> MOICA estimates that approximately 10000 cards were deployed in non-FIPS mode as a result of "human error".<p>While it's bit silly that the so called secure cards can be configured into non-secure modes, I think it's important to note that again we have the human factor messing our nice cryptosystems. The security of the FIPS mode might be questionable too due the behaviour of the HW RNG, it should still improve the security significantly over the non-FIPS mode which was the one found broken in this analysis.
Dan Goodin from Ars Technica shares more details about the paper:<p><a href="http://arstechnica.com/security/2013/09/fatal-crypto-flaw-in-some-government-certified-smartcards-makes-forgery-a-snap/" rel="nofollow">http://arstechnica.com/security/2013/09/fatal-crypto-flaw-in...</a>