News for hackers. Stuff that matters.

A comment on Factors in authentication. Parent comment

Re:Factors in authentication by Lukas_Skywalker on Tuesday January 15, 2019 @12:34PM (#18912997)
I was always under the impression that the microprocessor on the chip should not allow a payment to be processed without the correct PIN. Apparently, based on the behaviour you described, my assumption is very wrong and the authorization is not made offline on the card itself.
[ Parent | on HN ]
Re:Factors in authentication by apenwarr on Tuesday January 15, 2019 @01:04PM (#18913317)
The standard allows for both options (and that switchability has led to security holes in the past[1]). Nowadays I think most of them validate the PIN on the server side rather than on the chip, which is better in some ways.

[1] https://apenwarr.ca/log/20110222

[ Parent | on HN ]