card pin to perform certain actions on their mobile banking app? (payment, view card number, etc.)

The pin will be transmitted over HTTPS, which is compliant with PCI requirements for online pin processing. But HTTPs can be hacked - so sending the PIN so often doesn't seem wise (and may not be PCI compliant, or follow industry best practices )

8
  • "Is it OK" is a very vague question. OK by whom? The bank? The payment processor? Your boss? J. Random Hacker? The Payment Card Industry? Please be more specific. Sep 20, 2016 at 19:15
  • @JohnDeters fixed
    – EugeneMi
    Sep 20, 2016 at 19:17
  • 1
    "But HTTPs can be hacked" that's a very vague and interesting assumption. There's is a lot more to HTTPS than just having a certificate. If https was easily hacked, the security community wouldn't be so adamant about using it everywhere. There do exist some minor vulnerabilities but there are no glaring issues that make the transfer of information over https a huge risk factor, in my opinion.
    – d0nut
    Sep 20, 2016 at 19:37
  • @iismathwizard: Maybe some more background reading required! There are some very major issues with HTTPS but it is currently the best standard we have and vastly better than doing nothing. Sep 20, 2016 at 19:39
  • 1
    Sorry, but a Google search for "https issues" is about the least convincing counterargument I can think of. If you know of a way to intercept a PIN from a TLS 1.2 connection and ciphersuite on a recently patched major implementation, publish it and enjoy your guaranteed speaking spot at the next DEFCON. Sep 20, 2016 at 23:31

2 Answers 2

2

I think PCI Pin Security (v2) Requirement 1 is the most relevant to your question:

"All cardholder-entered PINs must be processed in equipment that conforms to the requirements for secure cryptographic devices (SCDs). PINs must never appear in the clear outside of an SCD.

A secure cryptographic device (SCD) must meet the requirements of a “Physically Secure Device” as defined in ISO 9564. For POI PIN-acceptance devices this is evidenced by their being validated and PCI approved"

So, unless the device meets the requirements of an SCD (I don't know of any devices resembling home computers or consumer mobiles meeting those requirements) it can't be done. The details of encrypting and transporting the data are secondary to this (which, IMO, cant be overcome).

4
  • Requirement 2a suggests that online processing is ok - "All cardholder PINs processed online must be encrypted and decrypted using an approved cryptographic technique that provides a level of security compliant with international and industry standards. Any cryptographic technique implemented meets or exceeds the cryptographic strength of TDEA using double-length keys."
    – EugeneMi
    Sep 20, 2016 at 20:03
  • Also a bunch of banks allow you to set/reset your PIN using the mobile app.
    – EugeneMi
    Sep 20, 2016 at 20:04
  • @EugeneMi is there a distinction in compliance for using a PIN for a purchase vs some other purpose such as requesting a change? Also, 2a covers encryption while on the move and not just "any time a web site is involved" right? otherwise why does requirement 1 even exist, every POS could just pop open a browser window to handle a debit transaction, and Ingenico would go out of business
    – Jeff Meden
    Sep 20, 2016 at 20:14
  • From the little I've read I believe that the term "processed online" means "is sent and validated online" as opposed to "processed offline" which means "processed by the card chip". The term "online" does not mean that PIN entry is allowed on a web app. It means that a certified terminal would capture the PIN and transmit it. Does that make sense to anyone?
    – Kos Prov
    Nov 14, 2017 at 14:48
0

What I have understand, this requirement is waived (compensating control: Compromise is limited to a single cardholder) for cardholder-owned equipment, as the risk for compromise is reduced to one single instance of a card. Eg, if the mobile banking app is compromised, you would get the PIN code for one single customer. Not a lot of customers like if a ATM/POS PIN entry device was compromised.

When it also comes to transit, I believe the bank has taken measures to prevent the PIN from being visible even if the HTTPS was decrypted/removed/compromised, by using app-specific encryption that is using the PIN-code to generate a ZKP.

The reason a ATM/POS pinpad must for example be a SCD, is to prevent someone from installing a invisible skimmer under the keypad which "snoops" the PIN code. Now the skimmer must resort to detectable methods like cameras or PINpad overlays, as the PIN is encrypted in the tamper-resistant PIN pad.

Also another thing issuers do:

Think all those "OTP cardreaders" where you insert your card, enter your cardholder PIN, and then a OTP code is shown on screen that can be used to login to internet banking. These does not meet the requirements for SCD either, as they don't have any tamper resistance. But tamper resistance would also be impossible to implement on a "OTP cardreader", as then the cardreader would then need to be personalized to the customer instead of being "generic".

Same with Samsung Pay, Android Pay, and Apple Pay. Cardholder Authentication is here done on a "insecure" device, but the device is still owned by the cardholder, which makes it a lot more secure, as tampering with the device would get you ONE cardholder details, not many, and also, tampering with it would require getting physical hands on it, which is a lot harder than skimming a ATM or similiar.

The payment card industry has already approved Samsung Pay, Android Pay, and Apple Pay, even if their support for PIN authentication is done on a device which is not SCD compliant. (Fingerprint is normally used, but PIN can be used if finger is dirty etc.)

3
  • in re: apple pay et. al. they don't ever use the card pin, do they? I don't have an apple device to try it out but the other two (Samsung pay and android wallet) I know use just the visible card details and rely on a relationship with the bank (not all cards work) but never collect the card PIN for using a card.
    – Jeff Meden
    Sep 21, 2016 at 12:39
  • Heck, AFIK, most US Banks, do not even support CARD PINs for transactions. wsj.com/articles/…
    – jwilleke
    Sep 21, 2016 at 16:24
  • @JeffMeden No they don't use the Card PIN, but they use a "own PIN" that is associated with the virtual card that is created at transaction time (that has a one-time card number) that is neverless accepted for transactions, thus it would count as a cardholder PIN for the purposes of PCI DSS. The thing is that since authentication happen on a device that the cardholder owns, its keypad doesn't neccessary need to be "secure". Sep 22, 2016 at 3:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .