Live data from Hacker News

We'd lose our security certificate if we allowed pasting

twitter.com

121–130 of 225 posts

Re: We'd lose our security certificate if we allowed pasting

#121
post #55

Earlier quoted context omitted.

Do you not have to confirm outgoing wire transfers by inputting a code sent to your phone?

Americans don't do wire transfers, they write checks. The level of kidding in the previous sentence is extremely low.

I believe you're a UK but no offense intended if you're not. As an actual american I only write about three or four checks per year, everything else is online.

We do pull and push.

Pulls are an unholy PITA to set up where you give them all kinds of personally identifiable information which they hopefully won't lose, then they make multiple couple cent deposits to your account, then you tell them what the amounts were and they tell the bank, which creates a certain relationship which in the Future is very historical trust based. So click here on your car insurance site to make your biannual car insurance payment exactly like the last 20 payments (well, slightly different amounts, but ...) Ditto the mortgage website, the electric bill, a couple others. Basically very long term relationships, I'm unlikely to just randomly stop paying the monopoly electricity provider. This is a direct acct to acct transfer.

Pushes are easy to set up but more of a pain to use on a monthly basis. No one has control over pushes other than yourself. You send money to a postal address, and who knows what they do on the back end, individual old fashioned checks or batch up or wire transfers who knows. This is more for credit cards or temporary less formal associations. You go to your bank website, tell them the postal address (they'll save it for later use) tell them how much, click send, off it goes.

Speaking generically, most USA people use credit cards or paypal or the zillions of small time competitors when someone wants money from them, and they interface with the bank for you. So Paypal can eat money directly out of my checking acct to send cash, up to certain limits. This is vaguely ATM like, sort of a web interface to a ATM. Or it just gets added to the CC balance. So it would be really weird for me to pay directly for gasoline or even food, I generally CC that, and then send one very large "push" bill payment from the bank to the CC per month.

So Americans mostly do electronic pushes, pulls, and aggregators online, although we do have checks for non-electronic people.

I write a check to the school district for book + other fees, like $50 per year per kid. Technically its illegal to demand payment for free public schools but the PTO spends it on "free" after school activities so its kinda a donation and I think we get our monies worth. Also my wife buys an organic grown fraction of a cow from a local farmer every year or so, and the butcher shop takes electronic for processing but the old school farmer still does paper checks. Some tradesmen (plumber, carpenter) only take old fashioned paper checks, although that is very rapidly changing as they all get smart phones. I switched to a CU probably 7 to 10 years ago and since then I've written a couple dozen checks total, I'd have to find it to verify because I keep it locked up.

Some really old people, like non-computational, obviously write a lot of checks. I have an elderly uncle who had to pay an extra bank fee for writing more than two dozen a month, which seems weird to me.

Poor people with serious legal / financial issues are unbanked and mostly go pure cash. There's a whole industry grown around ripping off those people when they try to interface semi-legally with the financial system. This is probably less than 1/4 the population. Like if you owe child support or a court judgment, all your electronic money will simply disappear, but not your cash, leading to some peculiar behaviors.

Re: We'd lose our security certificate if we allowed pasting

#122
post #85

So, this is just someone on the BritishGas twitter account. We do not know if that person is repeating accurately what they've been told or just making stuff up. Assuming they asked the correct people in BG website accounts security, and those people said "it's to prevent brute force attacks" we do not know if that's the real reason they do it or if it's just what they say to people who ask. What is really frustratin…

The reason is irrelevant - there is no reason why you should do this.

Re: We'd lose our security certificate if we allowed pasting

#123
post #63
post #40

Earlier quoted context omitted.

> ... stupid password requirements; max lengths ... > ... if they are hashing the passwords in any form then it doesn't matter how long the password is ... Max lengths aren't inherently stupid. Presumably no one thinks 250MB password submissions should be handled, so you will be picking some number (possibly imposed on you by your stack).

If you're hashing it who cares if someone wants to submit a 250MB password? They'll only be slowing their own session down - what I store in the database is always 256 bits either way.

Because your app has to load it all into memory. Submitting many, very large payloads is a well known denial-of-service attack

Re: We'd lose our security certificate if we allowed pasting

#124
post #64

Earlier quoted context omitted.

No, it could have just been random. They've reduced their keyspace massively by doing that. Six characters, all numbers, no ascending or descending. 123849 is invalid as an example, as is 954391.

so 741963 would pass? Not sure how that rule your stated actually functions, I am probably over thinking it. I am curious what simple pattern people will adapt to once you eliminate simple sequences. It has got to be predictable, as in someone could put math behind it.

My guess (with nothing to back it up) is people will start moving into paterns of 963 852 741 or the reverse since they're easy to type on the numpad without really remembering the values.

edit: On second look, that's exactly what you did in your example.

Re: We'd lose our security certificate if we allowed pasting

#125
post #2

Almost all big companies handle security on this kind of cargo-cult basis, because it's easier than finding someone who understands security and letting them overrule stupid ideas.

Put yourself in their shoes though. The people at the top don't really understand security, other than the vague "only the right people should have access to stuff" requirement.

I think the problem is that the people in charge of making decisions are gun-shy. Because of their inability to properly evaluate the security itself, it's also very difficult for them to properly evaluate people telling them what the security system should look like, and they've been burned by bad decisions in the past, so they take the "lalalala do nothing" approach and hope for the best. From their point of view, it's a perfectly reasonable approach to the problem.

Re: We'd lose our security certificate if we allowed pasting

#126
post #40

It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…

> ... stupid password requirements; max lengths ... > ... if they are hashing the passwords in any form then it doesn't matter how long the password is ... Max lengths aren't inherently stupid. Presumably no one thinks 250MB password submissions should be handled, so you will be picking some number (possibly imposed on you by your stack).

A 250MB requests should get blocked by your web server way before it touches your code or your database.

But yes, you're right, limiting passwords can help avoiding edge cases where a long password is not handled correctly ecc... Just pick a sane length that no-one will hit, like 1000 chars or more.

Re: We'd lose our security certificate if we allowed pasting

#127
post #29

They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.

Same goes for Virgin Mobile (at least here in Australia), which ALSO requires you to only use numbers. Last week they forced me to change my password due to an "important change" - ascending or descending numbers were not allowed anymore. I guess they had a look at their plain text password database and realized that 99% of their users used 123456. Edit: Australia seems to be using the US system: http://www.bitdefend…

I have Virgin Mobile in the US (it's one of the cheapest options with good quality phones), and it seems the same. It made me set a 6-digit PIN as my password, and my phone number is my username. Here are the requirements listed on their website:

Your Account PIN must be:

-6 numbers (no letters or special characters)

-no more than 3 identical numbers in a row (222)

-no more than 3 sequential numbers (such as 234)

If I did the math right, that's approximately 900,000 possible passwords, which is obviously really low

Re: We'd lose our security certificate if we allowed pasting

#128
I would guess that the single greatest hole in computer / network security comes from the terror regime of incompetently enforced “security”. Users WILL get their revenge by undermining such measures any way they can in order to re-establish some usability. Like the best camera is always the one you have with you, the best security is the one your users will actually support, and not feel forced to circumvent.

Re: We'd lose our security certificate if we allowed pasting

#129
post #84
post #29

They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.

6 characters for a bank password?! Get a better bank! It's unbelievable how bad the password policies of some banks are. Mine doesn't allow special characters, for example. Fortunately it does allow longer passwords at least.

My bank not only allows a maximum of 6 characters, but it truncates all characters beyond 6 when processing the login form. If my password was "passwd", they would accept "passwdjdodw89wawlks".

Re: We'd lose our security certificate if we allowed pasting

#130

Earlier quoted context omitted.

Interestingly, the signature could be argued to be better in some cases: Under British law, a forged signature is never your fault, and the bank/merchant/card processor are liable (I can't remember exactly which, I think it depends). One of the reason that card issuers were so keen to switch to Chip&PIN/EMV is that the liability was turned over to the user . As they thought EMV was "unhackable", always a dangerous th…

It's better for the user when it comes to challenging a fraudulent purchase, but in terms of security, it's worse. That was the point.

There is no such thing as just "security".

If the expected loss of funds for the user is lower, it is more secure - for the user.

Post reply on HN