1
00:00:12,640 --> 00:00:14,700
I thank you.

2
00:00:15,400 --> 00:00:21,740
This will be a technical talk, but it's a technical talk being delivered at DefCon.

3
00:00:22,200 --> 00:00:24,720
So, you take your chances.

4
00:00:26,580 --> 00:00:28,520
Am I close enough?

5
00:00:30,460 --> 00:00:32,240
I don't know.

6
00:00:40,860 --> 00:00:42,860
I think it works.

7
00:00:43,340 --> 00:00:44,800
Does it work?

8
00:00:45,500 --> 00:00:47,100
Great, okay.

9
00:00:47,100 --> 00:00:54,280
What I said was, this will be a technical talk, but it is a technical talk at DefCon.

10
00:00:54,720 --> 00:00:58,420
So that makes it a little bit special.

11
00:00:59,500 --> 00:01:04,880
I'm going to talk about the ATM machines.

12
00:01:06,220 --> 00:01:07,880
That's where I get all my money.

13
00:01:07,880 --> 00:01:11,260
I don't know about you, but if I need some money...

14
00:01:11,260 --> 00:01:12,500
Louder?

15
00:01:14,360 --> 00:01:17,260
I think, well, okay.

16
00:01:22,740 --> 00:01:28,140
The ATM machines and the ATM system.

17
00:01:28,460 --> 00:01:30,880
I'll be talking about vulnerabilities.

18
00:01:30,880 --> 00:01:32,940
Now, this is going to be good.

19
00:01:32,940 --> 00:01:34,140
Pay attention.

20
00:01:35,700 --> 00:01:40,540
I'm going to tell you how to avoid being cheated by the ATM system.

21
00:01:40,540 --> 00:01:44,180
People lose an amount of money that you just wouldn't believe.

22
00:01:44,180 --> 00:01:46,500
It isn't just millions per year.

23
00:01:46,500 --> 00:01:47,900
It's more than that.

24
00:01:49,460 --> 00:01:54,180
I don't have an accurate figure, but then I'm not a bank, so I don't care much.

25
00:01:56,820 --> 00:01:59,760
Of course, the other banks don't care much either.

26
00:02:01,120 --> 00:02:03,140
Now, here I am.

27
00:02:03,240 --> 00:02:07,320
I'm standing in front of one of these here ATM machines.

28
00:02:08,800 --> 00:02:11,920
And, louder again, oh Lord.

29
00:02:14,240 --> 00:02:16,720
Well, okay.

30
00:02:16,720 --> 00:02:24,400
I'm standing at an ATM machine in the little town of Kirkenes, Norway.

31
00:02:25,140 --> 00:02:32,180
Now, most of you have probably never heard of Kirkenes, but it is the furthest north city in the world.

32
00:02:33,000 --> 00:02:40,080
It is an amount above the Arctic Circle that I just don't even know.

33
00:02:40,740 --> 00:02:42,660
A story about Kirkenes.

34
00:02:43,420 --> 00:02:50,080
It's hard to get any sleep there because if you visit in June, the sun never goes down.

35
00:02:50,540 --> 00:02:57,380
Well, around midnight, I was walking around the town and talking louder and louder and louder.

36
00:02:57,380 --> 00:03:05,740
I was talking to a lady who I suppose lived there, and I asked her, what country is this?

37
00:03:06,300 --> 00:03:08,220
And she said, well, I'm not sure.

38
00:03:10,220 --> 00:03:14,820
And went on to say, well, Norway plows the snow.

39
00:03:14,820 --> 00:03:16,680
Does that answer your question?

40
00:03:16,780 --> 00:03:20,080
Well, partly it did, and partly it did not.

41
00:03:20,280 --> 00:03:40,920
But the point is that I wanted some money, and I went to an ATM machine in this, not God forsaken, that wouldn't be right to say that, but a little town in extreme northern Norway, not very far from North Cape.

42
00:03:41,000 --> 00:03:47,540
North Cape, in fact, is the furthest north land in Europe.

43
00:03:49,080 --> 00:03:51,040
I wanted some money.

44
00:03:51,200 --> 00:03:53,450
Okay, so I go up to... yeah, hey.

45
00:03:54,600 --> 00:03:59,470
You've got to continually, during this, remember Willie Sutton.

46
00:03:59,470 --> 00:04:04,310
Willie Sutton was asked, why do you rob banks?

47
00:04:05,370 --> 00:04:07,010
And you know the answer.

48
00:04:07,010 --> 00:04:08,390
Because it's there!

49
00:04:08,590 --> 00:04:10,670
Yeah, you got it.

50
00:04:11,770 --> 00:04:24,310
Well , that's changed a little bit, and I'm talking about the slightly changed arrangements nowadays, in that it's not any longer really true that the money is in the bank.

51
00:04:24,310 --> 00:04:27,270
The money is actually in the ATM machine.

52
00:04:27,270 --> 00:04:44,610
And if you go up to a bank on Friday afternoon before a three-day weekend, you will find that the ATM machines at the bank have a lot more money than the bank had at any time during the week.

53
00:04:44,730 --> 00:04:47,970
The amounts tend to be really enormous.

54
00:04:48,490 --> 00:04:56,610
For a three-day weekend, having $10,000 in the ATM machine is simply not enough at most banks.

55
00:04:57,650 --> 00:05:03,410
Okay, so what I do is, I stick a card into the ATM machine.

56
00:05:03,570 --> 00:05:05,030
And this is a card...

57
00:05:06,110 --> 00:05:07,790
You're going to say it louder.

58
00:05:12,020 --> 00:05:13,940
I may need help.

59
00:05:15,400 --> 00:05:18,800
I'll appeal for help if this gets much worse.

60
00:05:19,320 --> 00:05:21,820
So I stick a card in the machine.

61
00:05:21,820 --> 00:05:27,820
And this is a card that was issued to me by my own bank somewhere in central New Hampshire.

62
00:05:27,820 --> 00:05:36,780
Now the connection between extreme northern Norway and central New Hampshire is not particularly obvious.

63
00:05:37,380 --> 00:05:41,760
They are distant from almost any point of view that you take.

64
00:05:44,180 --> 00:05:48,720
The card that I was issued has a magnetic stripe on the back.

65
00:05:48,720 --> 00:06:05,500
And as it turns out, what's in that magnetic stripe is simply an address for the bank and some other information about the bank and the account associated with that card.

66
00:06:07,900 --> 00:06:10,800
That's on that magnetic stripe on the back.

67
00:06:10,800 --> 00:06:19,160
Which you ought to learn more about from somebody else because there are some real problems associated with these stripes on the backs of cards.

68
00:06:19,380 --> 00:06:25,220
The machine then asks me for a pin and asks me how much money do I want.

69
00:06:25,860 --> 00:06:31,000
Hey, being a fairly honest guy, I'll tell them I want a reasonable amount of money.

70
00:06:31,420 --> 00:06:35,020
If I was different, I would say, well, just give me all of it.

71
00:06:36,100 --> 00:06:37,720
Some people do that.

72
00:06:41,560 --> 00:06:50,380
Now, the machine, after it's got the pin, gurgles for a while.

73
00:06:50,380 --> 00:07:02,140
And then in a surprisingly short period of time, usually of the order of 10, 20, 30 seconds at most, delivers the money to me.

74
00:07:02,740 --> 00:07:09,960
Since I was in Norway, of course it delivers Norwegian kroner, whatever a kroner is.

75
00:07:11,900 --> 00:07:16,580
I suppose in English it would be called a crown, but it's not that big a deal.

76
00:07:18,380 --> 00:07:36,760
So after I put my card in the machine, type in the four-digit pin, I walk away and the machine is now happy and the transaction is completed after it delivered me my money.

77
00:07:36,760 --> 00:07:58,200
Now, one question I have is that in this whole transaction, where I inserted a card into the machine, typed in a pin, and undoubtedly there were messages going back and forth between various banks and things of that sort, a real question is, what happened?

78
00:07:58,520 --> 00:08:04,380
And to some degree, I'm going to leave that as a homework exercise for you, it's not easy.

79
00:08:04,380 --> 00:08:20,520
A surprising amount of attention has to be paid to actually who knew what at the beginning of this process and what they found out, what information they sent and what information they received.

80
00:08:20,700 --> 00:08:24,300
Which I'll sum up by saying, what happened?

81
00:08:24,300 --> 00:08:26,920
It is not particularly easy.

82
00:08:26,920 --> 00:08:39,740
In fact, obviously the bank in extreme northern Norway never heard of a bank in the boondocks of central New Hampshire.

83
00:08:39,860 --> 00:08:52,340
So somehow or other, messages had to be transferred back and forth between these two entities, which are not, from any other point of view, close to each other in any possible sense.

84
00:08:52,340 --> 00:09:03,820
And so you have to remember that it's not clear with these messages just who is sending it to who and what information is being sent.

85
00:09:03,820 --> 00:09:06,160
That's the thing you have to think about.

86
00:09:06,400 --> 00:09:08,560
And I will help with that.

87
00:09:09,760 --> 00:09:29,740
Now, the parties to this overall transaction are me, that's the guy standing in front of the ATM machine, the bank in Norway that owns the ATM machine and the bank in New Hampshire of which I am a customer.

88
00:09:30,680 --> 00:09:35,700
This is all not supposing, nobody was telling any lies or anything of that sort.

89
00:09:35,700 --> 00:09:37,420
It's all straight stuff.

90
00:09:39,480 --> 00:09:49,240
Now, there are a number of requirements that are particularly obvious as this transaction goes on.

91
00:09:49,720 --> 00:09:57,560
And the parties to this transaction have their own needs that may well not intersect to any degree.

92
00:09:58,080 --> 00:10:10,840
The customer, that's me, wants some money and does not want, obviously, the system to drain his checking account, which is the kind of thing that might happen.

93
00:10:10,840 --> 00:10:13,440
I mean, you guys know about identity theft.

94
00:10:13,560 --> 00:10:26,820
Well, this is the same general kind of thing, differently detailed, but about the same in the general sense that you wind up with a heck of a lot less money and somebody else winds up with a heck of a lot more money.

95
00:10:28,740 --> 00:10:36,700
But the other... so I just want the money and I don't want the system to drain my checking account.

96
00:10:37,060 --> 00:10:43,060
I also probably don't want my PIN to be broadcast all over the world.

97
00:10:43,900 --> 00:10:52,700
The PIN is something I care about and I would prefer to keep that a little bit close to the chest.

98
00:10:53,860 --> 00:10:58,120
The bank in Norway has just distributed

99
00:11:01,520 --> 00:11:11,120
a thousand dollars or so, I'm sorry, a thousand kroner or so, and it wants some assurance that it's going to get back its money.

100
00:11:14,060 --> 00:11:15,660
And that's about it.

101
00:11:15,660 --> 00:11:20,180
I am not a customer of this bank, so it doesn't care about me very much.

102
00:11:20,180 --> 00:11:22,420
It knows that I'm not a customer.

103
00:11:22,700 --> 00:11:27,800
It mostly cares about its own customers, not about me.

104
00:11:29,460 --> 00:11:36,120
The bank in New Hampshire, I am a customer of that bank.

105
00:11:36,120 --> 00:11:43,580
They want to keep me reasonably happy, but they've got some other problems facing them.

106
00:11:43,580 --> 00:11:56,920
They have to make sure that I am really who I say I am and that I've actually got the money in the account to pay this amount out.

107
00:12:00,560 --> 00:12:06,280
So it doesn't want any responsibility, for example, of a customer.

108
00:12:06,280 --> 00:12:12,180
A customer is actually not the person that he claims he is or she.

109
00:12:14,960 --> 00:12:25,300
The bank in Norway simply wants the whole transaction to settle down with it not either gaining or losing any money.

110
00:12:25,300 --> 00:12:38,760
Again, I'm not a customer of that bank, but it mainly wants to make sure that it is someday reimbursed for the money it gave me.

111
00:12:38,760 --> 00:12:47,600
It gave me a thousand something or others, a thousand kroner, and it wants to get that back somehow from the ATM system.

112
00:12:47,600 --> 00:13:01,940
Now the ATM system is a very large, very widespread system that exists all over the world, in fact, and I have used it in quite a few foreign countries, including Norway.

113
00:13:04,860 --> 00:13:06,960
So there are three pieces here.

114
00:13:06,960 --> 00:13:18,920
There's the ATM machine that you're standing in front of, the ATM system that in some sense is worldwide or very nearly worldwide.

115
00:13:19,120 --> 00:13:23,500
I know that it works in almost any European country.

116
00:13:23,860 --> 00:13:25,580
I was in Hungary last week.

117
00:13:25,580 --> 00:13:26,760
I didn't try it there.

118
00:13:26,760 --> 00:13:28,580
I don't know what would have happened.

119
00:13:28,580 --> 00:13:30,580
I guess.

120
00:13:31,440 --> 00:13:38,640
When I was staying in Budapest, I asked, is the hotel air-conditioned?

121
00:13:38,980 --> 00:13:43,400
The answer was, well, it has Hungarian air-conditioning.

122
00:13:44,680 --> 00:13:46,660
Nice place, very pretty place.

123
00:13:46,660 --> 00:13:59,840
It does... and it's not a third world country by any means, but it is not quite up to our standards for high range hotels.

124
00:14:00,800 --> 00:14:02,200
Okay.

125
00:14:07,010 --> 00:14:11,690
We have these parties to the transaction.

126
00:14:11,690 --> 00:14:20,720
Me, the ATM that I'm in front of, the bank that owns the ATM, and then some network that I'm not going to describe.

127
00:14:20,720 --> 00:14:23,140
It would bore you to tears.

128
00:14:23,140 --> 00:14:27,520
It actually connects all this together in a worldwide sense.

129
00:14:28,040 --> 00:14:31,440
And I'll call that just the ATM network.

130
00:14:31,460 --> 00:14:32,600
It is important.

131
00:14:32,600 --> 00:14:44,160
Without that, you wouldn't be able to use the ATM card in a whole lot of places without the ATM network existing.

132
00:14:48,980 --> 00:14:56,860
Well, what does one have to do to make all this work out?

133
00:14:58,560 --> 00:15:19,140
When you type the PIN into the ATM that you're standing near, right behind you, over your right or left shoulder, there is a person who is busily writing down the PIN you typed, which you can easily see over your shoulder.

134
00:15:19,140 --> 00:15:19,800
Fine.

135
00:15:19,800 --> 00:15:22,540
It's called shoulder surfing.

136
00:15:23,460 --> 00:15:32,880
And that is actually a major loss to the financial system because that kind of thing happens much more than you would believe.

137
00:15:32,880 --> 00:15:38,620
It is not just millions of dollars, it is more than millions of dollars.

138
00:15:41,080 --> 00:15:49,480
And that is the first vulnerability I'd like to talk about, and it is a serious vulnerability.

139
00:15:49,880 --> 00:16:02,420
I would advise you when you're at an ATM and about to punch in your PIN, just look over your shoulder, both shoulders, and see who is there copying it down.

140
00:16:03,400 --> 00:16:05,140
This is not unusual.

141
00:16:05,140 --> 00:16:18,760
It has not happened to me, but it has, for example, happened to my wife, where someone managed to see what PIN she was typing in and used it to extract quite a lot of money from the system.

142
00:16:18,760 --> 00:16:32,660
There is normally some limit of the amount that you can get out of ATMs per day, and that limit is designed so that you don't go broke if somebody steals your PIN or your card.

143
00:16:32,660 --> 00:16:35,380
You just get a little bit poorer.

144
00:16:36,400 --> 00:16:40,260
So that is the first vulnerability.

145
00:16:43,100 --> 00:16:44,800
There are others.

146
00:16:46,160 --> 00:16:48,640
I was in... why am I talking about Norway?

147
00:16:48,640 --> 00:16:52,060
Well, because I spent a lot of time in Norway last year.

148
00:16:52,060 --> 00:17:07,460
I walked up to an ATM machine in Bergen, that's in Norway, and I put in my card.

149
00:17:07,640 --> 00:17:09,460
It told me to punch in my PIN.

150
00:17:09,460 --> 00:17:11,120
I punched in the PIN.

151
00:17:11,300 --> 00:17:15,340
It gurgled for a while, and then said, sorry, we can't pay you.

152
00:17:15,880 --> 00:17:16,920
Eh?

153
00:17:17,840 --> 00:17:23,540
It's got all the information on my card, which tells it all about my bank account.

154
00:17:23,540 --> 00:17:29,420
It's got my PIN, and now it tells me it's not going to complete the transaction.

155
00:17:29,420 --> 00:17:55,940
What I did may seem a bit extreme to you, but I called the police, told them, and also pointed out to the bank, which arrived just behind the police, that right near my right hand was a fire axe, and if it didn't give me my card back, I was going to use that fire axe.

156
00:17:57,140 --> 00:18:08,840
Actually, they came in and gave me the card back, and in fact, no money had been withdrawn, so the whole transaction ended just fine.

157
00:18:08,840 --> 00:18:13,760
But still, a fire axe did enter the negotiations.

158
00:18:23,220 --> 00:18:26,640
What does this say?

159
00:18:27,800 --> 00:18:32,600
Why do my notes say, at this point, forklift truck?

160
00:18:32,980 --> 00:18:35,140
Forklift truck?

161
00:18:44,010 --> 00:18:46,690
Give that man a prize.

162
00:18:48,110 --> 00:18:49,790
Definitely.

163
00:18:50,750 --> 00:19:00,810
Forklift truck deserves to be at this point in the presentation, because it is the principal tool for cheating ATM machines.

164
00:19:00,890 --> 00:19:11,890
You slide it in, lift, slide it back, put it in the truck, drive away, and at home, all you need is an acetylene cutting torch, and you have the thing open in 20 minutes.

165
00:19:13,610 --> 00:19:34,990
So, forklift trucks are part of... by the way, I have promised, and I will tell you before the end of this talk, important things you should do and not do when dealing with ATM machines, because I mean to send you away knowing a good deal more about the down-to-earth vulnerabilities of ATM machines.

166
00:19:34,990 --> 00:19:40,430
None of this high-flown theoretical stuff, just things like forklift trucks.

167
00:19:42,550 --> 00:19:46,070
It's important, and people do that.

168
00:19:48,090 --> 00:19:58,870
I can't estimate what the losses are to forklift trucks, but they do exist, and it is

169
00:20:03,310 --> 00:20:08,770
mainly, in fact, an American habit.

170
00:20:08,770 --> 00:20:14,710
I have a slightly different habit, and that is... why am I all of a sudden louder?

171
00:20:14,710 --> 00:20:16,250
Somebody turn me up.

172
00:20:24,020 --> 00:20:35,540
The best deal at this point is you want to get money out of an ATM machine.

173
00:20:35,540 --> 00:20:45,120
You go to eBay, and on eBay you buy an ATM machine.

174
00:20:45,800 --> 00:20:48,780
Hey, they'll sell it to you.

175
00:20:49,400 --> 00:20:52,200
They really are there, and they don't cost very much.

176
00:20:52,200 --> 00:20:57,500
It's actually in the general range of $10,000 for an ATM machine.

177
00:20:57,500 --> 00:21:11,740
Now what you do is you install that ATM machine right over there in some obvious place where people pass by, and the ATM machine is reprogrammed.

178
00:21:11,740 --> 00:21:14,720
It's not a difficult reprogramming job.

179
00:21:14,720 --> 00:21:22,360
When somebody puts their card in, punches it in the pen, it says, sorry, try again tomorrow.

180
00:21:24,120 --> 00:21:27,780
If you don't happen to have a fire axe, you've got a problem.

181
00:21:29,500 --> 00:21:33,160
But that is probably more the British scheme than the U.S.

182
00:21:33,160 --> 00:21:36,200
scheme, though it doesn't matter very much.

183
00:21:38,740 --> 00:21:46,480
So what you have with this scheme is just you have a new machine.

184
00:21:47,280 --> 00:21:57,900
And I would advise you that if you see an ATM in a place where you've never seen one before, don't use it.

185
00:22:01,660 --> 00:22:07,760
Well, again, I'm giving advice, but what can I say?

186
00:22:08,020 --> 00:22:10,380
You want to take a look.

187
00:22:10,380 --> 00:22:20,680
In fact, in the town I live in, several times in the last month, in stores and restaurants that I normally go in, I've seen new ATM machines.

188
00:22:20,700 --> 00:22:23,080
I don't have any reason to believe they're fraudulent.

189
00:22:23,080 --> 00:22:27,480
On the other hand, I also don't have any reason to believe that they're honest.

190
00:22:27,480 --> 00:22:30,020
So I typically do not use them.

191
00:22:32,200 --> 00:22:44,540
So pay some attention to the place that the machine is, and if you run into a machine that you haven't seen before, it would be wise not to use it.

192
00:22:44,540 --> 00:22:56,680
Another problem associated with the whole business of ATM machines, and it includes problems with debit cards and things of that sort also, is banks.

193
00:22:57,080 --> 00:23:03,840
Big deal, honest banks all over the world, but I mainly know it from the U.S.

194
00:23:03,840 --> 00:23:06,360
and U.K.

195
00:23:07,120 --> 00:23:26,800
If you point out to them that they did not give you the money that you deserved, and you've got fraudulent charges on your debit card or checking out through the ATM machine, they will simply lie about what has happened.

196
00:23:26,800 --> 00:23:30,900
There's several famous cases, both in the U.S.

197
00:23:30,900 --> 00:23:59,900
and in the U.K., where it was perfectly clear that the problem was solved by the bank software, and the bank denied that it possibly could happen, and simply said that if the customer is claiming to have lost money through an ATM machine or a debit card,

198
00:23:59,900 --> 00:24:03,480
that the customer is lying.

199
00:24:03,480 --> 00:24:10,520
One of these cases actually came to court and was well defended, and the bank lost very big.

200
00:24:10,520 --> 00:24:21,260
They still try to do that, but they do it with much less success now, because after one big case has gone against them, it makes it more difficult.

201
00:24:21,260 --> 00:24:33,400
What they did in the first case was actually filed a criminal complaint against the person that was complaining about the loss of money in the ATM system.

202
00:24:33,760 --> 00:24:36,360
And that seems a little bit outrageous.

203
00:24:42,670 --> 00:24:48,810
I better finish all this technical stuff so I can give you all this valuable advice that you want.

204
00:24:58,020 --> 00:24:59,620
The way

205
00:25:03,100 --> 00:25:24,600
that the system works, the first thing that happens when you begin an ATM transaction is that the bank associated with the ATM machine you are using sends a message to the bank that issued the ATM.

206
00:25:24,600 --> 00:25:32,740
And there is not much that needs to be said at that point, and in fact, essentially nothing is said.

207
00:25:32,800 --> 00:25:43,520
The message that goes from the ATM machine through the ATM network to the issuing bank simply says, Hello, I've got a message for you.

208
00:25:43,700 --> 00:25:57,940
The response is that the bank dreams up an encryption key and sends that key back to the customer.

209
00:25:58,380 --> 00:26:02,560
This is fairly standard stuff nowadays in cryptography.

210
00:26:02,560 --> 00:26:21,800
There are any number of ways associated with cryptographic schemes where encryption and decryption, one is much more difficult than the other.

211
00:26:22,800 --> 00:26:35,130
So that all you need to do is send one party to send a key to the other, and now transmissions in the other direction become much, much easier.

212
00:26:35,640 --> 00:26:42,140
And this is not only a common but almost universal practice in cryptography nowadays.

213
00:26:49,090 --> 00:26:55,110
Okay, look over your shoulder when you type in the PIN.

214
00:26:55,210 --> 00:26:56,000
Important.

215
00:27:01,130 --> 00:27:12,470
Pay some attention to the place where you see the machine, and if you recognize something as being a new machine, go somewhere else.

216
00:27:21,170 --> 00:27:26,670
A stolen card is not a terribly big deal.

217
00:27:26,670 --> 00:27:41,150
I don't know about you generally, but my bank will only let me withdraw $200 per day through the ATM system, which means that the amount of loss is relatively limited.

218
00:27:41,150 --> 00:27:44,130
I mean, that's annoying, but not absolutely disastrous.

219
00:27:45,730 --> 00:28:03,930
Another piece of advice, though, is the ATM machines, mostly after they give you your money and that kind of good stuff, and give you your card back, one hopes, give you information in the form of a receipt.

220
00:28:04,130 --> 00:28:10,090
The receipt talking about what the account was, what the amount was, what the date was, things of that sort.

221
00:28:10,090 --> 00:28:18,590
And my advice about that piece of paper, that receipt, is don't leave it next to the machine.

222
00:28:18,590 --> 00:28:20,290
Don't simply drop it.

223
00:28:20,710 --> 00:28:21,530
Take it with you.

224
00:28:21,530 --> 00:28:23,830
Take it away from the machine, take it with you.

225
00:28:23,830 --> 00:28:36,290
Because that plus the four-digit key, which the same guy has just read over your shoulder, is enough for him to drain a good deal of money out of your account.

226
00:28:36,290 --> 00:28:43,190
So, when and if a receipt appears, take it with you, don't leave it at the machine.

227
00:28:43,670 --> 00:28:51,210
And that makes it much more difficult and much more inconvenient for anyone to drain the account.

228
00:28:54,390 --> 00:29:00,570
The other advice is, I assume that some of you are going to need money in the next few days.

229
00:29:00,570 --> 00:29:02,310
Yeah, almost certainly.

230
00:29:02,810 --> 00:29:12,610
I recommend that when you want money, tomorrow and the day after, please get it from the ATM machine in the lobby of this hotel.

231
00:29:14,830 --> 00:29:17,230
And I don't need to talk anymore.

232
00:29:17,230 --> 00:29:20,250
Does anyone want to ask any questions?

233
00:29:20,410 --> 00:29:22,230
Or should I talk about something?

234
00:29:22,230 --> 00:29:25,370
I didn't talk at all about cryptography, really.

235
00:29:25,550 --> 00:29:32,150
And one of the reasons is that cryptography does not really come up as a prime problem.

236
00:29:32,370 --> 00:29:36,670
What the prime problem is, in fact, is key distribution.

237
00:29:38,170 --> 00:29:41,470
It's not the algorithm that you use to do the encryption.

238
00:29:41,470 --> 00:29:48,290
It's who's got the key and where did that entity get the key is the problem.

239
00:29:48,290 --> 00:29:50,770
That's work that Scott's been talking about.

240
00:29:50,830 --> 00:29:52,530
And I've run out of data.

241
00:29:52,530 --> 00:29:53,870
Thank you for coming.

242
00:29:54,050 --> 00:29:55,730
Unless there's any questions.

243
00:29:57,050 --> 00:29:58,910
I see no questions.

244
00:29:59,030 --> 00:30:00,270
Have a good day.