Ask HN: Have you ever regretted working on a product?

Re:Ask HN: Have you ever regretted working on a product? by Symbiote on Wednesday November 21, 2018 @03:46AM (#18501120)

I'd met one of those students, they went to my university.

Whoever signed off on the badly designed process is to blame. It should not have been possible for the card reader to verify a PIN. It could easily generate a code with a fake PIN, and leave the banking website to verify that.

It was already known that criminals would escort someone to an ATM when streaking their card, and demand the real PIN was given. This made it a lot easier.

[ Parent | on HN ]

Re:Ask HN: Have you ever regretted working on a product? by Rjevski on Wednesday November 21, 2018 @05:00AM (#18501422)

How would this work for offline transactions? Cards need to be able to verify PINs offline and provide feedback to users & merchants, otherwise someone can type a wrong PIN at an offline terminal (on an airplane, etc) and get away with free stuff because the transaction isn’t valid.

[ Parent | on HN ]

Re:Ask HN: Have you ever regretted working on a product? by Symbiote on Wednesday November 21, 2018 @01:15PM (#18504740)

Good point, but allowing a device given away for free to anyone with a bank account to test a PIN opens up a much bigger risk than limiting it to merchant terminals.

[ Parent | on HN ]

Re:Ask HN: Have you ever regretted working on a product? by icebraining on Wednesday November 21, 2018 @07:06PM (#18507049)

I think you're really overstating the difficulty of acquiring a merchant terminal, which are available at literally any shop or restaurant that accepts cards.

[ Parent | on HN ]

Re:Ask HN: Have you ever regretted working on a product? by Rjevski on Thursday November 22, 2018 @08:25AM (#18509840)

You know the EMV specification is open and anyone could write software to check a PIN using a standard smartcard reader (10$ on Amazon), right?

[ Parent | on HN ]