41–50 of 225 posts
Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.
To me this sounds like a crazy PCI Compliance related rule; and someone who doesn't understand anything about the PCI Compliance process or brute force hacking made the tweet. When I ran a web-site with an e-commerce store that accepted credit cards; I was required to have PCI Compliance scans done. One of the things they had me do was turn off the autocomplete on the password field with autocomplete="off". I have no…
They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.
However, they didn't tell me (or anyone) so I've been telling everyone I know to update their password to be longer.
Earlier quoted context omitted.
Well, it's not like my card is hooked up to the internet for everybody to try and log in. PIN isn't particularly vulnerable to brute force anyway, as number of failed authorisation attempts is strictly limited to something like 3, and a fraudster has to risk capture by being physically present at each attempt or 'trying out' a stolen card, and having their face recorded on cameras. I haven't seen any advantages for u…
> Now, checking "signature" instead of chip&pin, now that's an example of blind trust. If even. I cannot find the original report, but there was a guy who tried all kinds of weird signatures including "I STOLE THIS CARD" and it only took purchasing 3 most expensive TVs and signing "NOT AUTHORIZED" for someone to question him. Unoriginal report: http://www.getrichslowly.org/blog/2006/07/29/the-credit-card...
Earlier quoted context omitted.
> Now, checking "signature" instead of chip&pin, now that's an example of blind trust. If even. I cannot find the original report, but there was a guy who tried all kinds of weird signatures including "I STOLE THIS CARD" and it only took purchasing 3 most expensive TVs and signing "NOT AUTHORIZED" for someone to question him. Unoriginal report: http://www.getrichslowly.org/blog/2006/07/29/the-credit-card...
Interestingly, the signature could be argued to be better in some cases: Under British law, a forged signature is never your fault, and the bank/merchant/card processor are liable (I can't remember exactly which, I think it depends). One of the reason that card issuers were so keen to switch to Chip&PIN/EMV is that the liability was turned over to the user . As they thought EMV was "unhackable", always a dangerous th…
Not really true. The main reason was the switch in liability to the merchant, if the merchant accepted a transaction without using EMV and PIN.
AFAICT the Cambridge research isn't really that relevant, it doesn't really give you practical attacks, and it's not so much a crack on the chip security itself as it is a piece of Man-In-The-Middle hardware (IIRC, haven't read it for a couple of years).
Under UK law, with a credit card (debit is different), the liability is never with the user. The bank may claim that it was obviously you that did it, or that you gave away your PIN, but where credit is concerned they legally have to refund you the money pending an investigation.
Debit is less strongly protected and comes under banking rules and guidelines, and if you report unauthorised activity as fraud they will usually still take your side.
--edit-- I'm not trying to say EMV is bulletproof, nothing is bulletproof, but the primary method anyone's going to use to get your PIN is still social engineering, or possibly some sort of compromised terminal hardware, which they'd have to make from scratch because accredited devices disable themselves if they detect they've been tampered with.
To me this sounds like a crazy PCI Compliance related rule; and someone who doesn't understand anything about the PCI Compliance process or brute force hacking made the tweet. When I ran a web-site with an e-commerce store that accepted credit cards; I was required to have PCI Compliance scans done. One of the things they had me do was turn off the autocomplete on the password field with autocomplete="off". I have no…
It's arguable that it's not the website's decision where the user caches it's passwords, but in high security environments I don't think it is an overkill.
It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…
Most banks I know uses pin and either a hardware token or a bound smart phone. Its far from perfect, but at least someone has to steal a physical object or hack the phone system to start their brute-force attacks.
They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.
Same goes for Virgin Mobile (at least here in Australia), which ALSO requires you to only use numbers. Last week they forced me to change my password due to an "important change" - ascending or descending numbers were not allowed anymore. I guess they had a look at their plain text password database and realized that 99% of their users used 123456. Edit: Australia seems to be using the US system: http://www.bitdefend…
Earlier quoted context omitted.
Cards are way different. They combine something you have (the card) with something you know (the PIN). After three false attempts to enter the PIN you have to unlock the card going a different route. In such a scenario, 4 digits are fine. You can't lock accounts only protected by a password and accessible by anyone (via internet) this way as this would invite for Denial-of-Service attacks (locking your account with t…
I have had quite a few sites block my account for three bad password attempts and I had to actually call the company to unlock the account (this was always a financial services company). It's quite annoying as none of the sites warned me about the impending account block after the first or second try. I guess it's an inconvenience that is worth it for the extra anti-brute-force security. Being locked out due to someo…