🚀 go-pugleaf

In article <1992Sep14.085441.28829@nessie.mcc.ac.uk>, Simon Read writes:
>
> Unfortunately the banks are not interested in security. [project story deleted]

Of course they are, but if they don't loose anything (themselves) they cannot
secure that <nothing>, can they?  :-)   I guess what we need is some legal
case, some really bad publicity (on the behalf of banks) and maybe a law or
two to make this security "worth the cost" for banks. Who should pay the cost,
however, the customers or the owners, that's outside the charter of this group
to discuss.

> The only security a bank customer has is the security of his PIN. The banks do
> say "TREAT THIS CARD LIKE CASH" (from an ATM here); they don't provide advice on
> keeping your PIN safe though. The naivete of Joe Public is immense, as is
> illustrated by password/PIN frauds; but the banks and others must have some duty
> of care surely? Why don't they provide more advice on when to use your PIN and
> when not to? How to prevent the guy behind you in the ATM queue from seeing your
> PIN?

Well, why don't CNN or any other tv station make some feature on the topic?
The naive Joe Public v. the "hear no evil, see no evil, say no evil" banks
should make an interesting show.

(For a good story about a related problem, read Forbes Magazine, Aug. 3, 1992.)


In article <BuL2pH.6s3@visix.com>, Ken Mayer writes:
>
> Face it, no matter how sophisticated you make your authentication
> scheme, if the end user doesn't know how to take adavantage of it,
> they're going to get ripped off. You are much better off trying to
> educate them (a lost cause, but far cheaper than technological slight
> of hand), in hopes that someone learns something.

That's maybe a related problem to the above. John Doe doesn't understand
how "open" the system is today, and there's a limit to how advanced the
systems can be before he's unable to use them.


Btw., can anybody out there give one or two really good reasons for using
only 4 digit PINs? Why do all these cards have 4 digit PINs? Even my one
time password cards use a 4 digit PIN. (Ok, I wouldn't feel much safer
with a 6 digit PIN. Maybe there's some logic there after all - at least
the public isn't fooled into believing that a longer PIN would be safer.)

---
Haakon Styri				*** std. disclaimer applies  ***
Norwegian Telecom Research