Cash machines

[Incognito]

Pins are just 4 digits - encrypting just them is crazy because it is easy to check less than 10k combinations using plain text attack.

What are you on about? The article is on about the Server back in the datacentre where you'd think they'd encrypt the PINs so that nosy admin type doesn't have a quick browse through them.

[Peoplesoft bloke]

For that they're not.

Only people with no brain think they are the answer to anything

[Incognito]

Only people with no brain think they are the answer to anything

Are you not dead yet?

[Peoplesoft bloke]

Are you not dead yet?

No - have a nice weekend.

[Incognito]

No - have a nice weekend.

Same to you. I hope your next poo's a hedgehog.

[Bob Dalek]

Pins are just 4 digits - encrypting just them is crazy because it is easy to check less than 10k combinations using plain text attack.

How would that work? 3 incorrect attempts and strike-out, surely?

[Peoplesoft bloke]

Same to you. I hope your next poo's a hedgehog.

Charmed I'm sure

[bored]

How would that work? 3 incorrect attempts and strike-out, surely?

AtW's idea is to try and encrypt each of 4 digit numbers until the encrypted text matches the intercept. However, if the ATM adds some random data before encrypting the PIN (it should), then such attack won't work.

/geek_mode off

[Paddy]

Surely the transaction is encrypted though or could someone just tap in and sniff their traffic?

No, it's not encrypted. Nor is the Visa and Mastercard interbank system.

[Paddy]

Pins are just 4 digits - encrypting just them is crazy because it is easy to check less than 10k combinations using plain text attack.

The banks had a choice of 4 or 6 digits, they opted for 4

Your pin number is here... http://www.positiveatheism.org/crt/pin.htm