Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We'd lose our security certificate if we allowed pasting

twitter.com

Post reply on HN
Print view View original

71–80 of 225 posts

Re: We'd lose our security certificate if we allowed pasting

#71

Post by Dylan16807 »

SideburnsOfDoom wrote: post #20
Dylan16807 wrote: post #8

Earlier quoted context omitted.

Losing passwords is bad because they get reused. 4-digit pin not so much, debit card is basically the only thing that uses it.

You don't have to re-use passwords. In fact, don't re-use passwords. Keeping them in a password manager helps a lot with this. I have over 50 unique passwords which are all long, generated random strings. But there are a few websites, including British Gas, which get shitty weak passwords because they pull dumb crap like this in the name of "security".

People shouldn't but they do.

If they didn't then password breaches would barely matter.

Re: We'd lose our security certificate if we allowed pasting

#72

Post by randlet »

dougedey wrote: post #43
fdej wrote: post #29

They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.

My bank (TD Canada) used to have this policy. Luckily it changed. However, they didn't tell me (or anyone) so I've been telling everyone I know to update their password to be longer.

TD's password is still HORRIBLE. It is case insensitive and ignores anything after the first 8 characters and doesn't allow special characters.

If my password is "aBc123De" I can log in by entering the password "ABC123DEFOOBARBAZ".

Re: We'd lose our security certificate if we allowed pasting

#74

Post by davb »

afro88 wrote: post #66
err4nt wrote: post #51

Earlier quoted context omitted.

"Most banks you know"? I'm genuinely curious, I don't know of any bank like that in Canada, and I'm in the US weekly and I've never heard or seen it there. I've seen token generator keychains, but what do you mean about the phone?

It's pretty standard in the UK

None of my personal accounts in the UK use two factor authentication. Same goes for the majority of friends and family.

Only one (former) account ever done this, and it was own used when adding a new payee records. It used EMV CAP (http://en.wikipedia.org/wiki/Chip_Authentication_Program) with a separate smartcard (not my EMV compliant debit card).

All of my business accounts offer two factor authentication, recently shifting from SecurID-style TOTP tokens to EMV CAP authenticators.

Re: We'd lose our security certificate if we allowed pasting

#76

Post by dagw »

err4nt wrote: post #51
belorn wrote: post #48

Earlier quoted context omitted.

If a bank use passwords at all, its a big red sign that they only care about the appearance of security. A password do not strongly identify a person, and should not be used for anything that involve high value and easy stolen property. Most banks I know uses pin and either a hardware token or a bound smart phone. Its far from perfect, but at least someone has to steal a physical object or hack the phone system to st…

"Most banks you know"? I'm genuinely curious, I don't know of any bank like that in Canada, and I'm in the US weekly and I've never heard or seen it there. I've seen token generator keychains, but what do you mean about the phone?

I've been online banking in Norway and Sweden since 1999 and I've never seen a bank that just uses passwords.

For phones you download an app and enter a unique security code that you get from your bank. This, combined with some uid on your phone, creates a unique salt and basically ties that copy of the app on that phone to your bank account, so only your phone can log into your account. Your phone now becomes the "something you have" in addition to the "something you know" (your chosen bank password)

Re: We'd lose our security certificate if we allowed pasting

#77

Post by [deleted] »

nwh wrote: post #64
V-2 wrote: post #49

Earlier quoted context omitted.

Given that they've requested you to change password to conform to the new rule, I believe you were within these 99%? ;)

No, it could have just been random. They've reduced their keyspace massively by doing that. Six characters, all numbers, no ascending or descending. 123849 is invalid as an example, as is 954391.

[deleted]

Re: We'd lose our security certificate if we allowed pasting

#78

Post by aylons »

err4nt wrote: post #51
belorn wrote: post #48

Earlier quoted context omitted.

If a bank use passwords at all, its a big red sign that they only care about the appearance of security. A password do not strongly identify a person, and should not be used for anything that involve high value and easy stolen property. Most banks I know uses pin and either a hardware token or a bound smart phone. Its far from perfect, but at least someone has to steal a physical object or hack the phone system to st…

"Most banks you know"? I'm genuinely curious, I don't know of any bank like that in Canada, and I'm in the US weekly and I've never heard or seen it there. I've seen token generator keychains, but what do you mean about the phone?

In Brazil, most banks use two-factor authentication in some form for internet transactions.

One of my banks gives me the option to receive the code through SMS, generate it through a phone app or with a dedicated keyring token. This is a option I can make at the time transaction-time.

The other requires me to authenticate each new machine I login from, through an SMS. A bit less secure.

Biometrical authentication is also a thing. The biggest banks already have some form of it (fingerprint or hand palm), and I can even make transactions w/o a card, using only fingerprint and password. Actually, I only carry credit cards nowadays, the bank account card stays at home and use fingerprint to withdraw.

Re: We'd lose our security certificate if we allowed pasting

#79

Post by etimberg »

dougedey wrote: post #43
fdej wrote: post #29

They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.

My bank (TD Canada) used to have this policy. Luckily it changed. However, they didn't tell me (or anyone) so I've been telling everyone I know to update their password to be longer.

I didn't know they changed their policy, so thanks :). Their old policy stripped out capital letters too which made it even less secure. Sadly it still doesn't allow all special characters, but it's a start.

Re: We'd lose our security certificate if we allowed pasting

#80

Post by jrockway »

randlet wrote: post #72
dougedey wrote: post #43

Earlier quoted context omitted.

My bank (TD Canada) used to have this policy. Luckily it changed. However, they didn't tell me (or anyone) so I've been telling everyone I know to update their password to be longer.

TD's password is still HORRIBLE. It is case insensitive and ignores anything after the first 8 characters and doesn't allow special characters. If my password is "aBc123De" I can log in by entering the password "ABC123DEFOOBARBAZ".

Better than idiotic websites that enforce their character length limit on the client, but not on all pages on the client. So you can change your password to 123456789, but the login page will truncate it to 12345678
Post reply on HN