# Where's my PIN number stored?

**URL:** <https://boards.straightdope.com/t/wheres-my-pin-number-stored/411623>\
**Category:** Factual Questions\
**Created:** [July 13, 2007, 9:45am UTC](https://boards.straightdope.com/t/wheres-my-pin-number-stored/411623 "2007-07-13T09:45:29Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![essell](https://avatars.discourse-cdn.com/v4/letter/e/34f0e0/32.png) [@essell](https://boards.straightdope.com/u/essell)\
**Post date:** [July 13, 2007, 11:18am UTC](https://boards.straightdope.com/t/wheres-my-pin-number-stored/411623/21 "2007-07-13T11:18:49Z")

</div>

Given that:

The bank can send me an unencrypted pin if I forget it **without generating a new one** clearly they have some record stored on their end.

**But**

I think chip&pin has changed the rules a little because the PDQ machine in my shop checks the pin _before_ it dials the bank. So it must be stored in the chip atleast. I was wondering if that was a recent change or is the magnetic cards have always had the pin inside them too.

The answer seems to the ever present: **It Depends**. I expected a little more unity from international organisations like banks though especially on something so fraud-related as pin numbers!

I humbly apologise for the obvious error in the title. Very sorry **danceswithcats** and anyone else who I upset

---

<div class="post-metadata">

**Author:** ![Ximenean](https://avatars.discourse-cdn.com/v4/letter/x/aca169/32.png) [@Ximenean](https://boards.straightdope.com/u/Ximenean)\
**Post date:** [July 13, 2007, 11:30am UTC](https://boards.straightdope.com/t/wheres-my-pin-number-stored/411623/22 "2007-07-13T11:30:45Z")

</div>

When you say that the PIN must be stored on the chip, do you mean the PIN in unencrypted form? Because I don’t see why. The machine could perform the hash on the PIN + other details, and compare that to what is stored on the chip.

---

<div class="post-metadata">

**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\
**Post date:** [July 13, 2007, 11:44am UTC](https://boards.straightdope.com/t/wheres-my-pin-number-stored/411623/23 "2007-07-13T11:44:01Z")

</div>

[QUOTE=Usram]  
When you say that the PIN must be stored on the chip, do you mean the PIN in unencrypted form? Because I don’t see why. The machine could perform the hash on the PIN + other details, and compare that to what is stored on the chip.  
[/QUOTE]

Even if it’s hashed, it’s only four digits - brute force attacks would find it quickly, wouldn’t they?

---

<div class="post-metadata">

**Author:** ![Ximenean](https://avatars.discourse-cdn.com/v4/letter/x/aca169/32.png) [@Ximenean](https://boards.straightdope.com/u/Ximenean)\
**Post date:** [July 13, 2007, 12:12pm UTC](https://boards.straightdope.com/t/wheres-my-pin-number-stored/411623/24 "2007-07-13T12:12:42Z")

</div>

Not if you add some pre-calculated random bits (“salt”) before hashing.

---

<div class="post-metadata">

**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\
**Post date:** [July 13, 2007, 12:28pm UTC](https://boards.straightdope.com/t/wheres-my-pin-number-stored/411623/25 "2007-07-13T12:28:15Z")

</div>

How do you prevent the salting value from being discovered?

---

<div class="post-metadata">

**Author:** ![Ximenean](https://avatars.discourse-cdn.com/v4/letter/x/aca169/32.png) [@Ximenean](https://boards.straightdope.com/u/Ximenean)\
**Post date:** [July 13, 2007, 12:35pm UTC](https://boards.straightdope.com/t/wheres-my-pin-number-stored/411623/26 "2007-07-13T12:35:11Z")

</div>

You can’t, but you can make it harder, e.g. by storing on the chip in obfuscated form. I know what you’re thinking - “security by obscurity isn’t security”.

[Previous page](https://boards.straightdope.com/t/wheres-my-pin-number-stored/411623.md?page=1)