271–280 of 307 posts
Earlier quoted context omitted.
To be fair Chase seems (on the surface) to have the best site/app/whatever of the major US banks. The app is pretty great.
Except for the unnecessary 5 second wait when accessing chase.com for the login prompt to appear.
It’s not pretty but it’s quick. :)
NatWest is also guilty of storing passwords in plain text: their login page says 'enter the 5th, 8th and 12th character of your password'
Who's to say they haven't just hashed each individual character of the password?
a: 0CC175B9C0F1B6A831C399E269772661
b: 92EB5FFEE6AE2FEC3AD71C777531578F
c: 4A8A08F09D37B73795649038408B5F33
etc.
then this is basically the same as storing the plaintext characters because as long as you know the hashing algorithm you can generate a pretty small map of hash -> original character and convert back.
Another lesson is to always host the login section on a sub domain of the company which website you visit. A prime example not to follow is Citibank in Europe. My account is with citibank.co.uk, but when I login to my account I get redirected to online.citi.eu. How do I know that citi.eu belongs to Citibank? I have no relationship with citi.eu, that’s not the website I visited. How do I know I can trust it? Microsoft…
Microsoft's sign in is a real mess, I think in part due to having to make your hotmail login that you made 15 years ago still work, along with the dozens of other services that MS has acquired or integrated. I've had a real shitter of a time trying to login before, with redirect loops, or getting automatically signed out as soon as I sign in. Or accounts being a "games for Windows" account, but not an MS account, or…
Earlier quoted context omitted.
I don't want to enter my password on the phone, I have fingerprint or pin in mobile banking app.
He meant over the phone, not on a phone. Ex : I call my bank and I have to go through a menu leading me to the right agent. Eventually, it asks for my password over the phone that I need to type using the 10 numbers on a phone dial. Good luck using your fingerprint there :)
Earlier quoted context omitted.
But did you call the support phone number shown on the dodgy domain?
T-Mobile called me back one time instead of me waiting on hold. This was after I went through the song and dance of giving the automated system my details. The first thing this representative wanted to do was, again, confirm I am who I said I was. I said think about what you're asking for a second. Should I answer your questions? Couldn't get them to understand. Wound up hanging up and calling again and waiting on ho…
"Hello, am I talking to Nick Lamb?" "Yes, this is me" "OK, I'm calling from Example Bank and our confirmatory password is Melons" [not the actual bank or password] "Thanks, that checks out, what can I do for you?"
This happened because I had one of those conversations you're talking about, and they were like "Aha! We have something we can do for those situations, call us and set a password we can use" so I hung up and sure enough they've used that password ever since. I like it.
It's not a _good_ password, but hey, how many times does anyone try the wrong one? Literally never. So it's good enough.
It's 2017, and my social media account is protected by a tamper-proof phish-resistant embedded-encryption U2F microcontroller dongle, in addition to a password of virtually unlimited length and charset. Meanwhile, my bank has a max password length of 12 and I can only use an alphabet of roughly 64 characters. The future is here folks. And it sucks.
It's 2017, and my social media account is protected by a tamper-proof phish-resistant embedded-encryption U2F microcontroller dongle, in addition to a password of virtually unlimited length and charset. Meanwhile, my bank has a max password length of 12 and I can only use an alphabet of roughly 64 characters. The future is here folks. And it sucks.
Guess what! If your financial service restricts your password to letters and numbers, it's most likely because they want you to be able to enter your password on the phone. So the passwords 'abc' 'ABC' and '222' are treated as equivalent. Try it out for fun!
Earlier quoted context omitted.
Microsoft's login experience has been generally broken for years. Multiple redirects through different domains. Heck it uses Javascript redirects. In 2017. So your back button won't work. And it has a habit of just not working. I went to visit a public page on docs.microsoft.com and wound up dead on a white page on login.live.com because it decided I needed to be redirected to login. Just to view a docs page.
What is the alternative to javascript redirecting when you can't do it as the http response?
Probably not a good person to piss off. Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox shouldn’t tell users it’s insecure. Within hours his database was pwned.
The funny thing is, checking their web site they still haven't managed to secure their landing page. You'd think they'd get the message when everyone's just laughing at them...
everyone = Hacker News
Mostly likely not their customers; whom they have a vested interest in keeping money with.