Re:PIN number analysis
by itcmcgrath on Sunday January 27, 2013 @06:24PM
(#5126157)
I worked at a bank, I did code for generating PINs. I can tell you the urban myth is incorrect. Perhaps a single bank did it, but it sure isn't industry standard.
Re:PIN number analysis
by mynameishere on Sunday January 27, 2013 @09:26PM
(#5126752)
Did you filter out terrible combinations like 1111?
Re:PIN number analysis
by itcmcgrath on Monday January 28, 2013 @12:22PM
(#5129418)
We did some sensible things to prevent non-sensible things. I don't think talking about the secret sauce would be appropriate though.
The fact that you can change it disproves it.
You are both kind of right: http://en.wikipedia.org/wiki/Personal_identification_number#...
If enough people never bother to change their PIN, it might still be worth it.
Yeah, but then you have to make the lookup anyway, to check if they did change it. You might as well just authenticate. Unless the original PIN always works, which is not secure.
I think the changed PIN is stored on your card as an offset. When you enter your pin, both the offset and the code you entered are transmitted, so they always validate agains the original, non changed, PIN.
Re:PIN number analysis
by superuser2 on Sunday January 27, 2013 @08:00PM
(#5126489)
My ATM won't complain about an invalid pin until it actually communicates with the bank, at the very end of the transaction (after choosing checking/savings and the amount).
This way your pin can be verified without needing to call back to the central bank core - the ATM cloud can just move straight on to transactions.
It may save a lot of cash it may be a myth - anyone got details?