Chip and PIN Cards More Secure Than Swipe Cards, Also Pretty Awful
To our U.S. readers, paying with a credit card means swiping a magnetic strip. But for people in much of Europe and other countries, it means inserting your chip card into a reader and entering your PIN. This so-called chip and PIN solution has long been touted as far superior to the American swipe, and in most ways it is. But there are some serious issues with how the scheme has been implemented.
Ross Anderson laid out his team's history of investigating chip and PIN cards at Black Hat this year. For a system designed to be harder to cheat, Anderson had a surprising amount to say.
A quick refresher on chip and PIN: consumers insert their cards when making purchases. They then enter their PIN, which is confirmed by the card on the device--when it works, the PIN should never leave the reader. The card then talks with the bank to authroize the transaction, and the sale is made. On paper, it all sounds great.
