Pins on Cards - Re: [LINK] City launches fingerprint payment program

[Adam Todd]

At 09:33 PM 15/10/2007, Rick Welykochy wrote:
Coincidentally I picked up my chip-enabled credit card today from
>my bank.
>
>I asked numerous questions of the staff about security and privacy
>regarding the data stored on the chip, but no real answers were
>forthcoming. They just didn't seem to know.
>
>The new credit card provides two modes of authentication:
>
>1. my PIN is encoded on the magnetic strip, as always

Actually the PIN is not recorded on the Mag Strip.  When you enter 
your pin the card number and your encrypted (at the keypad on the 
EFTPOS machine) PIN are sent HOST POSITIVE to the clearance service 
which then sends the data to you bank, and the bank replies with "yes" or "no"

You can read that mag strip as much as you like!  All you'll get is 
the Card Holders Name, the Card Number, the Expiry Date.  Dats about it :)


>2. my PIN and other data are encrypted in the chip.

I'd be VERY surprised if this is the case.  Might as well print the 
pin on the card!