So what banks out there actually have password systems that let you use secure passwords, or maybe even real 2FA that aren't German banks with their TIN systems?
The “Cobra Effect” that is disabling paste on password fields
421–430 of 450 posts
Re: The “Cobra Effect” that is disabling paste on password fields
#422Earlier quoted context omitted.
I never used them, but my guess they try to make one time passwords from your passwords. They probably ask to enter e.g. 3rd, 6th and 8th letter of the password. Supposedly if someone logs it it supposedly won't be as useful, because next time it will ask for different letters. Not sure why won't they use rsa keys or similar technology. Also if it is the way I think it is, then you know that your passwords aren't has…
> Also if it is the way I think it is, then you know that your passwords aren't hashed on their servers. Only if the developers are extremely lazy. A proper implementation would precompute a series of hashes for different subsets of the password and store them in the database instead. Similar to how Facebook stores both the password and its reversed-case form as a convenience feature for people who forget to turn the…
I understand what you are saying, but I suspect that fb doesn't store multiple hashes but just recomputes the hash entered a couple of times on failure.
Re: The “Cobra Effect” that is disabling paste on password fields
#423I doubt that the motivation for preventing paste in a "confirm password" context is to prevent workarounds to character limits. Why does the "confirm password" field exist anyway? It exists to remove the risk of input error. They want to avoid you locking into a mistyped password and not being able to recover. To this end, it makes some sense to prevent copy/paste, as a user may simply copy their mistyped password an…
This raises the interesting question of why we obscure the input when changing passwords. Showing the new password would allow people to check and correct it, so you'd only need one input. Given that the contents of a password input can easily be revealed, the only security obscuring the input provides is from an attacker who can see the screen but not the keyboard, and has no physical access to the device - a pretty…
Showing the password can be nice in situations but I doubt I would catch most typos but re-reading my password. My eyes often see what my brain expects to see.
Re: The “Cobra Effect” that is disabling paste on password fields
#424Earlier quoted context omitted.
The Co-operative Bank does this too. They absolutely store the password in plain text, because if you phone up, you have to tell the whole thing to the phone operator. To be fair, they're right in the middle of rolling out a new banking site which I think has proper passwords. The current system is a holdover from when they only had phone banking.
That does not mean they store plaintext passwords. When you login to most any website you have to submit your whole password. It is usually hashed and the hash is compare to the stored hashed pasword
From my conversations with the telephone banking operators, it's clear that they have the plaintext password in front of them.
Re: The “Cobra Effect” that is disabling paste on password fields
#425Earlier quoted context omitted.
How would you prevent a client from logging in from an infected system?
Isn't this what Intel's SGX system is supposed to do? Create a trusted, isolated execution environment, that's certified by Intel (or whomever manages your PC platform) not to mess with your data in malicious ways? IIRC can't it communicate directly to the keyboard,screen and the network? Besides DRM, this is probably the next best killer feature for the system if it's as secure as they claim.
In practice no, it's not useful for this because it has to take over everything. This makes it basically impossible to support for anything complex like a web browser. You end up having to put way too much stuff in the trusted environment. It might have worked way back in the text terminal days when it was slightly realistic for someone to build basically an entire trusted OS to run instead of your normal OS, but today that's just not going to happen.
Re: The “Cobra Effect” that is disabling paste on password fields
#426Earlier quoted context omitted.
It's a huge detriment to security. You can break sets of 5-7 characters at a time and combine them instead of having to break the entire password at once.
Seems like a tradeoff. What's more likely - that a bank loses its password database, or that some customers find themselves infected with keyloggers? Also in any bank that's even remotely sane this is just one leg of a 2FA; often a kind of a "delayed" 2FA - where one factor is enough to get you mostly "read-only" access, and any important changes or wiring actual money requires one-time SMS codes.
In today's environment? Probably the bank losing its password database.
Re: The “Cobra Effect” that is disabling paste on password fields
#427It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.
United MileagePlus just switched to security questions that only allow multiple choice answers. Some of the questions only have 12 valid answers. Compare that with even a weak password! Unbelievable.
That is laughably bad. I hope there is some backstop where the system will lock the account hard after a handful of bad answers?
Re: The “Cobra Effect” that is disabling paste on password fields
#428Earlier quoted context omitted.
I imagine he/she is referring to how most "security questions" use info that we typically don't hesitate to give out in casual conversation, even with total strangers.
Man I hate those security questions with a passion. They are super weakly protected backdoors into your account. Here's how I deal with sites that require them: site: "What is your first teacher's name?" me: "'Fx| The answer is a password equivalent, so I just treat it like a password.
If you can do this, it seems weird you would ever need to contact support for help. If you can keep the security answers safe why can't you keep the original password safe in the same place?
Or is this for when the account is locked for some random reason?
Re: The “Cobra Effect” that is disabling paste on password fields
#429and at this point, who isn't using a mobile device to enter passwords where potential shoulder surfers (human and camera) lurk? Without copy and paste, you have to what? Go into a bunker to type in passwords safely?
Re: The “Cobra Effect” that is disabling paste on password fields
#430The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.
HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...
Not necessarily. It might actually store multiple versions of your password as A.....B...C (where . means some known-to-them character, basically salt), ..A....B.C., etc, basically all the combo-of-3 templates encoded as PWs. Then it asks for one of them and recreates the template before comparing.
Still crappy entropy, though. An eight char password has 56 combinations of 3 positions each, so with N character choices that's 56 * N^3 vs. N^8 the normal way. Gets much worse in comparison with longer passwords.