101–110 of 164 posts
The number one reason I do not keep CC info, and why I don't fill out details wherever I can. I don't trust your security.
good luck buying a plane ticket from easyjet without giving them your CC info
I wouldn't be surprised if they stored it anyway though
Earlier quoted context omitted.
Still better than my bank (one of Spain's biggest) that requires your password to be 8 (not less, not more) digits.
Use "password" - eight letters and it's English and so should be safe on a Spanish site.
I just logged in to change my easyJet password: > Your password must be a single word between 6 and 20 characters in length and must not include the special characters # & + or space. Come on! This is ridiculous. If you're going to get hacked at least have a sane password policy.
I just logged in to change my easyJet password: > Your password must be a single word between 6 and 20 characters in length and must not include the special characters # & + or space. Come on! This is ridiculous. If you're going to get hacked at least have a sane password policy.
How much you wanna bet they weren't salting passwords in the backend?
Any customer data, and especially PII, needs to be toxic. The toxicity needs to increase super-linearly with the total amount of data, because the value of leak does, too, while the difficulty of the breach probably does not. It needs to be so expensive to store extensive data of millions of people that companies (or for that matter, the government) cannot wait to get rid of it. Currently, most online shops nudge me…
Any customer data, and especially PII, needs to be toxic. The toxicity needs to increase super-linearly with the total amount of data, because the value of leak does, too, while the difficulty of the breach probably does not. It needs to be so expensive to store extensive data of millions of people that companies (or for that matter, the government) cannot wait to get rid of it. Currently, most online shops nudge me…
Certainly in my own business, I want as little PII as possible.
I also removed my credit card at some point after this from every single website - and changed the card in real life. So even if there is a card number somewhere in a db, it's not valid anymore.
I'm tech savvy and this still took around a day, and it was a pain in the ass but hopefully mitigates some of the fallout from this hack - but to be statistically safe while continuing to use online services, id have to wipe my passwords and cards every few months given the frequency of hacks. I couldn't expect my family to put this much effort into doing this frequently.
The system of holding a central database is completely bust. It's just too juicy a target to keep the hackers at bay.
I really wish there was more effort today spent on changing this centralised paradigm to a decentralised one - my personal data should live on my computer, and my computer only. It should never ever leave it. It should always be hashed.
If there was some way for web apps to be distributed and ran on my own personal computer, with zero knowledge proofs verifying transaction on the third party services side we would seriously reduce the attractiveness of hackers going off these enormous databases. It needs to be as easy to secure this data as possible, and it needs to never be sucked up to somewhere else, and security patches need to be instantly applied over the top of my running kernel - without any hiccup.
Impossibly difficult you will scoff. No one wants to run their own software. They absolutely would if the tech industry put any effort into it. Also the fines need increased massively to incentivise action in this direction. It should be business-ruining if you lose your customers data like this.
Earlier quoted context omitted.
This reminds me of "identity theft". Someone didn't steal my identity, someone stole from the bank using my identity. It should really be called "bank fraud".
Unless you are being sued by the bank as the one who stole the money and this happens in another country and the time to claim your innocence is out. Then it’s you who suffers the fraud, not the bank :/ (talking from personal experience of a close friend)
Earlier quoted context omitted.
How much you wanna bet they weren't salting passwords in the backend?
I remember reading that a somewhat-legitimate reason for blocking special characters is that it's a signal for keyloggers that the typed string might be a password. After briefly searching Google, I couldn't find anything to support that theory though.
If special chars can be a signal for keyloggers, so are strings > 10 chars, and strings which are not all-lowercase/all-uppercase/first-capital. Basically to mislead the keylogger in this way, the user would have to use a short all-lowercase dictionary password :)