411–420 of 450 posts
Until better minds prevail.., Disable JavaScript, paste password, enable JavaScript, login. A pain, but usually effective.
I have a feeling that while Ctrl+V is prohibited, maybe Shift+Insert isn't...
Earlier quoted context omitted.
It seems astonishing to me to attempt to include in your threat model "login must be secure even on a system which has malware on it". If a system is infected with a keylogger, the LAST thing you want to do is allow the client to log in.
How would you prevent a client from logging in from an infected system?
Like a Bloomberg terminal.
Earlier quoted context omitted.
It seems astonishing to me to attempt to include in your threat model "login must be secure even on a system which has malware on it". If a system is infected with a keylogger, the LAST thing you want to do is allow the client to log in.
How would you prevent a client from logging in from an infected system?
IIRC can't it communicate directly to the keyboard,screen and the network?
Besides DRM, this is probably the next best killer feature for the system if it's as secure as they claim.
Earlier quoted context omitted.
but it prevents MitM spying.
Hashing passwords is not done to prevent MitM, it's done to prevent/delay password disclosure if the database is hacked.
Earlier quoted context omitted.
HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...
Yes. This is to protect against attackers obtaining your full plaintext password on your end, for example by phishing or installing keyloggers. In practice this is a much bigger security threat in the online banking world than someone doing the same by compromising the bank's systems - even if that were to happen they can easily re-verify your identity and issue you with a new password, and you really shouldn't be us…
If an attacker is running code on your system, you are already lost.
Earlier quoted context omitted.
Quote from the CEO's blog[1]: > I agree, it’s a little more inconvenient than before.... but for now we’re asking you to accept a little inconvenience for the sake of greatly enhanced security. This gives people incentive to pick the shortest possible easiest to input password. Definitely not good for "greatly enhanced security". [1] http://community.tradeking.com/members/bigdog/blogs/7546-a-w...
Security at the expense of usability comes at the expense of security. Shamelessly stolen from SE.
Earlier quoted context omitted.
Another one that is a great pain are the sites that insist upon asking for three letters from one's password to log in. This is all very well if one has an insecure password, but when I've created a 20-character password containing all the necessary characters then this makes it rather more difficult to enter the required values.
I actually like this as implemented by one of my banks. The 'pick a few letters' part of the login is pulled from a list of secret question answers rather than the password itself, and is presented after successfully entering the password. So my password manager enters my password, and then on the next screen I am asked for the (for example) 4th and 5th letters of the street I grew up on. The requested letters change…
Instead of all the work banks put into chicanery around this secret question and answer security theater, they should just roll out real Two Factor and save us all some hassle.