71–80 of 148 posts
Earlier quoted context omitted.
What exactly is wrong with offering SMS 2FA? I don't have a smartphone, but I have a great little prepaid phone. Why should I get no features just because they are not necessarily as good as it gets ? Also, as far as I'm aware, all of the major "attacks" on SMS 2FA are just the fact that a smartphone can be compromised in many ways. I have much less attack surface: an attacker would need to reprogram my undocumented…
From my limited reading on the issue. SMS in US is unsafe. Not sure if the same can be said in other places like EU or Japan.
Earlier quoted context omitted.
When I went to setup my online account for my old bank, I entered a randomly generated 16 digit key and got an error; "Maximum password length limited to 6 characters...only alpha-numeric" I called to inform them that their account creation was broken, because obviously that was a bug. They told me that sometimes people have a hard time remembering their password, so they "need to balance between ease of use and secu…
Heh, both my banks (Banco do Brasil and Santander) are worse. 6 characters, numbers only! "For my safety" they recommend not using my birthday - how thoughtful.
It's different from a system that never blocks passwords, security questions, and so on.
Earlier quoted context omitted.
When I went to setup my online account for my old bank, I entered a randomly generated 16 digit key and got an error; "Maximum password length limited to 6 characters...only alpha-numeric" I called to inform them that their account creation was broken, because obviously that was a bug. They told me that sometimes people have a hard time remembering their password, so they "need to balance between ease of use and secu…
It seems standard practice for German banks to limit online passwords to five alpha-numeric characters. Fortunately, you need a TAN number (generated by a device or from an SMS message) to actually make a transaction. I have no idea why they limit the password length like this.
That said, Comdirect seems to offer regular passwords or six digit PINs and Bank of Scotland (in Germany) seems to also offer regular passwords.
But there are plenty of other offenders. For example my energy provider E-wie-einfach requires a mix of alphanumeric characters but forbids pasting and autofill (the latter of which luckily Chrome simply ignores).
I don't know what idiot ever came up with the idea that disabling paste makes logins more secure (only justification I've ever heard was about preventing brute force attacks, proving an utter lack of understanding of the technology involved) but sadly it's still a thing and it still leads to people using trivial and easy to type passwords.
Is 17 days an acceptable TAT here? I know investigation and fixes can be a challenge, but with the severity of this exploit+PayPal being a serious financial service, I kind of would hope for a faster fix. Maybe I'm off base...I really don't know; curious what others think. How much time would've had to pass (without PayPal doing anything) before the author is ethically obligated to post to HN/media/etc about the hack…
Earlier quoted context omitted.
> If you can't - just generate a random password as the answer. "I_ty/:QWuCllV?'6ILs`O12kl;d0-`1" is an excellent name for your first dog / high school. Just don't forget to use a password manager to store these. Be wary of social engineering attacks though. - I'd also need you to provide me an answer to your security question. What was your first dog's name? - Oh, you know, it's a long string of random characters I…
Great point. "correct horse battery staple" wouldn't be vulnerable to such an attack.
Earlier quoted context omitted.
> If you can't - just generate a random password as the answer. "I_ty/:QWuCllV?'6ILs`O12kl;d0-`1" is an excellent name for your first dog / high school. Just don't forget to use a password manager to store these. Be wary of social engineering attacks though. - I'd also need you to provide me an answer to your security question. What was your first dog's name? - Oh, you know, it's a long string of random characters I…
Yes, having something readable (and "believable") is more useful and secure than having to rely on saying a random string Just put "Plymouth Creek High" (Not to mention the possibility that some "security genius" will ban special characters on those answers)
For example, "What's the name of your high school?" would be answered with something like "Khan Academy" (the name of a site that helped me) or "Mr. Jefferson" (A teacher, or best friend)
I've seen equally as ridiculous web bugs, computing prices browser side in javascript, credit card numbers encoded in REST API endpoints, financial websites not supporting 2FA at all or mixing http requests into the sites. We're solidly in the dark ages of web security still.
I want to say it was Yahoo Messenger but my memory could very well be lying to me.
Earlier quoted context omitted.
I noticed that if it's a fire that kills many people it's only a one day news; while if it's a bomb that kills one everybody's afraid.
It's not the number of casualties that scares people, but rather the nature of the threat. Fires have existed for several millennia. Our ancestors who built and lived in the very first settlements suffered from their homes/stores occasionally burning down. We know what types of conditions increase risk of fires and we know how to minimize those risks and put the fires out when they occur. Bombs on the other hand are…
So flying is much higher than diving:
People drive much more than they fly (a few times a year vs twice a day) and hear about air-crashes (9/11, Malaysia Airlines) more than car crashes.
It's the brain playing games with us