News for hackers. Stuff that matters.

A comment on The Big Hack: How China Used a Tiny Chip to Infiltrate Amazon and Apple. Parent comment

Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by lmilcin on Thursday October 04, 2018 @10:15AM (#18140051)
That's not correct.

HSMs are required so that the company does not need to have PIN codes exposed anywhere. Not having PINs or full credit card data makes your life easier as there is nothing to steal from you in the first place.

If your company stored PIN codes it means you were in breach of the contract and it had to lie to the auditors to pass the certification.

[ Parent | on HN ]
Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by datavirtue on Thursday October 04, 2018 @12:14PM (#18141211)
It is correct. Incompetence abounds. You are correct about the HSM but it does not enforce anything except for the exchange between whoever and MC. You do realize that pin codes are entered into a UI and phone system as plain text right? There are PCI audits but they are a joke.
[ Parent | on HN ]
Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by lmilcin on Thursday October 04, 2018 @01:39PM (#18141944)
You realize when we talk pins we mean authorizing your credit card chip&pin transaction? Nothing to do with your phone pin or maybe som other pins.

The pin we are talking about is what is customized on your credit card (directly in its memory) or its equivalent in your bank's HSM for the sole purpose of performing CVM step negotiated by yor card and payment terminal.

[ Parent | on HN ]
Re:The Big Hack: How China Used a Tiny Chip to Infiltrate Am... by syn0byte on Thursday October 04, 2018 @11:18AM (#18140662)
"If someone was going to break the law, they would have to lie about it first."

Legit companies don't want the info and anyone that wants the info isn't doing anything legal with it.

[ Parent | on HN ]