For me the lesson is not something that happened years ago, but that all to often a system that “ought” to work is handcapped by not accepting it cannot work as stated - there just was not enough computing power to send PINS to a central computer to verify and lookup, so you store the pin on the card. Then you don’t salt it with the account number, you just encrypt my pin with the same key as your pin. And both encrypted values are in the open. Swap my pin onto your stripe and I then can withdraw from your account.
The fix? Not sure. I think there is a lot more to the story than I know - but the problem is I’m not sure anyone knows
And using it “in the public interest”
Is just bollocks
I think this is why OSS matters - if this scheme was published no-one would have trusted it. And queues at banks would have got longer.
Would that matter?
bediger4000•3mo ago
Not in this case - an entire bank's IT department was in on the magic ATM cards.
lifeisstillgood•3mo ago
The fix? Not sure. I think there is a lot more to the story than I know - but the problem is I’m not sure anyone knows
And using it “in the public interest” Is just bollocks
I think this is why OSS matters - if this scheme was published no-one would have trusted it. And queues at banks would have got longer.
Would that matter?
bediger4000•3mo ago