[nffc]

Originally Posted by Chris T

A symptom of 'Agenda Journalism', which is something we suffer a lot of in this country. You choose your standpoint on an issue, then go and compile a report that supports it, while glossing over (or ignoring entirely) anything that doesn't.

I saw the edition of Tonight with lots of journalists and the odd cameo by Trevor McDonald in question, and I was appalled by the shoddy standard of journalism. The woman being interviewed was pointing out that the so-called deficiencies of Chip and Pin are actually deficiences in the old swipe-and-sign system that has to run in parallel during the changeover phase, but the hack was clearly only interested in pursuing the pre-agreed editorial line, that 'this chip and pin thing isn't all it's cracked up to be'.

Bizarrely, they backed all this up by demonstrating how easy it is to clone a card, not by copying the chip but by *swiping* it. The logical fallacy in question here is, I believe, the Straw Man.

But that is the point.

The woman was saying that there were no deficiencies in the new C+P cards- which, as they have the strip still, are prone to the same problems as non-C+P cards in that all the data may very well be encrypted on the chip, but it's still on the bleeding strip! Add into that the banks since rolling out C+P cards are shifting their fraud liabilities onto the consumer more, whilst the deficiencies are still there, it's just wrong, which was the point of the programme.

The swiping was to prove that they could still copy out all the details from a C+P card - and use it in an ATM - which bypasses the need to have the chip on there, and saying that the card as an entity was still vulnerable- which of course is true.

There is no doubt C+P is safer than the strips providing the latter is removed. But since stores are still swiping and haven't moved over yet, and to provide legacy support [how long have floppy drives been superfluously in PCs?] to other customers where C+P is not used, they're going to have keep the stripes to for some time it seems. Which means that the problem is still going to exist and the banks seem oblivious to that fact- which is the point I was trying to make and I think, what the programme was trying to say.

It's encouraging to see that some stores are now making ID checks on people who have C+P but would rather sign. That's encouraging but it won't solve the problem.

I also thought the programme glossed over one of the more serious reservations of C+P- that being, someone "shoulder surfing" and then stealing the card. At least, when you signed [most of the time] stores would look on the back and see if the signature's the same- and if it's not, they'd seem suspicious. So if someone tried to forge your signature if they could it would be a problem but if they failed then they'd be stopped... but, if someone knows your PIN and then takes the card on a spending spree with no further checks they have a free rein to spend. And the risks especially with the design of some of the readers and ATMs are high if the motivation exists. Of course you could stop the card but maybe, the damage has already been done by that point... I usually try and cover up my hand when I'm typing the PIN, like with my other hand, coats, or something.