test@strawberrynet.com
test test test, Burdur, Eastern, Hong Kong , Hong Kong
Daytime Contact Number: 1234567890 ; Mobile: 55555555
Stupid security things
131–140 of 161 posts
Re: Stupid security things
#132That "What is the name of your grandmother's dog?" security question made me lol @ work. This really makes me want to write a "Stupid security questions generator" website.
Are you guys all serious? Just give it a word which you can remember. They are not going to cross check it.
Re: Stupid security things
#133Why do we still use passwords? When I connect to Amazon.com I don't ask them for a username and password to verify they really are Amazon. I verify their certificate. Why can't I authentic with a certificate too?
You can. Client side SSL is a thing, and it totally prevents phishing - pretty much any browser has supported it for ten years. It is also a UX nightmare. The browser you are reading this with almost certainly support it, but try to see if you can find the menu option to install one.
I've actually played around with that. Yes, the browser side UX is a nightmare. It was real fun (for extremely small values of "fun") installing the client certificate on Firefox and Safari (on the Mac, on the iPad and on the iPhone). I was rather surprised by the number of different browsers (and number of computers) it needed to be installed on.
Re: Stupid security things
#134Earlier quoted context omitted.
Why is that funny or bad? If your grandmother is living and has a single dog, as 'security questions' go that would strike me as being pretty good.
It's a bad idea to use anything that might change. For example, "What was the make of your first car?" Might be OK. "What is the make of your favorite car?" Not good, odds are decent your favorite will change between setting the answer and trying to use it.
I'll take that usability problem over the security problem of using my mother's maiden name though.
Re: Stupid security things
#135Earlier quoted context omitted.
Why is that funny or bad? If your grandmother is living and has a single dog, as 'security questions' go that would strike me as being pretty good.
When you want to retrieve the password for an account you created 5 years ago, but you only remember creating it between 5 and 15 years ago and you have 2 dog loving grandma's each of whom have 2-3 old doggos all the time....well, good luck in remembering and identifying the correct name of the possible 10-15 dogs
Right but if there are six possible dogs at creation time you choose a different question.
If the answer is unique when you create it, but a new dog comes into the picture when you need to recall it, I doubt that's going to cause much of a problem. Maybe you get it wrong once and try again - you're only going through this because you already forgot your password.
Re: Stupid security things
#136Sadly British and other Commonwealth countries like Australia seem way too overrepresented in crap like this. Something about British culture leads to atrocious ignorance of security.
Re: Stupid security things
#137Why do we still use passwords? When I connect to Amazon.com I don't ask them for a username and password to verify they really are Amazon. I verify their certificate. Why can't I authentic with a certificate too?
WeMoney.ru has been offering precisely that since 2007 at least.
Re: Stupid security things
#138This is pretty horrifying. But almost as bad: websites that insist on over-elaborate security measures for trivial stuff. Take a bow, HM Revenue & Customs: > You’ve got a new message from HMRC > Dear Fred > You have a new message from HMRC about Self Assessment. > To view it, sign in to your HMRC online account. For security reasons, we have not included a link with this email. > Why you got this email > You chose to…
I don't get it. It's bad that you have to log in securely to an HMRC portal? I honestly don't see what you're complaining about here.
Nowadays every login requires a 2fa with a sms so got to have that phone handy to login. And as a bonus juggle multiple ids if you have a business account too in addition to your personal returns. Pure crap.
Re: Stupid security things
#139> And before we all lose out minds going "the password must die", nobody has yet figured out how to make that happen! If I were designing a new product today, I would never consider having usernames and passwords. While it is a shame Mozilla killed Persona before it could even have a chance, it is still way, way more reasonable to use third party signin buttons than to try to do it on your own. Again. Brokenly. For t…
I hate most OpenID implementations, because I can never remember which particular provider I used to authenticate with them.
Re: Stupid security things
#140Another example of possible poor security (which seems to be depressingly common with UK banks) is to ask for certain characters from your password. Like say, the 1st, 3rd and 5th characters in the word.
However, if the password was encrypted, they shouldn't really have this information should they? So by asking for it, they're basically admitting everything's stored in either plain text (very bad) or a reversable form of encryption (also quite bad).
There are other complaints about this too (like accidentally encouraging people to write the passwords down so they can figure out which character is the 3rd one or what not):
https://security.stackexchange.com/questions/64589/is-it-bad...
And it also doesn't seem much like a good deterrent against keyloggers. But yeah, quite a few banking sites do this, which is a tad worrying.