Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We'd lose our security certificate if we allowed pasting

twitter.com

Post reply on HN
Print view View original

101–110 of 225 posts

Re: We'd lose our security certificate if we allowed pasting

#101

Post by scrabble »

a_bonobo wrote: post #38
fdej wrote: post #29

They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.

Same goes for Virgin Mobile (at least here in Australia), which ALSO requires you to only use numbers. Last week they forced me to change my password due to an "important change" - ascending or descending numbers were not allowed anymore. I guess they had a look at their plain text password database and realized that 99% of their users used 123456. Edit: Australia seems to be using the US system: http://www.bitdefend…

That sounds like a much better security fix than allowing the full range of alphanumeric characters + symbols.

Re: We'd lose our security certificate if we allowed pasting

#102

Post by frou_dh »

lmm wrote: post #63
frou_dh wrote: post #40

Earlier quoted context omitted.

> ... stupid password requirements; max lengths ... > ... if they are hashing the passwords in any form then it doesn't matter how long the password is ... Max lengths aren't inherently stupid. Presumably no one thinks 250MB password submissions should be handled, so you will be picking some number (possibly imposed on you by your stack).

If you're hashing it who cares if someone wants to submit a 250MB password? They'll only be slowing their own session down - what I store in the database is always 256 bits either way.

Predictably this just regresses to what constitutes a big number. Take your pick for one that would cause noteworthy resource consumption in a given system.

Re: We'd lose our security certificate if we allowed pasting

#103

Post by johnbellone »

randlet wrote: post #72
dougedey wrote: post #43

Earlier quoted context omitted.

My bank (TD Canada) used to have this policy. Luckily it changed. However, they didn't tell me (or anyone) so I've been telling everyone I know to update their password to be longer.

TD's password is still HORRIBLE. It is case insensitive and ignores anything after the first 8 characters and doesn't allow special characters. If my password is "aBc123De" I can log in by entering the password "ABC123DEFOOBARBAZ".

Perhaps this[1] has something to do with it?

[1]: http://stackoverflow.com/questions/2179649/are-passwords-on-...

Re: We'd lose our security certificate if we allowed pasting

#104

Post by dave84 »

Kudos wrote: post #96
mcv wrote: post #84

Earlier quoted context omitted.

6 characters for a bank password?! Get a better bank! It's unbelievable how bad the password policies of some banks are. Mine doesn't allow special characters, for example. Fortunately it does allow longer passwords at least.

That's nothing, mine's a 5 digit pin code which they only validate 3 of in a random order (to annoy keyloggers, I assume) plus the last 4 digits of my phone number. Edit: This feels like the scene where Mel Gibson and Rene Russo compare scars in Lethal Weapon 3.

Sounds like AIB. If you use the app they don't even ask for the last 4 digits of your phone number.

Re: We'd lose our security certificate if we allowed pasting

#105

Post by maaarghk »

Kudos wrote: post #96
mcv wrote: post #84

Earlier quoted context omitted.

6 characters for a bank password?! Get a better bank! It's unbelievable how bad the password policies of some banks are. Mine doesn't allow special characters, for example. Fortunately it does allow longer passwords at least.

That's nothing, mine's a 5 digit pin code which they only validate 3 of in a random order (to annoy keyloggers, I assume) plus the last 4 digits of my phone number. Edit: This feels like the scene where Mel Gibson and Rene Russo compare scars in Lethal Weapon 3.

Yeah, similarly, Lloyds/HBOS in the UK do allow you to have a master password but you also need to fill out a "memorable information" where you select 3 random characters from a second password. But you don't type them, you select them from a drop down. I can see how this would annoy the most basic of keyloggers but it is also a UX disaster and not suitable for decent loggers. Pisses me off.

Re: We'd lose our security certificate if we allowed pasting

#106

Post by chrismorgan »

lsh wrote: post #90
err4nt wrote: post #51

Earlier quoted context omitted.

"Most banks you know"? I'm genuinely curious, I don't know of any bank like that in Canada, and I'm in the US weekly and I've never heard or seen it there. I've seen token generator keychains, but what do you mean about the phone?

NAB (National Australia Bank) require a bound mobile phone for a lot of operations. Its a real pain, given that I now live overseas.

I don’t have a mobile phone; my experience with NAB’s Internet banking is that there are a few things which want that, such as viewing or changing daily limits, but so long as you never set up SMS Alerts just about everything else is fine. I don’t believe I’ve ever run into any problems with them due to not having a mobile phone. If you’ve already set up SMS Alerts, I don’t know what the situation is.

Re: We'd lose our security certificate if we allowed pasting

#107

Post by mcv »

belorn wrote: post #48
DomBlack wrote: post #22

It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…

If a bank use passwords at all, its a big red sign that they only care about the appearance of security. A password do not strongly identify a person, and should not be used for anything that involve high value and easy stolen property. Most banks I know uses pin and either a hardware token or a bound smart phone. Its far from perfect, but at least someone has to steal a physical object or hack the phone system to st…

A pin is just a very short password. A bank using only a password would of course be ridiculously negligent. All banks I'm familiar with use 2 levels of authorization: 1 to log in, 1 to authorize payment.

I have 2 bank accounts. One with ING (a major Dutch/international bank), which uses a password (without special characters unfortunately) to log in, and an authorization code to authorize payment. In my case, that authorization code comes from a piece of paper with a bunch of one-time codes on it. This is an old system that dates back to when you called them directly by modem, rather than over internet. Nowadays I could also have the code sent to my phone. But phones can also be stolen, so I don't see the point.

My other account (at Triodos, a much smaller Dutch bank) uses a pin + hardware token at both stages. I wouldn't also having a ridiculously long password there.

Re: We'd lose our security certificate if we allowed pasting

#108

Post by coldcode »

higherpurpose wrote: post #59
nraynaud wrote: post #19

Earlier quoted context omitted.

maybe this loud PR thing will go up to the people in charge and stuff could be actually resolved at the root? Or maybe it will just be forbidden to tweet about internal policies in the future for security reasons, NSA cover style.

I was hoping the Target CEO firing/resignation due to security issues would spark a little bit of security interest from other companies, too.

He's getting $55M to leave. Sounds more like an encouragement to do stupid things to me.

Re: We'd lose our security certificate if we allowed pasting

#109

Post by kleim »

a_bonobo wrote: post #38
fdej wrote: post #29

They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.

Same goes for Virgin Mobile (at least here in Australia), which ALSO requires you to only use numbers. Last week they forced me to change my password due to an "important change" - ascending or descending numbers were not allowed anymore. I guess they had a look at their plain text password database and realized that 99% of their users used 123456. Edit: Australia seems to be using the US system: http://www.bitdefend…

Same goes for Virgin Mobile France.

Re: We'd lose our security certificate if we allowed pasting

#110

Post by emeidi »

err4nt wrote: post #51
belorn wrote: post #48

Earlier quoted context omitted.

If a bank use passwords at all, its a big red sign that they only care about the appearance of security. A password do not strongly identify a person, and should not be used for anything that involve high value and easy stolen property. Most banks I know uses pin and either a hardware token or a bound smart phone. Its far from perfect, but at least someone has to steal a physical object or hack the phone system to st…

"Most banks you know"? I'm genuinely curious, I don't know of any bank like that in Canada, and I'm in the US weekly and I've never heard or seen it there. I've seen token generator keychains, but what do you mean about the phone?

Every Swiss bank I have accounts with (Credit Suisse, Postfinance, Raiffeisen) have internet banking protected with two factor authentication. The second factor can either be a chip card with a reader (protected by a PIN, and you then enter a code shown on screen and it returns another number), an SMS token or an iPhone app which reads a picture of the screen (!) and returns another token number (with a SMS token fallback).
Post reply on HN