Re: Most People don't Think about Security

: Have a look at Ross Anderson's paper ``Why Cryptosystems Fail'' from
: the Fairfax conference.  He points out that one reason U.S. banks use
: better security for their ATM cards than do U.K. banks is a difference
: in the law:  in the U.S., the banks are (generally) liable for disputed
: charges.  Again -- if you pay for failures, you worry about the security.

I dunno where you got that idea.  We don't have better security at all,
we have banks that are better at covering up ATM abuse with the help of
our enlightened Government and the courts.  They've never once admitted
that ATM fraud can occur without the card owner voluntarily disclosing
his pin.  The last guy to try to take them to court on it got arrested
himself and found guilty of trying to defraud the bank for the return
of his lost money!

Theoretically UK banks may be liable - I've never heard that - but I
know that in practice for certain they do *not* pay out in cases of
ATM fraud.  They have a consistent policy of blaming it on the
customer.  And they get away with it.

G
PS What UK *does* do that the US is abysmal at is checking the 
signatures on VISA cards et al.  I'm staggered by how lax US shopkeepers
are about looking at the signature.  No wonder fraud is rampant.
Over here they not only *always* without exception check the
signature, they often query it online and occassionally *sniff*
the cards to see if an old signature has been removed with lighter
fluid...

According to Graham Toal:

> PS What UK *does* do that the US is abysmal at is checking the 
> signatures on VISA cards et al.  I'm staggered by how lax US shopkeepers
> are about looking at the signature.  No wonder fraud is rampant.
> Over here they not only *always* without exception check the
> signature, they often query it online and occassionally *sniff*
> the cards to see if an old signature has been removed with lighter
> fluid...

Ah, but the UK is starting to catch up with the US even in this. Over the
last couple of years I've noticed an increasing number of merchants who
skip the signature check for small purchases; on a couple of occasions 
recently I've even had my card returned to me BEFORE I'd signed the sales 
voucher (exactly like the normal US practice). Each time I've been tempted 
to use an "alternative" signature just to see what the response was, but lost
my nerve at the last moment. It'd be interesting to find out who's liable
for a debt incurred by Mickey Mouse on my account...

Paul (who lurks no more).

-- 
pak@chaser.co.uk(Paul Kathro)   Chase Research PLC, Chase House, Cedarwood,
voice     : +44 256 52260       Chineham Business Park, Basingstoke,
facsimile : +44 256 810159	Hampshire, RG24 8WD, United Kingdom.

> Over the
> last couple of years I've noticed an increasing number of merchants who
> skip the signature check for small purchases; on a couple of occasions 
> recently I've even had my card returned to me BEFORE I'd signed the sales 
> voucher (exactly like the normal US practice). 
> Paul (who lurks no more).

   I worked a few years in a pharmacy (credentials established) and so
noticed that most customers will take it as a personal affront if anything
more than this cursory attention is paid to their credit card. It's a
North American phenomenon I can attest to, though whether it's much
different from European attitudes I cannot judge until I work retail
on the other side of the pond. (Read, hopefully never. Retail, that is. I
would like to work in Europe at some point. But I'd rather not be selling
Aspirin.)
   We had a few incidents with credit cards at the pharmacy, and would
generally be very pedantic about calling in anything over $75CAN (which is
<weeping as he considers the current exchange rate> about $60US) for
certification. When I first got there (about five years ago, now) there
were large, thousand-page flyers from the companies listing numbers of
stolen cards. I'm not sure if we were actually expected to stand there in
front of a customer and check in the book -- the circulars didn't last
long and were soon replaced by the more commonly used 1-800 number.
   Out of some interest, what do the "swipe" card verification systems
do? How much information do they read from the card and pass down the
telephone line? How much information would a tap of such a transmission
reveal?

Richard Martin.
<climbing back down into the little hole I've been occupying>

--
rmartin@alias.com - a228mart@cdf.toronto.edu - martinrd@gpu.utcc.toronto.edu
University of Toronto ChemPhysCompSci 9T7, Shad Valley Waterloo 1992 [svp942]

The credit card swipers send the entire transaction in for both
approval and reporting.  I'd imagine that the account number, merchant
number, and transaction amount are all there, since that's all needed.
Whether or not they encrypt the data I don't know.