19

Is the credit card number, CVV & expiry date considered to be a secret? If so, then the physical credit card is incidental & the info about the card is something "you know". OTOH, if you don't think that it's a secret, then the credit card is a "what you have".

From the 3D Secure description on Wikipedia https://en.wikipedia.org/wiki/3-D_Secure

The newest variant of 3D Secure, which incorporates one time passwords, is a form of software-based strong authentication. However, the legacy variant with static password does not meet the European Central Bank's (ECB) January 2013 requirements.

If you think a credit card is a "what you have" then a static password (what you know) is a better 2nd factor. If you think it's a "What you know", then an OTP is a better 2nd factor.

I am getting a little confused about this. Also I think there will be similar considerations for debit cards also.

  • 6
    Incidentally, I have changed my CVV from "what I have" to "what I know" by taking a hole punch(!) to the card to remove the CVV imprinted (deeply) on the back of the card. This is to foil simply copying the data off of the card (by hand or otherwise). – KlaymenDK Jan 30 '17 at 12:25
36

A requirement for "what you have" based authentication is that ownership can be clearly assigned to a single specific entity. This specifically means that this information/device can not be (easily) cloned and that access to the information requires access to the original device.

But credit number, CVV & expiry date are static information which can be easily cloned. Once you've entered these pieces of information somewhere they are not any longer what only you have. Thus they cannot be used as "what (only) you have" authentication. One-time passwords (OTP) are different. As the name suggests these are one time and cannot be reused, so access to a specific already used OTP is of no use for the attacker. Instead one needs to have access to the device generating the OTP, i.e. "what (only) you have".

In the case of the credit card: when you pay or get money by using the Chip and Pin functionality (EMV) you use the uncloneable part of the card, i.e. the "what only you have" part. If instead you use only the old magnetic stripe or the information written on the card (number, CVV...) you deal with easily cloneable information. This means this information is "what you have and others might have too" and thus can not be used to prove ownership of the card.

  • 2
    Consider adding a subtle complication to this answer: the credit card could be considered the what you have if (and only if) it is a chip and PIN card and the chip secret is used to generate the OTP. The idea is that the card's chip is not easily cloned. (In this case, what you know is the card PIN, so it is not a particularly strong second factor as it is only 4 digits.) – Qsigma Jan 30 '17 at 11:49
  • 1
    @Qsigma: I don't think how this complicates the answer: I already said that it can be considered what you have only if it is not (easily) cloneable. – Steffen Ullrich Jan 30 '17 at 12:37
  • 3
    @Qsigma a 4 digits (5 in some cases) code IS secure if the bank blocks the card after a few incorrect attempts. Mine does. – BgrWorker Jan 30 '17 at 16:48
  • 2
    @Qsigma - my bank and card issuer allows up to 12 digit pins – HorusKol Jan 30 '17 at 22:41
  • 2
    @HorusKol sure, but most don't. So, it should not be relied upon as a general security practice for a debit card. Also, allowing for 12 digits and requiring a minimum of 12 digits are two different things (in other words, it doesn't matter how many digits they allow if most people still just use 4). – iheanyi Jan 30 '17 at 22:44
3

The number written on the back is actually the CV2. It is designed to be "something you have" because it is physically printed on the card but not encoded on the magnetic strip, or in the chip. It is also forbidden by the rules of the card processors for any merchant to store the CV2 value.

Of course in reality it does not necessarily prove physical access to the card as the number can be copied, written down, or stored electronically even if it is against the rules; and anyone attempting fraud is by definition not going to play by the rules.

By contrast the PAN and expiry date are "something you know" and in fact these values can in some circumstances be given out by the card issuer to interested parties.

  • 3
    The point of "something you have" is not that you have it but that only you have it. It does not matter if the CVV is printed on the card and it does not matter if nobody is allowed to store it: since you enter it when buying something you lose control over it so there is no guarantee that you are the only one having the CVV. Also anybody having your credit card for a short moment can see and copy the value. – Steffen Ullrich Jan 30 '17 at 16:15
  • @SteffenUllrich: And you enter your password into websites do you not? – Joshua Jan 30 '17 at 17:38
  • 3
    @Joshua: A password is similar to the CVV in that it does not count as something you have but as something you know. Something you have would be a U2F token or similar which is uncloneable. Somebody shoulder surfing while you enter the password could "copy" it and use it later. This would be impossible with the U2F token which the attacker would need to physically steal from you. – Steffen Ullrich Jan 30 '17 at 17:39
3
  1. All information is supposed to be more or less secret, including the card number, your PIN, etc. Even the name of cardholder.
  2. No static (that is, usable more than once) information can be considered "what you have", they're all "what you know".
  3. "what you have" could only be something physical that's not easy to duplicate. The proof of having what you have is usually one time password generated using such physical object. Examples:
    • an indication of a hardware token (proof of having the token)
    • a communication with secure element, chip (proof of having chip card in a reader)
    • a one time password generated on the server side and delivered via side channel (proof of having access to that channel). In 3d-secure the object is your mobile phone (your SIM card, to be specific) which it gives you access to the channel (your phone number). The channel is reasonably secure and access to it is reasonably limited, so it can be assumed that you having access to the channel to read the one time password is good enough proof that you physically have the SIM card.

Now, to have 2-factor you're supposed to both know the secrets AND prove your recent access to the physical object. The "recent" part can be implemented in many ways, eg by the token having internal clock that changes indication every few seconds, or via challenge-response mechanism.

Ultimately one can say that even the physical object is just information: the secret keys hardcoded in chips. But in security the difference between information and object is that information can be easily copied, while an object cannot. Fun fact: keys to your house are more information than objects, as it's quite easy to make copy of them.

If you want to do only MOTO transactions, the card doesn't even need to exists physically. There are examples of banks issuing "virtual cards" for internet use only, and those "cards" are just a bunch of letters printed on a paper: card number, expiry date, cardholder name, etc. Because they're not supposed to be used in card reader, there is no need nor use for mag strip, chip or embossed letters.

1

Retailers have different relationships with the card provider for "card not present" transactions. Their liability, and transaction costs are usually higher. This is because card not present transactions are (obviously) much more prone to fraud than card present, especially with Chip and PIN.

This is why online retailers will often only deliver to your registered address on first order; or will be limited in amount; or be limited to transactions where they will meet you at some point (e.g. ticket bookings).

Basically, because it's an easy to get secret, retailers have to make a choice whether to take the risk, and mitigate that risk in whatever way suits their trading environment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.