Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stupid security things

troyhunt.com

Post reply on HN
Print view View original

101–110 of 161 posts

Re: Stupid security things

#101

Post by bm5k »

BinaryIdiot wrote: post #85
jfoutz wrote: post #72

Earlier quoted context omitted.

I don't know if it's a good practice or not, but i usually just pick a word to use for all security questions, that's totally unrelated to the question. ex. I what town did you first meet your best friend? "potato".

This is sorta what I do except I use a unique answer for each one and I store the question and answer in my password manager. Sometimes I use a straight up password generator for the answers. Hope I never have to give those out over the phone.

Same here.

Re: Stupid security things

#102

Post by stickfigure »

r1ch wrote: post #55
Neliquat wrote: post #2

The number of webmasters who wanted me to set up ssl to 'secure' their site, while the backend emailed cc info in the clear to the orders dept is larger than I have digits, even the extra adolecent joke ones.

Reminds me of Cloudflare's "Flexible SSL", where backend connections aren't encrypted at all.

As someone who has used Flexible SSL, it's perfectly reasonable for some threat models. In our case, credit cards and passwords were both managed by external services and the actual data we stored was not sensitive. We really just needed to prevent account hijacking in cafes via Firesheep.

Re: Stupid security things

#103

Post by tomjen3 »

krupan wrote: post #97

Why do we still use passwords? When I connect to Amazon.com I don't ask them for a username and password to verify they really are Amazon. I verify their certificate. Why can't I authentic with a certificate too?

You can. Client side SSL is a thing, and it totally prevents phishing - pretty much any browser has supported it for ten years.

It is also a UX nightmare. The browser you are reading this with almost certainly support it, but try to see if you can find the menu option to install one.

Re: Stupid security things

#104

Post by tomjen3 »

Tistron wrote: post #29
nojvek wrote: post #6

Earlier quoted context omitted.

To be honest credit cards are a terrible system in terms of security. Everything to make a charge is on the card and people freely give it out to different websites.

Is this not changing though? I can't remember the last time I bought something online without having to either use password or 2factor auth, and there are no places here that do not require a pin code when using a cc in a store. I'm in Sweden though (but using mastercard).

There are a couple online stores that requires verified by visa.

Just means I don't care to shop there, its a pain.

Re: Stupid security things

#105

Post by jrockway »

ilamont wrote: post #77
gambiting wrote: post #33

Huh, couple years ago Santander in the UK changed their web layout. No big deal, except that my password wouldn't work anymore - I rang them up, and they said "did you have any special characters in your password? If yes, then they have been removed because the new system does not support special characters. Please use the same password as before, but without special characters". 1) This is one of the largest banks i…

Chase doesn't except certain characters, including "&"

It's one thing to reject special characters at password change time, that's silly but not massively insecure. It's another thing to modify passwords at rest to delete the special characters. (However, the backend could easily have always been doing that, and the frontend changed from silently deleting what you typed to refusing to accept what you typed.)

It's silly but probably has to do with some percentage of customers not realizing that - and _ aren't the same character or something.

Re: Stupid security things

#106

Post by gumby »

oblio wrote: post #32
gumby wrote: post #19

> and I know for a fact 90% of the sites I personally sign up to online also follow that same process. This is a totally legit response. After all if something goes wrong they must have followed "best practices". No reasonable person would expect them to do more. And it's true (if you only consider the needs of the business). This is a solid strategy for getting lawsuits dismissed. I've seen it in physical security t…

1. Are you for or against badge-checking turnstiles? I can't quite say for sure. 2. LCD = lowest common denominator in this case?

2. indeed.

1. I don't really give a shit either way when I encounter one but as a businessman I am against them as something I should have to pay for. My points were twofold:

A> there's a games theory/cartel issue around "best practices", and you basically have no liability if you provide the "standard of care". This is true in security practices, medicine, etc.

And B> there is often an incentive mismatch between the implementor of a process and those subject to it which biases aggressively down or up, against gradualism. The most visible extreme is TSA in which the risk of letting a shoe bomber is extremely high (i.e. the decision maker would lose their job if it actually happened) while the cost is borne by all the miserable travelers who, realistically, fare essentially epsilon risk of actually encountering such a device.

Re: Stupid security things

#107

Post by gumby »

IshKebab wrote: post #59
gumby wrote: post #19

> and I know for a fact 90% of the sites I personally sign up to online also follow that same process. This is a totally legit response. After all if something goes wrong they must have followed "best practices". No reasonable person would expect them to do more. And it's true (if you only consider the needs of the business). This is a solid strategy for getting lawsuits dismissed. I've seen it in physical security t…

> This is a totally legit response. Apart from the fact that it is totally untrue?

Who knows if it's untrue? Although it almost certainly is. What's "legit" is the point "lots of other people do it so why should I go to any greater effort? And anyway I don't actually give a shit about my employer's customers."

(I was being sarcastic about "legit" -- it's only legit from the selfish POV of the web admin)

Re: Stupid security things

#108

Post by cookiecaper »

BinaryIdiot wrote: post #83
bungie4 wrote: post #7

Programmer (not me!) manually iterates over user file (passwords plain text natch). If he finds a matching username (format is enforced so dead easy to guess). He sets the auth cookie. THEN he goes looking for the password. You don't have to enter any password. At that point, just hit the back button a couple of times and refresh and BING! You can impersonate anybody on the system. Including the admin because guess w…

I used to work at a life insurance company that had a sessions page for the developers that wasn't locked down at all. If you could get someone's id you could go directly to this page and set your user id to that. Done. They also had a contest for their agents and the database they used to store all of the entries and information was an access database that happened to be sitting in the public directory for the websi…

Yes, most medium-or-smaller sized companies, including ones in fields that should take security seriously like insurance and lending, will have tons of stuff like this. It shouldn't surprise anyone at this point.

Re: Stupid security things

#109

Post by cookiecaper »

yeukhon wrote: post #66

I feel like we need laws in place on software and hardware security. Laws to punish crimes is good, but we also need some regulation, simple ones, to govern how companies have the obligation to manage software and hardware security. I think: * companies running a website and collects customer data must have an incident response plan laid out. If we punish bad service providers reported by consumers, why can't we do t…

This is a very dicey subject. I think it's best to keep it loose as long as possible. Introducing a regulatory body into any field is perilous, but something as fast moving as software and security would be frightening. What happens when the regulation is that you have to use the algorithm that was cracked last month? Eek.

Voluntary, socially-enforced customs are better. Things like the MPAA rating system have successfully staved off government intervention. Such standards are much more flexible.

We already have this de-facto via TLS and the browser's angry messages if you don't comply with their expectations, but it'd be interesting if browsers started running a more thorough security verification program and giving preferential treatment to sites that implemented it.

That is also scary because it centralizes more control in browser manufacturers (which, today, means Google almost as much as it meant Microsoft in the oughts). But still better than the government I guess, and blocking a site in software is much more motivating than the risk of a fine for non-compliance.

Re: Stupid security things

#110

Post by cookiecaper »

krupan wrote: post #97

Why do we still use passwords? When I connect to Amazon.com I don't ask them for a username and password to verify they really are Amazon. I verify their certificate. Why can't I authentic with a certificate too?

This has been implemented before. I briefly maintained a legacy project that supported it via IE. In practice, it's a nightmare. Users constantly lose their certs and require manual re-auth. There was a complex install process to get the new cert in place. Usernames and passwords were still a thing; the cert was just to verify that you're coming from an authenticated computer.

Something like your proposal may work if it involves a one-way hash of biometric data (fingerprint scan) so that people can't "lose their cert", but that comes with its own problems too.

Post reply on HN