Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stupid security things

troyhunt.com

Post reply on HN
Print view View original

91–100 of 161 posts

Re: Stupid security things

#91

Post by djtriptych »

nojvek wrote: post #6
Neliquat wrote: post #2

The number of webmasters who wanted me to set up ssl to 'secure' their site, while the backend emailed cc info in the clear to the orders dept is larger than I have digits, even the extra adolecent joke ones.

To be honest credit cards are a terrible system in terms of security. Everything to make a charge is on the card and people freely give it out to different websites.

All of my cards have excellent theft protection policies though. If my card gets stolen, I'm not responsible for any damages. That's a great security policy; better than most websites.

They _assume_ card numbers will get stolen all the time and invest in identifying suspicious behavior. And all behavior is 100% auditable all the time. Security isn't just about authentication/authorization. I wish more websites assumed passwords might get phished and thought through how to protect users in that case.

My credit card numbers are one of my pieces of private information I feel _least_ apprehensive about sharing.

Re: Stupid security things

#92

Post by smnscu »

One of my pet peeves is that 1password doesn't seem to support security questions out of the box, so I have to manually generate random passwords with it, fields for Q1, A1, etc., then set those fields to type "password".

Re: Stupid security things

#93

Post by city41 »

soared wrote: post #82
city41 wrote: post #69

This is a huge problem and has been for a long time. We allow pretty much anyone to code up a website. It'd be similar to allowing anybody to start practicing medicine. I've lost count of how many websites I've used that were blatantly insecure. Sometimes you have no choice but to do it, like when I had to apply for a Brazil travel visa. Their SSL certificate has expired, and has been expired for years now.

So you'd rather the government hand out certifications and only allow those certified people to create websites? That sounds better.

I didn't say that, at all. I merely acknowledged there's a problem, a significant one in my eyes. I have no idea what the solution is.

Re: Stupid security things

#94

Post by dionidium »

"No really, I've seen some very stupid security stuff out there the likes of which make the above example not just believable, but likely. Don't believe me? Here, hold my beer..."

The "Here, hold my beer..." line is totally played out at this point, anyway, but the usage here doesn't even make sense. The implication is that you're about to do something stupid, not that you're about to tell us about some stupid things other people have done.

Why would I need to hold your beer while you tell me a story?

Re: Stupid security things

#95

Post by krupan »

djtriptych wrote: post #91
nojvek wrote: post #6

Earlier quoted context omitted.

To be honest credit cards are a terrible system in terms of security. Everything to make a charge is on the card and people freely give it out to different websites.

All of my cards have excellent theft protection policies though. If my card gets stolen, I'm not responsible for any damages. That's a great security policy; better than most websites. They _assume_ card numbers will get stolen all the time and invest in identifying suspicious behavior. And all behavior is 100% auditable all the time. Security isn't just about authentication/authorization. I wish more websites assume…

Thing is, you pay for that cc number protection with every transaction. How are you going to pay for the same sort of protection on your password?

Re: Stupid security things

#96

Post by GordonS »

dasil003 wrote: post #62
handelaar wrote: post #45

Earlier quoted context omitted.

People elsewhere in the world: whatever anybody tells you when they're crapping on the UK Government Digital Service, make sure they're not using HMRC as an example. Famously HMRC resists everything GDS has ever tried to do, and after GDS built a entire system for secure gov ID login which is deliberately not tied to a single vendor, HMRC refused to use it and instead is building another one, which is locked to a sin…

That's so frustrating. The GDS is one of the shining beacons of government tech done right, I was very impressed with their work and team when I lived in London from 2011-2014. I guess HMRC took one look and said "this not sufficiently bureaucratic for our needs". In general I liked the HMRC much better than the IRS, but I was sort of shocked to receive a paper cheque for my refund as it was the only time I ever saw…

GDS has a great blog[1] which I recommend, and have published a lot of stuff to GitHub too[2]. I never imagined the words 'government' and 'IT' could be used in the same sentence without laughing before learning about this group.

Whenever I read of yet another multi-billion pound failed IT project by SAIC or the like, I always wonder why on earth they didn't just let GDS at it.

[1]https://gdstechnology.blog.gov.uk [2]https://github.com/alphagov

Re: Stupid security things

#97

Post by krupan »

Why do we still use passwords? When I connect to Amazon.com I don't ask them for a username and password to verify they really are Amazon. I verify their certificate. Why can't I authentic with a certificate too?

Re: Stupid security things

#98

Post by degenerate »

empath75 wrote: post #51
gambiting wrote: post #33

Huh, couple years ago Santander in the UK changed their web layout. No big deal, except that my password wouldn't work anymore - I rang them up, and they said "did you have any special characters in your password? If yes, then they have been removed because the new system does not support special characters. Please use the same password as before, but without special characters". 1) This is one of the largest banks i…

my (former) bank used social security numbers as user accounts, and lets you reset your password over the phone with nothing more than address and birth date.

OK this one takes the cake. WOW.

Re: Stupid security things

#99

Post by klez »

krupan wrote: post #97

Why do we still use passwords? When I connect to Amazon.com I don't ask them for a username and password to verify they really are Amazon. I verify their certificate. Why can't I authentic with a certificate too?

Because users are more likely to lose a certificate or have it stolen than a website. What happens then?

Re: Stupid security things

#100

Post by trevor-e »

krupan wrote: post #97

Why do we still use passwords? When I connect to Amazon.com I don't ask them for a username and password to verify they really are Amazon. I verify their certificate. Why can't I authentic with a certificate too?

I'm guessing that it would not be feasible to manage a CA of that size.
Post reply on HN