Bank card readers ?

Bruv · Post by **Bruv** » Thu Jan 08, 2015 2:06 pm

I have had reason recently to transfer money to a family member's account from my own.

During the 'on line' process I have to put a PIN number into a device supplied by the Bank, which returns yet another number that has to be entered to verify the transaction.

All this from an un-connected device that is not personal to me as far as I know, because there are 2 such 'readers' in the house and I pick up either randomly.

What sort of magic does this little machine have in its workings ?

FG-administator · Post by **FG-administator** » Thu Jan 08, 2015 2:15 pm

I've never heard of anything like that, or I'd offer suggestions. It sounds impossible.

Bruv · Post by **Bruv** » Thu Jan 08, 2015 2:26 pm

FG;1471094 wrote: I've never heard of anything like that, or I'd offer suggestions. It sounds impossible.

I think it might be black magic......or something. HERE Using another Reader HERE

Strange or clever ?

Post by **Bryn Mawr** » Thu Jan 08, 2015 3:05 pm

Bruv;1471092 wrote: I have had reason recently to transfer money to a family member's account from my own.

During the 'on line' process I have to put a PIN number into a device supplied by the Bank, which returns yet another number that has to be entered to verify the transaction.

All this from an un-connected device that is not personal to me as far as I know, because there are 2 such 'readers' in the house and I pick up either randomly.

What sort of magic does this little machine have in its workings ?

It's called two factor authentication, the device takes your PIN and the Challenge Number supplied by the bank via the merchant's site and calculates an, apparently, random response that is then sent back to the bank's authorisation system to validate the PIN you've used.

It's neat enough that it can be, and in some instances has been, built into a credit card to validate on-line transaction but the common use at this stage is to validate access to on-line banking services. Without such validation they cannot be made secure and I, personally, refuse to use my bank's offering because they do not supply such a system.

FG-administator · Post by **FG-administator** » Thu Jan 08, 2015 3:16 pm

Ah. Well, yes, if it takes more input than just the user's PIN then I can see it might provide an informative response.

Bruv · Post by **Bruv** » Thu Jan 08, 2015 3:48 pm

Bryn Mawr;1471100 wrote: It's called two factor authentication, the device takes your PIN and the Challenge Number supplied by the bank via the merchant's site and calculates an, apparently, random response that is then sent back to the bank's authorisation system to validate the PIN you've used.

It's neat enough that it can be, and in some instances has been, built into a credit card to validate on-line transaction but the common use at this stage is to validate access to on-line banking services. Without such validation they cannot be made secure and I, personally, refuse to use my bank's offering because they do not supply such a system.

But I can use any reader, not my own dedicated reader.

I so wish I was cleverer......more clever ?

FG-administator · Post by **FG-administator** » Thu Jan 08, 2015 3:53 pm

Bruv;1471110 wrote: But I can use any reader, not my own dedicated reader.

I so wish I was cleverer......more clever ?

It allows you to confirm your PIN to the bank without actually telling the bank, or anyone monitoring your keystrokes, what your PIN is. An observer would be incapable of pretending to be you at a later date because your PIN is still hidden.

FG-administator · Post by **FG-administator** » Thu Jan 08, 2015 3:55 pm

Bryn Mawr;1471100 wrote: Without such validation they cannot be made secure and I, personally, refuse to use my bank's offering because they do not supply such a system.
I reckon a two-factor SMS is as reliable, as an alternative.

Bruv · Post by **Bruv** » Thu Jan 08, 2015 4:03 pm

FG;1471113 wrote: It allows you to confirm your PIN to the bank without actually telling the bank, or anyone monitoring your keystrokes, what your PIN is. An observer would be incapable of pretending to be you at a later date because your PIN is still hidden.

I think I know what your talking about, it is a sort of Enigma Code ?

But couldn't that be broken too, by someone smarter than me of course.

FG-administator · Post by **FG-administator** » Thu Jan 08, 2015 4:09 pm

Bruv;1471119 wrote: I think I know what your talking about, it is a sort of Enigma Code ?

But couldn't that be broken too, by someone smarter than me of course.

The phrase is "reverse engineering" - you'd need to know the internal workings of the box they gave you. It's designed to resist. It's easier for a thief to steal someone else's money and leave yours untouched.

FourPart · Post by **FourPart** » Thu Jan 08, 2015 4:45 pm

Bruv;1471119 wrote: I think I know what your talking about, it is a sort of Enigma Code ?

But couldn't that be broken too, by someone smarter than me of course.
That's exactly what I was thinking. The widget I have is with HSBC, and about the size of a cradit card, and fits nicely into my wallet. When logging into my online banking I have to enter my Online Banking Account No., then the answer to the Security Question (the usual twaddle), then the 6 digit security number. This is what fascinates me. If you enter your PIN, say 1234, it comes up with something like 456123 which you would enter to gain access to your account. However, if you enter 1234 on the widget again you get something like 748521, which will get you into your account. What I don't get, though, is how this can come up will multiple 'encoded' numbers, any one of which will work, when there is no connection between the widget & the computer.

FG-administator · Post by **FG-administator** » Thu Jan 08, 2015 4:47 pm

It has a clock. The code is only valid for the next few minutes.

Post by **Bryn Mawr** » Fri Jan 09, 2015 8:29 am

FG;1471114 wrote: I reckon a two-factor SMS is as reliable, as an alternative.

True, any secure back channel can be used but it must be dynamic authenticaltion and my bank still uses static.

FG-administator · Post by **FG-administator** » Fri Jan 09, 2015 9:02 am

Bryn Mawr;1471173 wrote: True, any secure back channel can be used
Hmm. That cuts out the ForumGarden Groups then.

Saint_ · Post by **Saint_** » Fri Jan 09, 2015 10:28 am

Here in the U.S., we have not implemented that system yet. We just let hackers steal everything so we can read celebrities emails and see their nude pictures. Oh, and the hackers release unreleased movies for us to pirate sometimes too. The only downsides are that you can't have a good credit rating, which we don't, and that you can't have any money in a bank, so we all keep it in our mattresses.

FourPart · Post by **FourPart** » Fri Jan 09, 2015 10:29 am

Saint_;1471199 wrote: Here in the U.S., we have not implemented that system yet. We just let hackers steal everything so we can read celebrities emails and see their nude pictures. Oh, and the hackers release unreleased movies for us to pirate sometimes too. The only downsides are that you can't have a good credit rating, which we don't, and that you can't have any money in a bank, so we all keep it in our mattresses.
But even a mattress might have a PIN Cushion.

Saint_ · Post by **Saint_** » Fri Jan 09, 2015 10:30 am

FourPart;1471201 wrote: But even a mattress might have a PIN Cushion.

Oh that was good. Very punny.

Bruv · Post by **Bruv** » Fri Jan 09, 2015 10:38 am

Saint_;1471199 wrote: Here in the U.S., we have not implemented that system yet. We just let hackers steal everything so we can read celebrities emails and see their nude pictures. Oh, and the hackers release unreleased movies for us to pirate sometimes too. The only downsides are that you can't have a good credit rating, which we don't, and that you can't have any money in a bank, so we all keep it in our mattresses.

My American son in law 'Banks' his check (that is American for cheque) by taking a photograph of it with his phone and forwarding the image to the Bank........they be different over there.....strange and different.

Never heard of BACS there I suppose.

FourPart · Post by **FourPart** » Fri Jan 09, 2015 10:40 am

Bruv;1471205 wrote: My American son in law 'Banks' his check (that is American for cheque) by taking a photograph of it with his phone and forwarding the image to the Bank........they be different over there.....strange and different.

Never heard of BACS there I suppose.
I just use PayPal wherever possible.