Content deleted Content added
Added newly-uploaded image |
merged some details from PINsentry article |
||
Line 1:
[[Image:nationwide-CAP-reader.jpg|thumb|right|A CAP reader]]
The '''Chip Authentication Program''' (CAP) is a [[MasterCard]] and [[Visa (company)|Visa]] initiative and technical specification for using [[EMV]] banking [[smartcards]] for [[authentication|authenticating]] users and transactions in online and telephone banking. The CAP specification defines a handheld device ("CAP reader") with a smartcard slot, a decimal keypad, and a display capable of displaying at least 12 characters (e.g., [[starburst display]]). Banking customers who have been issued a CAP reader by their bank can insert their [[Chip and PIN]] ([[EMV]]) card into the CAP reader in order to participate in one of several supported [[authentication protocol]]s. CAP is a form of [[two-factor authentication]] as both a smartcard and a valid PIN must be present for a transaction to succeed. Banks hope that the system will reduce the risk of unsuspecting customers entering their details into fraudulent websites after reading ‘[[phishing]]’ emails.<ref>http://www.theregister.co.uk/2007/04/18/pinsentry/</ref>
==Operating principle==
Line 15:
In the identify mode, the response depends only on the transaction counter value. In the response mode, it depends in addition on the entered challenge, and in signing mode it also depends on the entered transaction details.
Since normal EMV transactions are used by the CAP reader, its use will be limited by the PIN retry counter built into the card. Just like at an ATM, entering an incorrect PIN three times in a row into a CAP reader will block the card.
==Users==
[[Image:pinsentry.jpg|right|thumb|The Barclay PINsentry CAP device]]
*[[APACS]] has defined a subset of the CAP specification for use by banks in the United Kingdom.
*[[Barclays Bank]] began issuing CAP readers (which they call "PINsentry") to selected online-banking customers in the United Kingdom in 2007.<ref>{{cite web|url=http://www.barclays.co.uk/pinsentry/ | title=Barclays PINsentry}}</ref><ref>[http://www.theregister.co.uk/2006/08/09/barclays_launches_cardreaders/ Barclays to launch two-factor authentication], The Register, 2006-08-09.</ref> The 2008 version of the PINsentry device is powered by four [[LR44]] [[button cell]] batteries, which the manual claims will last from five to seven years. The first PINsentry readers used recorded audio to guide the user when using the device, whereas the devices issued in 2008 simply use on-screen instructions.
* Swedish bank [[Nordea]] began using CAP in December 2007.
*[[Canadian]] banks starting [[2008]] (referred to as Chip Technology).
| |||