Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We'd lose our security certificate if we allowed pasting

twitter.com

Post reply on HN
Print view View original

31–40 of 225 posts

Re: We'd lose our security certificate if we allowed pasting

#31

Post by raesene3 »

eyko wrote: post #12
morsch wrote: post #4

Earlier quoted context omitted.

It's secured by a four digit password and self destruction after three consecutive invalid PIN entries. Which is plenty secure against brute force. Or is that just the way it works around here?

Unless you buy online, in which case you just need the "last 3 digits on the back of your card".

That's different to the PIN. CVV is for cardholder not present transactions, PIN is for one's where you're there.

Also CVV needs the 16 digit card number, card holder name and expiry as well..

I'd almost guarantee that trying to brute-force a CVV number will get your card blocked real fast.

Re: We'd lose our security certificate if we allowed pasting

#32

Post by bsilvereagle »

nodata wrote: post #24
DomBlack wrote: post #22

It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…

What if the password is one character long?

DomBlack is referring to max length. For example several banks limit you to a 12 character long password and then don't allow special characters.

Re: We'd lose our security certificate if we allowed pasting

#34

Post by raesene3 »

fdej wrote: post #29

They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.

Very likely to be a legacy back-end system. Doesn't excuse it at all, but that's one I've seen limit banking systems in the past either in password length, complexity or case sensitivity (I've seen some systems automatically upcase passwords without telling you 'cause the back-end is case insensitive)

Re: We'd lose our security certificate if we allowed pasting

#35

Post by raesene3 »

DomBlack wrote: post #22

It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…

Some of this kind of system won't actually hash the password but encrypt it and use an HSM to secure the keys.

Wherever you see a password prompt where the ask for specific characters of the password, they're either doing this or shudder storing it in the clear.

Re: We'd lose our security certificate if we allowed pasting

#36

Post by wzdd »

DomBlack wrote: post #22

It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…

The last bank backend I worked around was composed of several interacting systems, written 30 or 40 years ago in COBOL, which ran batch jobs overnight and communicated with each other by writing files to disk. We were strongly encouraged to get the format of the file exactly right, or the batch job in question wouldn't run and nobody would be able to sort it out until morning. Passwords weren't involved but, if they had been, I am quite sure they would have been stored verbatim.

So, two problems: multiple interacting systems, which means you can't just fix one, you have to fix all of them; and lots of legacy code. Versus: there would certainly be quite a lot of pain to implement a new system, and the old one appears to be working.

Re: We'd lose our security certificate if we allowed pasting

#37

Post by reboog711 »

To me this sounds like a crazy PCI Compliance related rule; and someone who doesn't understand anything about the PCI Compliance process or brute force hacking made the tweet.

When I ran a web-site with an e-commerce store that accepted credit cards; I was required to have PCI Compliance scans done.

One of the things they had me do was turn off the autocomplete on the password field with autocomplete="off". I have no idea how that makes things more secure.

A lot of the things they made me do in order to be PCI compliant made no sense to me. I think I spent a week trying to convince them that my "error" page which showed up when someone mistyped a URL was not a security risk and was not something I should remove.

Re: We'd lose our security certificate if we allowed pasting

#38

Post by a_bonobo »

fdej wrote: post #29

They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.

Same goes for Virgin Mobile (at least here in Australia), which ALSO requires you to only use numbers. Last week they forced me to change my password due to an "important change" - ascending or descending numbers were not allowed anymore. I guess they had a look at their plain text password database and realized that 99% of their users used 123456.

Edit: Australia seems to be using the US system: http://www.bitdefender.com/security/hacking-virgin-mobile-us...

Re: We'd lose our security certificate if we allowed pasting

#39

Post by lostcolony »

danpalmer wrote: post #23
praptak wrote: post #18

Earlier quoted context omitted.

> Now, checking "signature" instead of chip&pin, now that's an example of blind trust. If even. I cannot find the original report, but there was a guy who tried all kinds of weird signatures including "I STOLE THIS CARD" and it only took purchasing 3 most expensive TVs and signing "NOT AUTHORIZED" for someone to question him. Unoriginal report: http://www.getrichslowly.org/blog/2006/07/29/the-credit-card...

Interestingly, the signature could be argued to be better in some cases: Under British law, a forged signature is never your fault, and the bank/merchant/card processor are liable (I can't remember exactly which, I think it depends). One of the reason that card issuers were so keen to switch to Chip&PIN/EMV is that the liability was turned over to the user . As they thought EMV was "unhackable", always a dangerous th…

It's better for the user when it comes to challenging a fraudulent purchase, but in terms of security, it's worse. That was the point.

Re: We'd lose our security certificate if we allowed pasting

#40

Post by frou_dh »

DomBlack wrote: post #22

It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…

> ... stupid password requirements; max lengths ...

> ... if they are hashing the passwords in any form then it doesn't matter how long the password is ...

Max lengths aren't inherently stupid. Presumably no one thinks 250MB password submissions should be handled, so you will be picking some number (possibly imposed on you by your stack).

Post reply on HN