Sumber: Wikipedia, the free encyclopedia
A personal identification number (PIN, pronounced "pin"; often redundantly PIN number) is a numeric password
shared between a user and a system, that can be used to authenticate
the user to the system. Typically, the user is required to provide a
non-confidential user identifier or token (the user ID) and a
confidential PIN to gain access to the system. Upon receiving the user
ID and PIN, the system looks up the PIN based upon the user ID and
compares the looked-up PIN with the received PIN. The user is granted
access only when the number entered matches with the number stored in
the system. Hence, despite the name, a PIN does not personally identify the user.[1]
PINs are used with banking systems (where the identifying token is a card), but are also used in other, non-financial systems.
The PIN is not printed or embedded on the card but is manually entered by the cardholder during automated teller machine (ATM) and point of sale (POS) transactions (such as those that comply with EMV), and in card not present transactions, such as over the Internet or for phone banking.
PINs may also be used in contexts other than ATM or POS transactions, such as door access, Internet transactions, or to log in to a restricted website. In such cases, the PIN may simply be a password, and not necessarily associated with a specific card.
In banking systems, PIN management and security are governed by international standard [[ISO 956 4]].
History
The PIN originated with the introduction of the ATM in 1967, as an
efficient way for banks to dispense cash to their customers. The first
ATM system was that of Barclays in London, in 1967; it accepted cheques with machine-readable encoding, rather than cards, and matched the PIN to the cheque.[2][3][4] In 1972, Lloyds Bank issued the first bank card to feature an information-encoding magnetic strip, using a PIN for security.[5]
In 2006, James Goodfellow, the inventor who patented the first personal identification number, was awarded an OBE in the Queen's Birthday Honours.[6]
PIN length
The inventor of the ATM, John Shepherd-Barron, at first envisioned a six-digit numeric code for customer authentication. His wife however could only remember four digits, which became the most commonly used length.[3]
ISO 9564-1,
the international standard for PIN management and security in retail
banking, allows for PINs from four up to twelve digits, but also notes
that "For usability reasons, an assigned numeric PIN should not exceed six digits in length."[7] Financial PINs are often four-digit numbers, with Switzerland
being a notable exception with six-digit PINs being given by default.
Almost all countries in South East Asia use six-digit pins and have been
since ATMs were introduced. Four-digit pins are unheard of in Malaysia.
PIN validation
There are several main methods of validating PINs. The operations discussed below are usually performed within a hardware security module (HSM).
IBM 3624 method
One of the earliest ATM models was the IBM 3624, which used the IBM method to generate what is termed a natural PIN. The natural PIN is generated by encrypting the primary account number (PAN), using an encryption key generated specifically for the purpose.[8]
This key is sometimes referred to as the PIN generation key (PGK). This
PIN is directly related to the primary account number. To validate the
PIN, the issuing bank regenerates the PIN using the above method, and
compares this with the entered PIN.
Natural PINs can not be user selectable because they are derived from
the PAN. If the card is reissued with a new PAN, a new PIN must be
generated.
Natural PINs allow banks to issue PIN reminder letters as the PIN can be generated.
IBM 3624 + offset method
To allow user selectable PINs it is possible to store a PIN offset
value. The offset is found by subtracting natural PIN from the customer
selected PIN using modulo 10.[9] For example, if the natural PIN is 1234, and the user wishes to have a PIN of 2345, the offset is 1111.
The offset can be stored either on the card track data,[10] or in a database at the card issuer.
To validate the PIN, the issuing bank calculates the natural PIN as
in the above method, then adds the offset and compares this value to the
entered PIN.
PIN security
Financial PINs are often four-digit numbers in the range 0000-9999,
resulting in 10,000 possible numbers. Switzerland issues six-digit PINs
by default.
Some systems set up default PINs and most allow the customer to set
up a PIN or to change the default one, and on some a change of PIN on
first access is mandatory. Customers are usually advised not to set up a
PIN based on their or their spouse's birthdays, on driver license
numbers, consecutive or repetitive numbers, or some other schemes. Some
financial institutions do not give out or permit PINs where all digits
are identical (such as 1111, 2222, ...), consecutive (1234, 2345, …),
numbers that start with one or more zeroes, or the last four digits of
the cardholder's social security number or birth date.[citation needed]
Many PIN verification systems allow three attempts, thereby giving a card thief a putative 0.03% probability
of guessing the correct PIN before the card is blocked. This holds only
if all PINs are equally likely and the attacker has no further
information available, which has not been the case with some of the many
PIN generation and verification algorithms that financial institutions
and ATM manufacturers have used in the past.[12]
Research has been done on commonly used PINs.[13]
The result is that without forethought, a sizable portion of users may
find their PIN vulnerable. "Armed with only four possibilities, hackers
can crack 20% of all PINs. Allow them no more than fifteen numbers, and
they can tap the accounts of more than a quarter of card-holders."[14]
Breakable PINs can worsen with length, to wit:
The problem with guessable PINs surprisingly worsens when customers are forced to use additional digits, moving from about a 25% probability with fifteen numbers to more than 30% (not counting 7-digits with all those phone numbers). In fact, about half of all 9-digit PINs can be reduced to two dozen possibilities, largely because more than 35% of all people use the all too tempting 123456789. As for the remaining 64%, there's a good chance they're using their Social Security Number, which makes them vulnerable. (Social Security Numbers contain their own well-known patterns.)[14]
Implementation flaws
In 2002 two PhD students at Cambridge University, Piotr Zieliński and Mike Bond, discovered a security flaw in the PIN generation system of the IBM 3624, which was duplicated in most later hardware. Known as the decimalization table attack,
the flaw would allow someone who has access to a bank's computer system
to determine the PIN for an ATM card in an average of 15 guesses.[15][16]
Reverse PIN hoax
Main article: ATM SafetyPIN software
Rumours have been in e-mail circulation claiming that in the event of
entering a PIN into an ATM backwards, police will be instantly alerted
as well as money being ordinarily issued as if the PIN had been entered
correctly.[17] The intention of this scheme would be to protect victims of muggings; however, despite the system being proposed for use in some US states,[18][19] there are no ATMs currently[when?] in existence that employ this software.[citation needed]
Mobile phone passcodes
A mobile phone may be PIN protected. If enabled, the PIN (also called a passcode) for GSM mobile phones can be between four and eight digits[20] and is recorded in the SIM card. If such a PIN is entered incorrectly three times, the SIM card is blocked until a personal unblocking code
(PUC or PUK), provided by the service operator, is entered. If the PUC
is entered incorrectly ten times, the SIM card is permanently blocked,
requiring a new SIM card from the mobile carrier service.[citation needed]