Slashdot Mirror
Graphics Programs Uncover Secret PINs
Errtu76 writes "The BBC is running a story stating that, among other programs, The Gimp and Photoshop have been identified as possible tools for uncovering PINs via the mail." From the article: "The researchers collected lots of so-called Pin mailers and then tested how secure they were. Many were defeated using bright lights shone at an angle on to the paper. Other Pins could be read by scanning the letter and then adjusting some of the image qualities in popular programs such as GIMP, Adobe Photoshop and Paintshop Pro."
Hopefully though, this discovery will further bring to light all the lax security that companies that control our personal information have. It would be nice to see data brokers and banks start to care about security a little more.
And the fact that if your info gets out and someone exploits it, it is such a hassle to clear your good name/credit.
That being said- locks only keep honest men out... In the military locks are known as "delaying devices"
If someone wants your info, and are willing to break out the scanner and start graphics manipulation to get it, well, they are likely to get it. But wouldn't it just be easier to hit strangers about the head with a sock of nickels and take their cash?
And All I Ask is a Tall Ship And a Star to Steer Her By
If someone owned a convience store, wouldn't it be possible to scan the un-scratched tickets looking for the "big winner" without having to pay for them all?
The existing patterned ink method was adopted because of cost, but really, tacking some mylar onto the form would be cheaper than tacking those thick plastic fake credit cards into those credit offers they flood you with. Yeah, I know: marketing budget can afford fake credit cards but the operations budget can't afford mylar for security.
[
I can see them taking the same attitude towards PINs. Any abuse must be the customer's fault, since no one else could have known the PIN.
Mea navis aericumbens anguillis abundat
They were able to see through the enveloppe obfuscation using a slide projector as a bright light (and undoubtely a fair number of aspirins).
Perhaps they could intercept your mail, obtain your PIN, place the letter back in your mailbox (so you have no reason to be on your guard or change your PIN), follow you carefully into town, steal your wallet (maybe without you knowing, but a simple mugging would do) ...
Far fetched? Depends on whether this little security hole becomes well known in the wrong circles. Also, where I work the same kind of system is use to protect wage-slips - which have employee payroll numbers, bank details, social security numbers etc. on, so there is potentially a broader problem here. Think I might have a word with my manager....
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
I just discovered that duster cans (those little cans that blow dust out of your keyboard) when turned upsidedown will blow coolant.
Aim this coolant at a sealed envelope and it makes the paper transparent.
meh
Well, I'm going to opt to mod myself down a bit on that one. Always a good idea to RTFA before posting, heh. Apparently these pins are for ATMs, and thus, pretty much makes (most of) my above post irrelevant.
I was thinking of the security pin located on the back of most credit cards.
In this case, then, I'm in full agreement with the parent of my original post, though this is something that should be fixed... possibly through online pin activation:
Mail someone a temporary pin they have to enter online to get a one time view of the real pin. After the first view, no other views allowed. Thus, you really wouldn't even need that much initial security in the mailing, as no two people could view the pin, and if a second view was attempted, the issuer could be alerted to potential fraud.
I8-D