Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We'd lose our security certificate if we allowed pasting

twitter.com

Post reply on HN
Print view View original

11–20 of 225 posts

Re: We'd lose our security certificate if we allowed pasting

#11

Post by PeterisP »

eximius wrote: post #6
quchen wrote: post #3

Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.

Mine is 10 digits. I thought the 4 digit limit was just a societal assumption? (I'm being serious, I thought it was (near) universally allowed to be longer, people just didn't bother.) Is this not the case?

It's not the case, it depends on the issuing institution.

Also, there is a practical requirement to have it short; as physical merchants value quick processing, and having to type&re-type long passwords delays other people behind you - so they want long PINs to be unpopular.

Re: We'd lose our security certificate if we allowed pasting

#12

Post by eyko »

morsch wrote: post #4
quchen wrote: post #3

Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.

It's secured by a four digit password and self destruction after three consecutive invalid PIN entries. Which is plenty secure against brute force. Or is that just the way it works around here?

Unless you buy online, in which case you just need the "last 3 digits on the back of your card".

Re: We'd lose our security certificate if we allowed pasting

#13

Post by penguat »

PeterisP wrote: post #7
quchen wrote: post #3

Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.

Well, it's not like my card is hooked up to the internet for everybody to try and log in. PIN isn't particularly vulnerable to brute force anyway, as number of failed authorisation attempts is strictly limited to something like 3, and a fraudster has to risk capture by being physically present at each attempt or 'trying out' a stolen card, and having their face recorded on cameras. I haven't seen any advantages for u…

No need to be physically present anywhere except where the card is, and as for cameras, I see none on a PINSentry: https://www.google.co.uk/search?q=pinsentry&source=lnms&tbm=...

Re: We'd lose our security certificate if we allowed pasting

#14

Post by relix »

eximius wrote: post #6
quchen wrote: post #3

Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.

Mine is 10 digits. I thought the 4 digit limit was just a societal assumption? (I'm being serious, I thought it was (near) universally allowed to be longer, people just didn't bother.) Is this not the case?

Not common, and using anything other than 4 digits is not wise if you want universal support especially when travelling - 6 digit cards are not 100% compatible with every ATM/card machine because some (most?) only allow 4 code entry. I've never heard of 10 digits and the compatibility must be even more limited. Where do you live and what happens if you try to use your card at ATM's abroad?

Re: We'd lose our security certificate if we allowed pasting

#15

Post by crashandburn4 »

morsch wrote: post #4
quchen wrote: post #3

Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.

It's secured by a four digit password and self destruction after three consecutive invalid PIN entries. Which is plenty secure against brute force. Or is that just the way it works around here?

I actually rely on this self destruction, I have a scrap of paper in my wallet with "Pin Numbers" written on it along with 3 random four digit numbers, gives me minor peace of mind that if my wallet is lost and found by someone that wants to try and use them, hopefully they'll lose them to an atm rather than using them online.

Re: We'd lose our security certificate if we allowed pasting

#16

Post by koyote »

chopin wrote: post #5
quchen wrote: post #3

Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.

Cards are way different. They combine something you have (the card) with something you know (the PIN). After three false attempts to enter the PIN you have to unlock the card going a different route. In such a scenario, 4 digits are fine. You can't lock accounts only protected by a password and accessible by anyone (via internet) this way as this would invite for Denial-of-Service attacks (locking your account with t…

I have had quite a few sites block my account for three bad password attempts and I had to actually call the company to unlock the account (this was always a financial services company).

It's quite annoying as none of the sites warned me about the impending account block after the first or second try. I guess it's an inconvenience that is worth it for the extra anti-brute-force security. Being locked out due to someone personally locking you out as you mentioned might also be annoying, but I honestly rather be locked out of my account and therefore alerted that someone is trying to gain access to my data than not.

Why these same sites limit my password to a specific number of characters and disallow special characters is beyond me though.

Re: We'd lose our security certificate if we allowed pasting

#17

Post by huhtenberg »

eximius wrote: post #6
quchen wrote: post #3

Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.

Mine is 10 digits. I thought the 4 digit limit was just a societal assumption? (I'm being serious, I thought it was (near) universally allowed to be longer, people just didn't bother.) Is this not the case?

Mine was 8 until I came to visit certain European country where every single terminal has PIN length capped at 6. The best vacation I ever had.

Re: We'd lose our security certificate if we allowed pasting

#18

Post by praptak »

PeterisP wrote: post #7
quchen wrote: post #3

Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.

Well, it's not like my card is hooked up to the internet for everybody to try and log in. PIN isn't particularly vulnerable to brute force anyway, as number of failed authorisation attempts is strictly limited to something like 3, and a fraudster has to risk capture by being physically present at each attempt or 'trying out' a stolen card, and having their face recorded on cameras. I haven't seen any advantages for u…

> Now, checking "signature" instead of chip&pin, now that's an example of blind trust.

If even. I cannot find the original report, but there was a guy who tried all kinds of weird signatures including "I STOLE THIS CARD" and it only took purchasing 3 most expensive TVs and signing "NOT AUTHORIZED" for someone to question him.

Unoriginal report: http://www.getrichslowly.org/blog/2006/07/29/the-credit-card...

Re: We'd lose our security certificate if we allowed pasting

#19

Post by nraynaud »

pjc50 wrote: post #2

Almost all big companies handle security on this kind of cargo-cult basis, because it's easier than finding someone who understands security and letting them overrule stupid ideas.

maybe this loud PR thing will go up to the people in charge and stuff could be actually resolved at the root? Or maybe it will just be forbidden to tweet about internal policies in the future for security reasons, NSA cover style.

Re: We'd lose our security certificate if we allowed pasting

#20

Post by SideburnsOfDoom »

Dylan16807 wrote: post #8
quchen wrote: post #3

Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.

Losing passwords is bad because they get reused. 4-digit pin not so much, debit card is basically the only thing that uses it.

You don't have to re-use passwords. In fact, don't re-use passwords. Keeping them in a password manager helps a lot with this. I have over 50 unique passwords which are all long, generated random strings. But there are a few websites, including British Gas, which get shitty weak passwords because they pull dumb crap like this in the name of "security".
Post reply on HN