1. Wow, great write-up!

Posted at 9:18PM on Nov 3rd 2007 by crapface

2. That was packed so full of information I can barely contain myself. Code? Schematics? Any information at all?
Oh well, at least we can see the pin number.

Posted at 9:20PM on Nov 3rd 2007 by bazginge

3. The article was so weak I had a poke around the server. This is way better than the PIN thing.
http://www.mrg9999.com/pub/PHSB/ report cards
http://www.mrg9999.com/pub/picx/GT-SUIT.JPG amazing suit man ;)

There is much much more in the pub folder. Very entertaining. BTW nice kitchen ;)

Posted at 9:27PM on Nov 3rd 2007 by bazginge

4. Could someone please explain to me what this actually does? as I understand it the circuit to the left grabs a number from a calculator looking thing on the right and sends an SMS message with the number to his cell phone (I think?). I thought pin numbers were only ever assigned once, when you first get the card... so what does this do exactly and what purpose does it serve?

Posted at 10:12PM on Nov 3rd 2007 by twistedsymphony

5. This looks like a two - factor authentication system for use with internet banking. In order to log into his account on the bank website, he must put his card in the Key Generator (calculator type thing), and put in his PIN (two things he has, one thing he knows) and gets from this device a one-time password to enter into the website.

He doesn't want to have to carry around the stupidly huge key generator so he rigged it up so he can contact this device (call it? sms msg it?), and have it SMS him back with the current login key.

Posted at 11:19PM on Nov 3rd 2007 by smilr

6. I have never seen that rolling PIN generator thing before, and im sure others here haven't ither, which is why were all confused. Their like those IT key chain token things i guess. What banks out there use this? I have never seen them before.

Posted at 2:07AM on Nov 4th 2007 by Chupa

7. #6: Barclays is a british bank. This two-factor system is most likely what i've heard referred to as chip and pin system.

Posted at 3:53AM on Nov 4th 2007 by Tavor

8. @#7 - No this is not the chip and pin system. The chip and pin is added security to bank cards that works in conjunction to the magnetic stripe, you have to enter a pin code when buying things instead of signing for your card now. The chip is on the card and the pin is self explanitory. This is a new type of authentication system used for online buisness banking over here in the UK. You use your card and pin on the calculator and it generates a onetime password to log into youronline bank account.

Posted at 5:14AM on Nov 4th 2007 by Alex

9. no, it's not chip and pin - chip is your standard credit/debit card and pin is your ATM pin used in place of a signature

This calculator is used to authenticate you for on line banking, scary thing is it a) dosent connect to the outside world and b) is not tied to any card (both myself and my wife have one and ot doesn't matter which one we use). So given it knows if your atm pin is correct or not , the pin *must* be stored on the card :( Lets hope it's encrypted !

Posted at 5:14AM on Nov 4th 2007 by sal_park

10. It's Barclays (a UK bank) PINsentry. You can see a demo of it in use here:
http://www.barclays.co.uk/pinsentry/demo_login.html

It is NOT chip and PIN. The PINsentry (or card) also does not know your pin. It is simple a challenge and response system. Even if you enter an incorrect PIN, you still get a repsonse (but different to if a correct PIN is entered) and it's down to the bank to decide if the response is correct, or not.

Posted at 7:41AM on Nov 4th 2007 by xMov

11. Very interesting trick right there... I'm wondering where such SMS boards would be found, I'd have a bunch of utilities for it :)

Posted at 10:00AM on Nov 4th 2007 by Tolly

12. i would assume the little calculator thing has a RTC in it and generates the pin based on the time along with a unique code on the card. Same thing server side so the system knows what code to expect at any given time. Yes/No?

Posted at 12:27PM on Nov 4th 2007 by Chupa

13. to #10:

According to the manual that comes with the pinsentry if you enter 3 wrong pin codes it will lock the device. What makes you think it will accept any pin ?

Posted at 12:41PM on Nov 4th 2007 by sal_park

14. this is awfull..
i have a device like this, which looks like this:

https://bankieren.rabobank.nl/rabo/dp800.gif

it's small and i take it with me often..
but as soon as i've wanted to take a peek inside, the device locked up.. it's what should happen! these devices should be small and equiped with anti-tamper sensors, not as ugly and unsafe as these..

i still like the hack, but the bank should've made a better device by itself (in the netherlands some banks already send sms with login codes)

Posted at 12:52PM on Nov 4th 2007 by Urlax

15. Is this just to check your balance and perform other banking admin actions? Is this required for purchases as well? It would be really annoying if it were required for purchases...

Posted at 1:09PM on Nov 4th 2007 by Chupa

16. Online stores in the Netherlands can offer iDeal payments (pun probably intended). It's a great system, where you use the chip on the card and a provided code.

With my bank, Abn-Amro, I get an 8-digit code from the Abn-Amro site. I insert my card into the device, enter my PIN (if incorrect, I get a notice. If incorrect for the third time, chip locks up). I enter the 8-digit number and get a 6-digit number back. I enter the 6 digit number on the site, and am authenticated. It's a pretty secure system, as I understand it.

Posted at 3:41PM on Nov 4th 2007 by nebulous

17. Here in Germany, I got a similar device from my bank. But in my case it's not used to login to online banking, instead it is required for every online transaction you want to make. The system started about half a year ago. Before, you had to enter a TAN number for every transaction. Now you have to enter the bank account number, where you want to send the money to, into the device and get back a 6 (or was it 8?) digit number as TAN. It also expires after a few minutes.
But different from the device in this article it does NOT require your card... Maybe it's registered to my card, haven't tried that, yet.

Thanks for the comment before about opening the device what causes it to lock up.. I also already had the idea to take a look inside to find out how it gets the numbers. Think it was good to not really do that :)

Posted at 6:26PM on Nov 4th 2007 by Lars

18. all he is doing is VERRY generaly telling you how to do this i wouldn't call this a hack

Posted at 9:54PM on Nov 4th 2007 by alex mccown

19. its not supposed to be practical.

its not even supposed to be elegant.

its a HACK folks....Some dude took a calculator and a handfull of components and built something you didnt even think of----using parts never intended to be used in such a way, to create an entirely new and different machine; unique from any other in the world. Its a HACK proper, regardless of how convenient it is for you to carry to the grocery store.

Having said that.....some schematics would be nice. a diagram or a napkin with some scribble or something?---not that I would do anything with it but read it as I probably wont ever build one.....doubt I will even have a need for one.....thats not really the point though.

Maybe instead of bitchin we should all offer our support and send Will some hacks we all know and love but have yet to see on HAD.....maybe lighten his stress load for the next week? Will, I am sending you my top picks for as-yet un-featured hacks (good ones with writeups and all....) right after I post this....

I encourage you all to do the same.

Posted at 10:19PM on Nov 5th 2007 by frognall

20. Some clarification
All I have done is interface my banking authentication device to a SMS controller(modified). so that I don't have to carry the damm thing around. It is like not having to carry one's RSA token(which incidentally I have also remoted).

SMS controller
http://www.jaycar.com.au/productView.asp?ID=KC5400

Posted at 5:41PM on Nov 14th 2007 by Mr.G