Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plenty of Fish Hacked

plentyoffish.wordpress.com

Post reply on HN
Print view View original

31–40 of 104 posts

Re: Plenty of Fish Hacked

#31

Post by silvestrov »

_delirium wrote: post #24
jacquesm wrote: post #9

Earlier quoted context omitted.

If there is an option to use some kind of hardware token with your banking then I would strongly advise you to take that. Having just a password to protect your bank account sounds pretty scary to me. That's about as juicy as it gets. I'm paranoid enough about my servers having 'just' a password to protect them (oh, and an ACL), if my bank accounts would have only a password I wouldn't sleep. Every time I log on I ha…

In Denmark the currently-being-phased-in solution is a low-tech version of two-factor authentication. Instead of a hardware dongle, the centrally-administered "NemID" system issues you with a physical code card with some numerical codes on it. You enter your NemID password, your CPR number (Denmark's citizen-ID number), and the next unused code on the card. When there's fewer than 20 unused codes, the system notices…

The upside is that the NemID system gets the average citizen to a point where his/her family (and close friends) are the largest security problem. It is much more difficult for hackers in Argentina and Russia to get into your bank account when they need access to a piece of paper.

If is impossible to protect against your own family: the have hardware access to your computer, they can intercept all your paper mail, they know all details about your life, etc. So they are the perfect identity thieves.

Some Danes think they are clever and scan the paper card and store it as an image on their computer. Some people are just impossible to make a secure access system for.

The upside of the downside is that if anybody gets hold of your login details, then there is a single place to stop them instead of having to change 20 logins.

BTW. "NemID" translated to English is "EasyID". Within the next year, a hardware dongle will be available (e.g. for users who often login and uses up all the codes on a paper card in no time).

Re: Plenty of Fish Hacked

#33

Post by Tichy »

I read "closed the security hole", but I never read "reinstalled everything from scratch using clean data sources" - isn't that what he should have been doing?

I still feel icky because of the sourceforge hack and wonder if I should reinstall everything. I probably should :-(

Re: Plenty of Fish Hacked

#34

Post by domino »

fleitz wrote: post #23
domino wrote: post #18

Earlier quoted context omitted.

I just checked your profile, do you also do iPhone apps? We're a cool startup in Vancouver and we're looking for help with our iPhone development, maybe we can chat

Yup, definitely do do that. I'll email you right now. team at summify.com?

Yes, that's it

Re: Plenty of Fish Hacked

#35

Post by gnaffle »

bitserf wrote: post #26
AgentConundrum wrote: post #14

Earlier quoted context omitted.

Are you European? I only ask because my friend in London is the only person I've ever heard of using such a device. Unfortunately, such a thing seems all but unheard of here in Canada. Our debit and credit cards are being replaced with cards with chips embedded, which could be a sign that such devices are coming, but for now I'm afraid my password is my only real line of defense online. I have noticed that when I log…

The chips are most likely for EMV[1], which essentially puts some intelligence on the card in the form of an IC chip, and allows the card to make approve/deny decisions based on rules of the issuing bank. With EMV cards, the transaction is more like a negotiation, and the card may reject at any point. Of course, like anything, there will be vulnerabilities, and in the interests of usability, some issuing banks will r…

Actually, in Norway there are some banks that use the credit card chip for two factor authentication (the same which is used for EMV). You put the card into a small "reader" with a display, and out pops a number that you use when logging into the online bank. Most banks however use a dedicated device with a time-based one time password.

I'm not sure why, but I've seldom seen EMV transactions take longer than a regular swipe, but this might be because both 1 second * 3 is still not that big of a deal. (Or for all I know, it might be because they are only validating the credit card number..)

The interesting thing is that skimming is still possible, at least in Norway. It still happens that there is some kind of communication problem with the EMV system, and swiping the card is the fallback option. I guess this option will be turned off as soon as it works "all the time" and they can remove the magnetic stripe.

Re: Plenty of Fish Hacked

#36

Post by jacquesm »

bitserf wrote: post #26
AgentConundrum wrote: post #14

Earlier quoted context omitted.

Are you European? I only ask because my friend in London is the only person I've ever heard of using such a device. Unfortunately, such a thing seems all but unheard of here in Canada. Our debit and credit cards are being replaced with cards with chips embedded, which could be a sign that such devices are coming, but for now I'm afraid my password is my only real line of defense online. I have noticed that when I log…

The chips are most likely for EMV[1], which essentially puts some intelligence on the card in the form of an IC chip, and allows the card to make approve/deny decisions based on rules of the issuing bank. With EMV cards, the transaction is more like a negotiation, and the card may reject at any point. Of course, like anything, there will be vulnerabilities, and in the interests of usability, some issuing banks will r…

> there will be vulnerabilities

Correct, in fact there already are. Most of those will require at a minimum a hardware hack or access to transactions 'in progress' (modified terminals) and will usually only gain access to the data that is stored on the magnetic stripe, not to the other data stored on the chip (the chip contains a duplicate of the stripe data and some other data only available on the chip and not sent out over the wire used in challenge/response fashion).

The system is not 100% secure but is a bit better than just having a password and the fact that it requires access to the original card makes it a lot harder still (those cards can be stolen though, and combined with a bit of hardware and a 'yes' card (a card that always responds 'transaction authorized') you could fool online payment terminals).

But that's still a step removed from gaining complete control of a bank account using web based banking and a password.

Re: Plenty of Fish Hacked

#37

Post by patio11 »

prodigal_erik wrote: post #22
AgentConundrum wrote: post #14

Earlier quoted context omitted.

Are you European? I only ask because my friend in London is the only person I've ever heard of using such a device. Unfortunately, such a thing seems all but unheard of here in Canada. Our debit and credit cards are being replaced with cards with chips embedded, which could be a sign that such devices are coming, but for now I'm afraid my password is my only real line of defense online. I have noticed that when I log…

The weird thing is that Blizzard will cheerfully sell you a $7 hardware token to protect your imaginary WoW gold and equipment, but I don't know of any US banks that offer one to protect your actual money.

Paypal will.

Don't quote me on this, but I think banks are starting to lean on "possession of a trusted mobile device" as their two-factor authentication. The basic theory is that I give them a number I can receive SMSes at, and then any time they want to verify that the person operating my web browser is really me, they say "We just sent you a one-time password via SMS. Enter it, resend it, or talk to customer service."

This has significant advantages over dongles from the perspective of the bank: they don't have to get into dongle distribution, and people are probably better at keeping cell phones available than they are at keeping dongles available.

Re: Plenty of Fish Hacked

#39

Post by jacquesm »

silvestrov wrote: post #31
_delirium wrote: post #24

Earlier quoted context omitted.

In Denmark the currently-being-phased-in solution is a low-tech version of two-factor authentication. Instead of a hardware dongle, the centrally-administered "NemID" system issues you with a physical code card with some numerical codes on it. You enter your NemID password, your CPR number (Denmark's citizen-ID number), and the next unused code on the card. When there's fewer than 20 unused codes, the system notices…

The upside is that the NemID system gets the average citizen to a point where his/her family (and close friends) are the largest security problem. It is much more difficult for hackers in Argentina and Russia to get into your bank account when they need access to a piece of paper. If is impossible to protect against your own family: the have hardware access to your computer, they can intercept all your paper mail, th…

If there is one thing I would like it would be the option to specifically authorize a set of IP addresses allowed to access my bank account rather than the implicit way it is done right now.

Re: Plenty of Fish Hacked

#40

Post by whatusername »

patio11 wrote: post #37
prodigal_erik wrote: post #22

Earlier quoted context omitted.

The weird thing is that Blizzard will cheerfully sell you a $7 hardware token to protect your imaginary WoW gold and equipment, but I don't know of any US banks that offer one to protect your actual money.

Paypal will. Don't quote me on this, but I think banks are starting to lean on "possession of a trusted mobile device" as their two-factor authentication. The basic theory is that I give them a number I can receive SMSes at, and then any time they want to verify that the person operating my web browser is really me, they say "We just sent you a one-time password via SMS. Enter it, resend it, or talk to customer servi…

My bank in Australia does this (for any transaction to an account I've never sent money to before). Works prettty well.

I click a button, they SMS a 6 digit code, I enter it, money transferred (or bill paid).

Post reply on HN