111–120 of 225 posts
Earlier quoted context omitted.
Do you not have to confirm outgoing wire transfers by inputting a code sent to your phone?
Americans don't do wire transfers, they write checks. The level of kidding in the previous sentence is extremely low.
They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.
I guess that means they're wide open to denial of service attacks, but that's another story.
Earlier quoted context omitted.
Well, it's not like my card is hooked up to the internet for everybody to try and log in. PIN isn't particularly vulnerable to brute force anyway, as number of failed authorisation attempts is strictly limited to something like 3, and a fraudster has to risk capture by being physically present at each attempt or 'trying out' a stolen card, and having their face recorded on cameras. I haven't seen any advantages for u…
I was once refused a consumer credit application for a kitchen appliance because I'd forgotten to sign the back of my credit card. I had a passport and a photo driving license on me at the time but because there wasn't a signature they "couldn't be sure" it was me so they refused to process the application. I signed it in front of them (which matched my passport signature BTW) but was politely declined as they'd seen…
Earlier quoted context omitted.
If a bank use passwords at all, its a big red sign that they only care about the appearance of security. A password do not strongly identify a person, and should not be used for anything that involve high value and easy stolen property. Most banks I know uses pin and either a hardware token or a bound smart phone. Its far from perfect, but at least someone has to steal a physical object or hack the phone system to st…
Not in the US. Not one of my banks or other finance-related websites uses two-factor authentication by default. I haven't looked to see if any offer it as an option, but I tend to doubt it (it certainly isn't advertised).
Earlier quoted context omitted.
If a bank use passwords at all, its a big red sign that they only care about the appearance of security. A password do not strongly identify a person, and should not be used for anything that involve high value and easy stolen property. Most banks I know uses pin and either a hardware token or a bound smart phone. Its far from perfect, but at least someone has to steal a physical object or hack the phone system to st…
A pin is just a very short password. A bank using only a password would of course be ridiculously negligent. All banks I'm familiar with use 2 levels of authorization: 1 to log in, 1 to authorize payment. I have 2 bank accounts. One with ING (a major Dutch/international bank), which uses a password (without special characters unfortunately) to log in, and an authorization code to authorize payment. In my case, that a…
Of course, if anyone did try to steal my money this way, the bank would reverse the transfer and give it back to me.
It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…
Ditching symbols makes reciting passwords easier for telebanking.
Earlier quoted context omitted.
No, it could have just been random. They've reduced their keyspace massively by doing that. Six characters, all numbers, no ascending or descending. 123849 is invalid as an example, as is 954391.
so 741963 would pass? Not sure how that rule your stated actually functions, I am probably over thinking it. I am curious what simple pattern people will adapt to once you eliminate simple sequences. It has got to be predictable, as in someone could put math behind it.
I'm of the opinion that everybody should be given public and private key at birth.
Earlier quoted context omitted.
> ... stupid password requirements; max lengths ... > ... if they are hashing the passwords in any form then it doesn't matter how long the password is ... Max lengths aren't inherently stupid. Presumably no one thinks 250MB password submissions should be handled, so you will be picking some number (possibly imposed on you by your stack).
I think you failed to understand the second point you quoted. A 250MB password should be perfectly valid (if a bit foolish on the customer's part). That 250MB password will be run through scrypt by javascript running on the browser. (That may take a while, and a large amount of memory, but this is part of the CUSTOMER'S stack, not the server's.) Some amount, perhaps 512 bits worth, is then passed to the server. (Wher…
No, it will not. Nobody does this.
They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.
Earlier quoted context omitted.
I have had quite a few sites block my account for three bad password attempts and I had to actually call the company to unlock the account (this was always a financial services company). It's quite annoying as none of the sites warned me about the impending account block after the first or second try. I guess it's an inconvenience that is worth it for the extra anti-brute-force security. Being locked out due to someo…
It's always annoyed me how people set the lockout after n attempts value to ~3 or 4. Why not 100? It makes almost no difference in your chances at brute forcing a password, but means that the real user trying all the passwords they might have used won't get locked out mid way.