321–330 of 450 posts
I store my credit card data in 1Password - so I dont have to pull out my card each/every time I want to buy something online.
Not been able to paste my credit card number into the field is a PITA.
TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out. Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers. [1]: https://community.tradeking.com/forum/categories/suggestions...
Perhaps the companies involved have been told by their lawyers that choosing a password is a legal action, like an electronic signature, that must be performed by a human, letter by letter, to have certain legal ramifications. It is only stupidity if you assume the only purpose of a password (or a physical key) is security, and not also authorized entry. It may still be a poor engineering solution to the requirement…
This is all made up nonsense. You can paste your signature, choose some random image to represent your signature, or even merely click to sign. Have you used Docusign? HelloSign? Document signing in Mac Preview? Please don't spread FUD.
The article advocates breaking the bank's protocol for your own convenience because you supposedly know more than the other party. In general, in life, this is bad advice.
Please do not ask people to do things against the will of the other contracting party for their own convenience, without considering the risks of doing so.
Earlier quoted context omitted.
And that’s why I host all my email myself, and have my VPS with no password login (only key auth), and have 2FA enabled for the VPS control panel at the hoster, and have 2FA enabled for any change to the domain requiring a letter to be sent to me.
You should use a dedicated server instead of a VPS if you're concerned about privacy.
Earlier quoted context omitted.
Yes. This is to protect against attackers obtaining your full plaintext password on your end, for example by phishing or installing keyloggers. In practice this is a much bigger security threat in the online banking world than someone doing the same by compromising the bank's systems - even if that were to happen they can easily re-verify your identity and issue you with a new password, and you really shouldn't be us…
Phishing is a much bigger security threat, but is a much less harmful one than having the password database stolen. It sounds like they are trying to minimize the day-to-day risks, at the expense of maximize the damage of a catastrophic event.
I doubt that the motivation for preventing paste in a "confirm password" context is to prevent workarounds to character limits. Why does the "confirm password" field exist anyway? It exists to remove the risk of input error. They want to avoid you locking into a mistyped password and not being able to recover. To this end, it makes some sense to prevent copy/paste, as a user may simply copy their mistyped password an…
Earlier quoted context omitted.
And that’s why I host all my email myself, and have my VPS with no password login (only key auth), and have 2FA enabled for the VPS control panel at the hoster, and have 2FA enabled for any change to the domain requiring a letter to be sent to me.
You should use a dedicated server instead of a VPS if you're concerned about privacy.
Here in Norway, almost all financial and government institutions allow a form of authentication called BankID ( https://www.bankid.no/en/company/ ). I use the mobile variant and it works for all government related stuff like taxes, health, relocation notices and also with all banks both when logging in and paying bills, signing contracts etc. It is a legally binding identification akin to signing a paper. The procedu…
Isn't that vulnerable to MITM attacks for GSM? There have been quite a few demonstrated at DEFCON that could work very well for attacking this kind of system (on a large scale)
Attackers convinced (either with their official badges or by conning) the targets' cell service providers to change the SIM info associated with the accounts, and thereby intercepted SMS authentication codes.