HOWTOFAIL: ENTERCARD

[This is bad, and this is just the beginning of this blog post...]

Update March 29, 2013: SSL config is now at grade A! Congratulations!

Remembercard (brandname) is issued by Entercard, a joint venture between Swedish Swedbank and Barcleys Bank Plc. The irony of a credit card company not having a PCI-DSS compliant website is amazing. The lack of knowledge concerning users' selection of PIN codes is obvious, the lack of proper security for e-mail based marketing is shocking.

I hope this blog post will be read, understood and acted upon properly ASAP by those in charge.


First of all, thank you to name withheld, who sent me the marketing mail received from Remembercard.

Please phish us.

The picture is my screenshot of the HTML formatted mail. It was sent out from isave.no, a marketing firm. The web version of the mail is stored at isave.no as well. All links go through isave.no. No mentions of Entercard using isave.no as an external service provider for marketing e-mail at the websites of either Remembercard or Entercard. 

Banks, financial institutions and credit card companies are generally good at advising people not to click on suspicious links received by e-mail. This e-mail from Remembercard has pretty much every possible options included to make it appear as a phishing attempt, including a tracking-click-through login link using http to https.

There are good reasons why marketing/info/sales staff should work closely with security staff to ensure marketing complies with internal policies and good practices. This was just one of those reasons.

Users' selection of PIN codes.

We know people select easy PIN codes, and existing research documents this. From a sales/marketing perspective promoting same PIN across all your cards form one provider, as well as user selected PINs, is good. People want simplicity, banks & credit card companies want people to spend money.

But there's a line to be drawn here. 

Making such obvious PIN selection examples as those pictured above has a dangerous effect. People use examples, because examples are "good". I wonder if Entercard have even heard the term "keyspace reduction" before?

Remembercard / Entercard should go examine the following links:

A birthday present every eleven wallets? The security of customer-chosen banking PINs (PDF)

Joseph Bonneau, Sören Preibusch and Ross Anderson, University of Cambridge

PIN Analysis, an excellent blog post from DataGenetics.

Take the cucumbers! An analysis of user selected PIN numbers (Youtube)
Howard Smith, Chief Hacking Officer, Oracle Corporation (UK), at Passwords^10

PCI-DSS compliance for websites

These are the minimum requirements for SSL/TLS configuration of a website, as considered by SSLLABS,  to be considered PCI-DSS compliant:

(Thank you @ivanristic), with some more interesting info to read at flyingpenguin.com as well.

Now *THIS* is the SSLLABS result on March 6, 2013, for the login website of Entercard:

[The grade F is clearly visible. Click for the whole truth, and nothing but the truth.]

That is one looong screenshot, sorry about that, but its necessary in this case. Some nice supported cipher suites in there, the irony is absolutely fantastic when their login page says your connection uses secure SSL encryption.

Now in their defence, if I should defend them, would be to say that their website doesn't necessarily handle credit card transactions. On the other hand, I can't see that as an excuse for a near complete lack of good practice security. Shame on you Entercard, period! (Wild guess: there is an outsourcing provider in the background who *really* needs to be audited. Thoroughly this time.)

I sincerely hope & believe Entercard wil take actions ASAP. Others may learn and benefit from this as well.