News for hackers. Stuff that matters.
Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by kuschku on Friday November 20, 2015 @11:24AM (#10602004)
Holy shit, that’s horrible.

Where I am, PIN and Card arrive in different letters, and the Card letter is only sent once you confirmed via your online banking interface (which uses 2FA) that you received the PIN letter. And you need to confirm online in your banking interface to have received the card to be able to use it.

Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by bpicolo on Friday November 20, 2015 @12:38PM (#10602507)
For credit cards in the US you virtually never use a PIN. Debit cards only
Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by kuschku on Friday November 20, 2015 @01:56PM (#10603069)
Well, even then.

Require the customer to verify that he/she received the card in their online banking interface.

Mark it as invalid/stolen/whatever before that.

Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by modoc on Friday November 20, 2015 @02:44PM (#10603365)
This may seem foreign to most people here, but there's still a TON of people who don't do online banking or have an account setup/bookmarked for all their financial institutions online sites.
Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by kuschku on Friday November 20, 2015 @07:06PM (#10604733)
Well, in those cases you can go to the next branch.
Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by simantel on Friday November 20, 2015 @01:07PM (#10602723)
That's changing as of this month. Most banks have already issued new chip cards, which require a PIN. If a merchant is still using the old swipe and sign system, now they'll be liable for any fraudulent transactions if the customer has a chip card.
Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by hollerith on Friday November 20, 2015 @01:29PM (#10602889)
All of the new chip cards in the US I've read about are signature only. It was decided that the US consumer would dislike the added complication of needing to use PIN.

I'd like a chip card that requires a PIN (and that is accepted widely in the US) because such a card would make unauthorized charges less likely after the card is lost or stolen, but was not able to find one.

Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by doppelganger27 on Friday November 20, 2015 @03:12PM (#10603542)
I have a US chip card where I've set a PIN for transaction purposes, so it's not signature only, but it'll still accept both. That said, all of the chip card readers that I've used (few and far between still...) seem to have been configured for signature only, so I haven't been prompted for my PIN yet.
Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by hollerith on Friday November 20, 2015 @05:00PM (#10604147)
Thanks for clarifying. I agree that my "signature only" was inaccurate.
Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by jrockway on Friday November 20, 2015 @01:29PM (#10602888)
The system in the US is not chip-and-PIN, it's chip-and-signature.
Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by hueving on Friday November 20, 2015 @01:49PM (#10603025)
Incorrect. The new cards are chip and signature. No pin involved.
Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by bpicolo on Saturday November 21, 2015 @12:51PM (#10607429)
Debit cards are chip and pin now, granted
Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by caskance on Friday November 20, 2015 @12:43PM (#10602547)
Which is itself horrendous on a different axis.
Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by kuschku on Friday November 20, 2015 @12:48PM (#10602583)
How so? It means you need access to the online account, to the 2FA device, and to both letters to abuse the card.

If the attacker already has access to the online banking account, then he/she can do much worse things anyway.

Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by caskance on Friday November 20, 2015 @12:53PM (#10602625)
Different axis aka not security. The security is much better. But it's slow and inconvenient.
Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by Symbiote on Friday November 20, 2015 @02:52PM (#10603414)
I opened an account at Metro Bank (in London), in a branch. They verified my id, then printed a debit card — this took about 10 minutes — and let me set its initial PIN in the bank.

I don't know if this is now normal in the UK. The previous time I opened an account in-branch was 2004, when the chip card arrived by post a few days later, with the PIN in a separate letter.

Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by kuschku on Friday November 20, 2015 @07:07PM (#10604744)
Similar situation here in Germany – but some banks, as I mentioned, require you to verify online that you received the letters, if you enabled this security feature.

In fact, I’ll go next friday to the bank to get a new debit card, as my existing one stopped working a few months ago.

Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by makomk on Saturday November 21, 2015 @06:32AM (#10606504)
Metro Bank are a newcomer to the market who've focused heavily on streamlining their customer enrolment because of that. I don't think other banks offer this.
Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by kuschku on Friday November 20, 2015 @01:55PM (#10603062)
How is it inconvenient? It’s not like you get a new card every day.

And it only delays the process by 2 days. At maximum.

Re:Introducing the Shift Card: Use Bitcoin where Visa is acc... by caskance on Friday November 20, 2015 @03:28PM (#10603634)
Rare inconvenience may be more easily tolerated, but it is no less inconvenient.

The fact that you can even say "well it's only 2 days delay" seems insane to me.