Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We'd lose our security certificate if we allowed pasting

twitter.com

Post reply on HN
Print view View original

51–60 of 225 posts

Re: We'd lose our security certificate if we allowed pasting

#51

Post by err4nt »

belorn wrote: post #48
DomBlack wrote: post #22

It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…

If a bank use passwords at all, its a big red sign that they only care about the appearance of security. A password do not strongly identify a person, and should not be used for anything that involve high value and easy stolen property. Most banks I know uses pin and either a hardware token or a bound smart phone. Its far from perfect, but at least someone has to steal a physical object or hack the phone system to st…

"Most banks you know"? I'm genuinely curious, I don't know of any bank like that in Canada, and I'm in the US weekly and I've never heard or seen it there. I've seen token generator keychains, but what do you mean about the phone?

Re: We'd lose our security certificate if we allowed pasting

#52

Post by heldtogether »

PeterisP wrote: post #7
quchen wrote: post #3

Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.

Well, it's not like my card is hooked up to the internet for everybody to try and log in. PIN isn't particularly vulnerable to brute force anyway, as number of failed authorisation attempts is strictly limited to something like 3, and a fraudster has to risk capture by being physically present at each attempt or 'trying out' a stolen card, and having their face recorded on cameras. I haven't seen any advantages for u…

I was once refused a consumer credit application for a kitchen appliance because I'd forgotten to sign the back of my credit card. I had a passport and a photo driving license on me at the time but because there wasn't a signature they "couldn't be sure" it was me so they refused to process the application.

I signed it in front of them (which matched my passport signature BTW) but was politely declined as they'd seen the card unsigned.

Another example of security policy getting in the way of actual security.

Re: We'd lose our security certificate if we allowed pasting

#53

Post by iancarroll »

reboog711 wrote: post #37

To me this sounds like a crazy PCI Compliance related rule; and someone who doesn't understand anything about the PCI Compliance process or brute force hacking made the tweet. When I ran a web-site with an e-commerce store that accepted credit cards; I was required to have PCI Compliance scans done. One of the things they had me do was turn off the autocomplete on the password field with autocomplete="off". I have no…

It's standard security practice to disable autocomplete for secure pages.

Re: We'd lose our security certificate if we allowed pasting

#54

Post by madeofpalk »

Nursie wrote: post #41
quchen wrote: post #3

Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.

The standards allow for up to 12. Not that people always implement them properly, but that's what you're supposed to support if (like me at the moment) you make credit-card terminals.

Cards issued by Commonwealth Bank in Australia actually don't come with a PIN - you set it yourself, up to 12 chars, online when you activate.

Re: We'd lose our security certificate if we allowed pasting

#55

Post by fwr »

err4nt wrote: post #51
belorn wrote: post #48

Earlier quoted context omitted.

If a bank use passwords at all, its a big red sign that they only care about the appearance of security. A password do not strongly identify a person, and should not be used for anything that involve high value and easy stolen property. Most banks I know uses pin and either a hardware token or a bound smart phone. Its far from perfect, but at least someone has to steal a physical object or hack the phone system to st…

"Most banks you know"? I'm genuinely curious, I don't know of any bank like that in Canada, and I'm in the US weekly and I've never heard or seen it there. I've seen token generator keychains, but what do you mean about the phone?

Do you not have to confirm outgoing wire transfers by inputting a code sent to your phone?

Re: We'd lose our security certificate if we allowed pasting

#56

Post by nly »

DomBlack wrote: post #22

It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…

Ditching symbols makes reciting passwords easier for telebanking.

Re: We'd lose our security certificate if we allowed pasting

#57

Post by acheron »

fdej wrote: post #29

They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.

Financial company I use apparently shares the same password between their web site and their automated phone system. So in addition to a max length of 10 or 12, you can't use anything non-alphanumeric since you wouldn't be able to enter it with a phone keypad.

Also rules out stored a hashed password, too. Terrible idea all around. (Edit: ok, I guess they could convert the PW to the phone key version when initially setting the PW, and then store both the hashed text PW and hashed phone key PW. So not "rules out". I just doubt they do it.)

Re: We'd lose our security certificate if we allowed pasting

#58

Post by mcherm »

frou_dh wrote: post #40
DomBlack wrote: post #22

It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…

> ... stupid password requirements; max lengths ... > ... if they are hashing the passwords in any form then it doesn't matter how long the password is ... Max lengths aren't inherently stupid. Presumably no one thinks 250MB password submissions should be handled, so you will be picking some number (possibly imposed on you by your stack).

I think you failed to understand the second point you quoted.

A 250MB password should be perfectly valid (if a bit foolish on the customer's part). That 250MB password will be run through scrypt by javascript running on the browser. (That may take a while, and a large amount of memory, but this is part of the CUSTOMER'S stack, not the server's.) Some amount, perhaps 512 bits worth, is then passed to the server. (Where it is run through another hash and then stored.)

Re: We'd lose our security certificate if we allowed pasting

#59

Post by higherpurpose »

nraynaud wrote: post #19
pjc50 wrote: post #2

Almost all big companies handle security on this kind of cargo-cult basis, because it's easier than finding someone who understands security and letting them overrule stupid ideas.

maybe this loud PR thing will go up to the people in charge and stuff could be actually resolved at the root? Or maybe it will just be forbidden to tweet about internal policies in the future for security reasons, NSA cover style.

I was hoping the Target CEO firing/resignation due to security issues would spark a little bit of security interest from other companies, too.

Re: We'd lose our security certificate if we allowed pasting

#60

Post by crbaker »

danpalmer wrote: post #30
DomBlack wrote: post #22

It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…

In the 1980s I don't think hashing passwords was common, it would have taken too much processing power, and the database fields on the mainframe don't support weird characters or a length of more than 8 characters. I wish this wasn't the case, but these systems are so old behind the scenes, that lots of it simply can't be changed without massive re-engineering. I have friends that work for a company who transfer COBO…

It will take these organisation years and lots of money to rebuild their reputations when their security malpractices catch up with them.
Post reply on HN