MSE News: Barclays customers face delays following system error

TOP_CAT

Lokolo,
you have picked out the most simple and obvious point in the post which is common knowledge and highlighted it, using a flippent remark of no value.

Is this to distract from my posts reply to Wizk1,s point that card readers are for the *banks financial gain only.

Not the customers security, as wizk1 has pointed out, to be why they must now regain that cost and then further profit from it, under a debatable cloak of customer security.

My point stands they cloak or cover their extremly excessive profits in many forms of disguise, beyond the average working persons ability too counter these tactics.Profiting at the disadvantaged expence.

Your post condons the financial ruin,hardship ,job loses from those very actions of the banks ,which are very real and can not be denied today.

If people chose to ignore these actions of excessive greed for whatever reasons, however small,thats fine but they are real and exsist.

Wiizk1 was just pointing that out, the truth for others too see or consider ,I seconded it.
Thats the heart of this forum.

Extant

wizk1 wrote: »

...And just for the record... PIN Sentry is not completely secure

http://news.bbc.co.uk/1/hi/england/cambridgeshire/8325477.stm

Here's my post from another thread about this hyperbolic news article:

Extant wrote: »

No, the card reader has not been hacked. Here's the key parts of the article:

But the Cambridge team say that by using a fake chip and pin terminal attached to a laptop the fraudster can learn the customer's name and unique pin code.

Nothing has been hacked here, they're just using an alternate technology to persuade people to input their PIN. This is, at best, social engineering - not hacking. It then follows up with:

Once they have also tricked the customer into giving out their bank membership number...

So this fraud method require the customer to a) use a compromised terminal; b) put their PIN in to a device attached to the computer other than their own card reader and then c) disclose their membership number.

No wonder Barclays don't view this to be a plausible threat. There's no hacking here, the technology remains secure - this prays on customers being careless with their details and reckless with the computers they use.

TOP_CAT

Extant,
Thats quite a news worthy Item highlighting the individuals absolute ability to fight on the right side of the law and still lose alot more, than a sum of money for been innocent.
Its really terrible.I don,t have words for a organisation that does that too people.Neither did the news piece,highly stressful too say the least.

I am impressed in the fight they have put up though,It does,nt get much better than that.

Extant

TOP_CAT wrote: »

Extant,
Thats quite a news worthy Item highlighting the individuals absolute ability to fight on the right side of the law and still lose alot more, than a sum of money for been innocent.
Its really terrible.I don,t have words for a organisation that does that too people.Neither did the news piece,highly stressful too say the least.

I am impressed in the fight they have put up though,It does,nt get much better than that.

The only thing stressful about it is, as said, the hyperbole - the card readers have not been "cracked" - they have merely developed a method to exploit the customer.

The summary of this article is: we can get passed security if you give us all of the details we need.

The underlying security/technology remains secure.

The fact remains that if anybody puts their card in to a device attached to a computer they have never used before and then enters their card PIN, they've acted negligently and stupidly.

hippey

There is no point 'cracking' the card readers as that is all they do, ready the card.

The output of the device is what the scammers want. And in reality it is only an 8 digit version of the TC from the card. So you do need a copy of the card, PIN, online details and where the card is in therms of TC (Transaction Code)

If you notice the number the reader gives out is seqential in the first four digits, the program on the laptop just exploits this code. Not easy though!

Paul_Herring

Extant wrote: »

The fact remains that if anybody puts their card in to a device attached to a computer they have never used before and then enters their card PIN, they've acted negligently and stupidly.

That's every CnP terminal in every shop you haven't been in before then. And, technically, in every shop you have been in before.

Sorry - why are these more secure again?

Extant

Paul_Herring wrote: »

That's every CnP terminal in every shop you haven't been in before then. And, technically, in every shop you have been in before.

Sorry - why are these more secure again?

Are you unable to distinguish between a Chip & PIN terminal in a store and the card reader Barclays provides? The PINsentry is a small, stand alone unit that is provided to you directly. It's made quite clear that it doesn't connect to your computer, doesn't need connecting, etc.

It relies on the stupidity of customers. The underlying technology, EMV (and the authentication there-of), remains "uncracked".

And to reduce the probability of this even further: most customers do not know their card readers can be used interchangeably - so your average Natwest customer couldn't be tricked to using a "disguised" Barclays unit, or vice versa.

Paul_Herring

Extant wrote: »

Are you unable to distinguish between a Chip & PIN terminal in a store and the card reader Barclays provides?

Perfectly.

Card readers aren't attached at all to a computer. Chip and Pin terminals are.

You said in the post, to which I replied:

The fact remains that if anybody puts their card in to a device attached to a computer they have never used before and then enters their card PIN, they've acted negligently and stupidly.

Emphasis mine. So if it's attached to a computer, that would be a CnP terminal.

The PINsentry is a small, stand alone unit that is provided to you directly. It's made quite clear that it doesn't connect to your computer, doesn't need connecting, etc.

Indeed. It appears I'm not the one who's confused here.

Extant

Paul_Herring wrote: »

Indeed. It appears I'm not the one who's confused here.

No, not at all.

Have you actually read the BBC article?

hopefulfooluk

For those of you moaning about not being able to log in without PINsentry once you've been given one, you can - on the login screen you can click (just below where you enter your membership number):

Personal/Premier customers: forgotten your PINsentry card reader?

And it will let you log in without it for a couple of weeks. Problem solved.