Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We'd lose our security certificate if we allowed pasting

twitter.com

Post reply on HN
Print view View original

81–90 of 225 posts

Re: We'd lose our security certificate if we allowed pasting

#81

Post by Shivetya »

nwh wrote: post #64
V-2 wrote: post #49

Earlier quoted context omitted.

Given that they've requested you to change password to conform to the new rule, I believe you were within these 99%? ;)

No, it could have just been random. They've reduced their keyspace massively by doing that. Six characters, all numbers, no ascending or descending. 123849 is invalid as an example, as is 954391.

so 741963 would pass? Not sure how that rule your stated actually functions, I am probably over thinking it.

I am curious what simple pattern people will adapt to once you eliminate simple sequences. It has got to be predictable, as in someone could put math behind it.

Re: We'd lose our security certificate if we allowed pasting

#82

Post by barry-cotter »

fwr wrote: post #55
err4nt wrote: post #51

Earlier quoted context omitted.

"Most banks you know"? I'm genuinely curious, I don't know of any bank like that in Canada, and I'm in the US weekly and I've never heard or seen it there. I've seen token generator keychains, but what do you mean about the phone?

Do you not have to confirm outgoing wire transfers by inputting a code sent to your phone?

Americans don't do wire transfers, they write checks. The level of kidding in the previous sentence is extremely low.

Re: We'd lose our security certificate if we allowed pasting

#83

Post by dak1 »

heldtogether wrote: post #52
PeterisP wrote: post #7

Earlier quoted context omitted.

Well, it's not like my card is hooked up to the internet for everybody to try and log in. PIN isn't particularly vulnerable to brute force anyway, as number of failed authorisation attempts is strictly limited to something like 3, and a fraudster has to risk capture by being physically present at each attempt or 'trying out' a stolen card, and having their face recorded on cameras. I haven't seen any advantages for u…

I was once refused a consumer credit application for a kitchen appliance because I'd forgotten to sign the back of my credit card. I had a passport and a photo driving license on me at the time but because there wasn't a signature they "couldn't be sure" it was me so they refused to process the application. I signed it in front of them (which matched my passport signature BTW) but was politely declined as they'd seen…

I had a slightly similar experience: I forgot to sign the back of my card, but the person just asked me to sign it and then made sure it matched my signature on the receipt.

Re: We'd lose our security certificate if we allowed pasting

#84

Post by mcv »

fdej wrote: post #29

They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.

6 characters for a bank password?! Get a better bank!

It's unbelievable how bad the password policies of some banks are. Mine doesn't allow special characters, for example. Fortunately it does allow longer passwords at least.

Re: We'd lose our security certificate if we allowed pasting

#85

Post by DanBC »

So, this is just someone on the BritishGas twitter account. We do not know if that person is repeating accurately what they've been told or just making stuff up.

Assuming they asked the correct people in BG website accounts security, and those people said "it's to prevent brute force attacks" we do not know if that's the real reason they do it or if it's just what they say to people who ask.

What is really frustrating is that there is no possibility of getting this changed - allow people to paste their passwords and use rate limiting to catch brute forcing.

Having said that, some aspects of BG's computer system are horrific for customers so I don't doubt that they do stupid things for stupid reasons.

Re: We'd lose our security certificate if we allowed pasting

#86

Post by bradleyjg »

mcherm wrote: post #58
frou_dh wrote: post #40

Earlier quoted context omitted.

> ... stupid password requirements; max lengths ... > ... if they are hashing the passwords in any form then it doesn't matter how long the password is ... Max lengths aren't inherently stupid. Presumably no one thinks 250MB password submissions should be handled, so you will be picking some number (possibly imposed on you by your stack).

I think you failed to understand the second point you quoted. A 250MB password should be perfectly valid (if a bit foolish on the customer's part). That 250MB password will be run through scrypt by javascript running on the browser. (That may take a while, and a large amount of memory, but this is part of the CUSTOMER'S stack, not the server's.) Some amount, perhaps 512 bits worth, is then passed to the server. (Wher…

It's not at all common or best practices to run an expensive key derivation function browser side. Doing so adds little to no additional security -- if you don't trust the TLS channel then you are screwed any way you look at it.

Re: We'd lose our security certificate if we allowed pasting

#87

Post by dougedey »

randlet wrote: post #72
dougedey wrote: post #43

Earlier quoted context omitted.

My bank (TD Canada) used to have this policy. Luckily it changed. However, they didn't tell me (or anyone) so I've been telling everyone I know to update their password to be longer.

TD's password is still HORRIBLE. It is case insensitive and ignores anything after the first 8 characters and doesn't allow special characters. If my password is "aBc123De" I can log in by entering the password "ABC123DEFOOBARBAZ".

I just tested this, it is case sensitive and it doesn't ignore things after 8 characters.

I'm using TD Canada, not sure if they've maybe updated since you tried?

Re: We'd lose our security certificate if we allowed pasting

#88

Post by robryk »

acheron wrote: post #57
fdej wrote: post #29

They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.

Financial company I use apparently shares the same password between their web site and their automated phone system. So in addition to a max length of 10 or 12, you can't use anything non-alphanumeric since you wouldn't be able to enter it with a phone keypad. Also rules out stored a hashed password, too. Terrible idea all around. (Edit: ok, I guess they could convert the PW to the phone key version when initially se…

Even if they do, acquiring both of these hashes vastly helps with brute-forcing: you first break the phone key password and then check only the alphanumeric passwords that match it against the alphanumeric password's hash.

Re: We'd lose our security certificate if we allowed pasting

#89

Post by nwh »

Shivetya wrote: post #81
nwh wrote: post #64

Earlier quoted context omitted.

No, it could have just been random. They've reduced their keyspace massively by doing that. Six characters, all numbers, no ascending or descending. 123849 is invalid as an example, as is 954391.

so 741963 would pass? Not sure how that rule your stated actually functions, I am probably over thinking it. I am curious what simple pattern people will adapt to once you eliminate simple sequences. It has got to be predictable, as in someone could put math behind it.

Any run of three characters in sequence, forward or reverse, is marked as invalid. 123 876 432 would all mark the whole password as invalid, even if they only take up half the string. Yours would pass though, yes.

Re: We'd lose our security certificate if we allowed pasting

#90

Post by lsh »

err4nt wrote: post #51
belorn wrote: post #48

Earlier quoted context omitted.

If a bank use passwords at all, its a big red sign that they only care about the appearance of security. A password do not strongly identify a person, and should not be used for anything that involve high value and easy stolen property. Most banks I know uses pin and either a hardware token or a bound smart phone. Its far from perfect, but at least someone has to steal a physical object or hack the phone system to st…

"Most banks you know"? I'm genuinely curious, I don't know of any bank like that in Canada, and I'm in the US weekly and I've never heard or seen it there. I've seen token generator keychains, but what do you mean about the phone?

NAB (National Australia Bank) require a bound mobile phone for a lot of operations. Its a real pain, given that I now live overseas.
Post reply on HN