Ask HN: My bank stores PIN as plain text, should I be worried?

Re:Ask HN: My bank stores PIN as plain text, should I be wor... by elric on Sunday May 09, 2021 @03:59PM (#27099191)

You are taking PIN security too seriously, yes. Your bank doesn't store them in the clear, they store them in an encrypted form, but they are able to decrypt them. There is a huge legacy of old hardware and software in banks. Much of the PIN issue has to do with maintaining backwards compatibility with cards without chips (magnetic strips), and readers that can only read those cards. I've encountered cash machines which didn't prompt for my pin code until after my card had been returned.

Don't sweat it. This is the least of your concerns.

[ Parent | on HN ]

Re:Ask HN: My bank stores PIN as plain text, should I be wor... by MichaelHoste on Sunday May 09, 2021 @04:24PM (#27099401)

Thank you! I didn't know PIN were also used for the magnetic strips (we never use them in Europe, or at least in Belgium).

The legacy software could explain it. But the difference of processes between my main bank (random temporary PIN obtained with 2-factor authentication: postal letter with code to send back using smartphone) and my credit card company (bank card mailed to my address with current PIN) was weirding me out.

[ Parent | on HN ]