Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stupid security things

troyhunt.com

Post reply on HN
Print view View original

81–90 of 161 posts

Re: Stupid security things

#81

Post by marme »

chrisper wrote: post #27

This reminds me of AT&To Gophone website. Your username is your phone number and your password is a 4 digit PIN. The same pin you can use to transfer out your number.

this is exactly why 2FA with SMS is not secure at all. If someone really wants to get into your account all you have done is added one extra step where they need to steal your phone account and then they steal your other account. It has been shown how easy it is to steal someones phone account and transfer the number to a cheap burner phone or online service. This also kills your cell service so unless you have another phone to use you cant even call to secure your accounts so the attacker has plenty of time to break in to all your other accounts

Re: Stupid security things

#82

Post by soared »

city41 wrote: post #69

This is a huge problem and has been for a long time. We allow pretty much anyone to code up a website. It'd be similar to allowing anybody to start practicing medicine. I've lost count of how many websites I've used that were blatantly insecure. Sometimes you have no choice but to do it, like when I had to apply for a Brazil travel visa. Their SSL certificate has expired, and has been expired for years now.

So you'd rather the government hand out certifications and only allow those certified people to create websites? That sounds better.

Re: Stupid security things

#83

Post by BinaryIdiot »

bungie4 wrote: post #7

Programmer (not me!) manually iterates over user file (passwords plain text natch). If he finds a matching username (format is enforced so dead easy to guess). He sets the auth cookie. THEN he goes looking for the password. You don't have to enter any password. At that point, just hit the back button a couple of times and refresh and BING! You can impersonate anybody on the system. Including the admin because guess w…

I used to work at a life insurance company that had a sessions page for the developers that wasn't locked down at all. If you could get someone's id you could go directly to this page and set your user id to that. Done.

They also had a contest for their agents and the database they used to store all of the entries and information was an access database that happened to be sitting in the public directory for the website to simply serve to anyone who knew to request the database.

Seeing so much "security" makes me realize that a large majority of sites out there are a complete shit show, especially if the companies I worked for / with couldn't get it right and they actually had some money to their name.

Re: Stupid security things

#84

Post by unethical_ban »

zanny wrote: post #65

> And before we all lose out minds going "the password must die", nobody has yet figured out how to make that happen! If I were designing a new product today, I would never consider having usernames and passwords. While it is a shame Mozilla killed Persona before it could even have a chance, it is still way, way more reasonable to use third party signin buttons than to try to do it on your own. Again. Brokenly. For t…

I would not funnel users into one of several privacy-sucking walled gardens to use my site.

If there were a true, privacy-oriented product whose sole job was identity, perhaps.

Usernames and passwords are not hard. It's just that a lot of people are stupid.

Re: Stupid security things

#85

Post by BinaryIdiot »

jfoutz wrote: post #72
djtriptych wrote: post #4

That "What is the name of your grandmother's dog?" security question made me lol @ work. This really makes me want to write a "Stupid security questions generator" website.

I don't know if it's a good practice or not, but i usually just pick a word to use for all security questions, that's totally unrelated to the question. ex. I what town did you first meet your best friend? "potato".

This is sorta what I do except I use a unique answer for each one and I store the question and answer in my password manager.

Sometimes I use a straight up password generator for the answers. Hope I never have to give those out over the phone.

Re: Stupid security things

#86

Post by Freak_NL »

jfoutz wrote: post #72
djtriptych wrote: post #4

That "What is the name of your grandmother's dog?" security question made me lol @ work. This really makes me want to write a "Stupid security questions generator" website.

I don't know if it's a good practice or not, but i usually just pick a word to use for all security questions, that's totally unrelated to the question. ex. I what town did you first meet your best friend? "potato".

Don't do that unless you don't care about that account. Often the answer to a security question effectively acts as a password. You are not defending against someone guessing your answer, you are defending against someone using an automated dictionary attack. A common word like 'potato' scores quite high in the common password lists.

A safer option is to just generate a random password for those questions as well and store it on your password manager.

Re: Stupid security things

#87

Post by mikeash »

user5994461 wrote: post #50
apeace wrote: post #34

Earlier quoted context omitted.

One could argue this is actually a good security practice. It's bad to train users that their bank/whoever will be sending them links via email, because then when the user gets a phishing email, they will have no way to tell the difference. If users can be trained to see "Login to your bank account to see the message", that's much better for their own security.

Then they go to google and click the first link... that will be a paid ad to a phishing site.

Most likely not, so it's still way better than clicking links that come in your e-mail.

Re: Stupid security things

#88

Post by optimuspaul »

IshKebab wrote: post #59
gumby wrote: post #19

> and I know for a fact 90% of the sites I personally sign up to online also follow that same process. This is a totally legit response. After all if something goes wrong they must have followed "best practices". No reasonable person would expect them to do more. And it's true (if you only consider the needs of the business). This is a solid strategy for getting lawsuits dismissed. I've seen it in physical security t…

> This is a totally legit response. Apart from the fact that it is totally untrue?

We don't know what sites they have signed up for. It could be true.

Re: Stupid security things

#89

Post by gambiting »

the_af wrote: post #47
gambiting wrote: post #38

Earlier quoted context omitted.

What do they require then? I've never in my entire life used my credit/debit card without typing in the PIN number(except for contactless payments, of course). I'm in the UK. I think they can be used with a signature too? Maybe? I've never heard of anyone actually signing a bill instead of using the pin, and besides, I don't even sign my cards.

Yes, they require a signature. I'm not saying this is a safe practice, just that I've never seen a store where they asked me for a pin code for major credit cards such as Visa, Amex and (I'm pretty sure, but I don't have one) MasterCard. And I'm talking not only my own country, but also the US and several countries in Europe. When I was in the UK some years ago, they didn't ask me for my pin code when I used my Visa…

I have both British and Polish debit and credit cards, Visa and Mastercard(Visa Classic credit cards), I've used them in Spain, Germany, Netherlands, France, Spain and Portugal, and literally never had to sign for them, be it in shops or restaurants.

I'm not saying there aren't cards that need signing,but I've literally never seen any.

Re: Stupid security things

#90

Post by yeukhon »

draw_down wrote: post #64

I can't believe people still inform and try to counsel these tone-deaf corporations. The upside is so small and the downside is potentially quite large. Catch some moron CEO in a bad mood and they've got plenty of resources to make your life hell even if they don't have a legal case.

So what is your suggestion here?
Post reply on HN