We'd lose our security certificate if we allowed pasting • Hacker News Board

Re: We'd lose our security certificate if we allowed pasting

#141

Post by mcv » Tue, May 06, 2014, 1:34 PM UTC

aianus wrote: post #115

mcv wrote: post #107

Earlier quoted context omitted.

A pin is just a very short password. A bank using only a password would of course be ridiculously negligent. All banks I'm familiar with use 2 levels of authorization: 1 to log in, 1 to authorize payment. I have 2 bank accounts. One with ING (a major Dutch/international bank), which uses a password (without special characters unfortunately) to log in, and an authorization code to authorize payment. In my case, that a…

All of the bank accounts I have in Canada let me send $2000 with nothing but a password. They also won't let me use non-alphanumeric passwords and don't support any two-factor authentication. Same in the US. Of course, if anyone did try to steal my money this way, the bank would reverse the transfer and give it back to me.

Sounds very insecure for a bank. Will they really automatically reverse any transfer you object to? What if they don't control the target account? What if there's no money on the other account anymore? What if it was a legitimate payment, you got what you ordered, and then you had the payment reversed?

I see a big hornet's nest of potential problems in a system like that.

Re: We'd lose our security certificate if we allowed pasting

#142

Post by jfoster » Tue, May 06, 2014, 1:36 PM UTC

mcv wrote: post #84

fdej wrote: post #29

They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.

6 characters for a bank password?! Get a better bank! It's unbelievable how bad the password policies of some banks are. Mine doesn't allow special characters, for example. Fortunately it does allow longer passwords at least.

One bank that I'm not going to identify is particularly scary. Predictable account number (sequential, I think) + 4 digit PIN. Even if they lock individual accounts after X retries, nothing prevents a well-distributed botnet from gaining access to an account (on average) every 10,000 attempts.

Re: We'd lose our security certificate if we allowed pasting

#143

Post by oneeyedpigeon » Tue, May 06, 2014, 1:37 PM UTC

tempodox wrote: post #131

mixedbit wrote: post #47

Reminds me of a password security policy that listed few SQL statements that can't be used in passwords.

That was probably to prevent SQL injection, right?

Can you really prevent SQL injection via a blacklist?

Re: We'd lose our security certificate if we allowed pasting

#144

Post by crazypyro » Tue, May 06, 2014, 1:37 PM UTC

higherpurpose wrote: post #59

nraynaud wrote: post #19

Earlier quoted context omitted.

maybe this loud PR thing will go up to the people in charge and stuff could be actually resolved at the root? Or maybe it will just be forbidden to tweet about internal policies in the future for security reasons, NSA cover style.

I was hoping the Target CEO firing/resignation due to security issues would spark a little bit of security interest from other companies, too.

Target was bleeding money in Canada expansion. I doubt the data breach was the only central issue.

Re: We'd lose our security certificate if we allowed pasting

#145

Post by michaelt » Tue, May 06, 2014, 1:37 PM UTC

lmm wrote: post #63

frou_dh wrote: post #40

Earlier quoted context omitted.

> ... stupid password requirements; max lengths ... > ... if they are hashing the passwords in any form then it doesn't matter how long the password is ... Max lengths aren't inherently stupid. Presumably no one thinks 250MB password submissions should be handled, so you will be picking some number (possibly imposed on you by your stack).

If you're hashing it who cares if someone wants to submit a 250MB password? They'll only be slowing their own session down - what I store in the database is always 256 bits either way.

Like a good developer, you run passwords through a slow hash function. This leaves you vulnerable to denial of service by wasting CPU hashing huge passwords: http://arstechnica.com/security/2013/09/long-passwords-are-g...

Re: We'd lose our security certificate if we allowed pasting

#146

Post by leetrout » Tue, May 06, 2014, 1:38 PM UTC

tempodox wrote: post #131

mixedbit wrote: post #47

Reminds me of a password security policy that listed few SQL statements that can't be used in passwords.

That was probably to prevent SQL injection, right?

Citi is the same way...

Nothing in their policy about what isn't allowed[0] and they updated their system one weekend and my password quit working because it had % in it. I called tech support over it and they offered no additional guidance.

https://www.accountonline.com/cards/svc/OutsideView.do?forwa...

Re: We'd lose our security certificate if we allowed pasting

#147

Post by jaredmcateer » Tue, May 06, 2014, 1:38 PM UTC

pjc50 wrote: post #2

Almost all big companies handle security on this kind of cargo-cult basis, because it's easier than finding someone who understands security and letting them overrule stupid ideas.

PCI compliance requires we change our login passwords every two months. This to me seems to just encourage users to create insecure passwords and sticky notes with them written down somewhere in/on their desk.

Re: We'd lose our security certificate if we allowed pasting

#148

Post by crashandburn4 » Tue, May 06, 2014, 1:39 PM UTC

omh wrote: post #27

crashandburn4 wrote: post #15

Earlier quoted context omitted.

I actually rely on this self destruction, I have a scrap of paper in my wallet with "Pin Numbers" written on it along with 3 random four digit numbers, gives me minor peace of mind that if my wallet is lost and found by someone that wants to try and use them, hopefully they'll lose them to an atm rather than using them online.

I like that idea. Unfortunately it doesn't prevent them using them online as well . At least for my cards, if I lock out the PIN I can still use them for non-PIN purchases.

Ah, in the UK it is standard for the machine to keep your card after three incorrect pin attempts. (at least I think it's the standard?)

Re: We'd lose our security certificate if we allowed pasting

#149

Post by danielweber » Tue, May 06, 2014, 1:39 PM UTC

NateDad wrote: post #114

alistairSH wrote: post #94

Earlier quoted context omitted.

Not in the US. Not one of my banks or other finance-related websites uses two-factor authentication by default. I haven't looked to see if any offer it as an option, but I tend to doubt it (it certainly isn't advertised).

The US's personal banking industry is like 20 years behind the rest of the developed world. Not sure why, probably because the banks have all the money to lobby to keep things the same.

The US's personal banking industry is like 20 years behind the rest of the developed world

People say Canada is a half-generation behind the US in banking innovation, which is generally in Canada's best interest. They've never had a banking crisis.

Not sure why, probably because the banks have all the money to lobby to keep things the same.

This response is worse than wrong, it's assuming bad intentions.

For personal accounts, banks are responsible for your money, even if the hackerz keylog your password and log on as you and steal your money. US banks already have all the incentive in the world to drive down fraud on personal accounts, and yet they seem to have decided it's not worth the time and money to clamp down on it.

Most likely it's because there are always other ways of fighting fraud. The US banking system is full of reversible transactions. From the outside, it sure seems the best use of limited resources is to choke the irreversible endpoints.

Re: We'd lose our security certificate if we allowed pasting

#150

Post by tokenizerrr » Tue, May 06, 2014, 1:40 PM UTC

DanBC wrote: post #85

So, this is just someone on the BritishGas twitter account. We do not know if that person is repeating accurately what they've been told or just making stuff up. Assuming they asked the correct people in BG website accounts security, and those people said "it's to prevent brute force attacks" we do not know if that's the real reason they do it or if it's just what they say to people who ask. What is really frustratin…

As if blocking pasting actually stops brute force attachs... Can still just write a script that repeatedly makes those HTTP(S) requests. They accomplished nothing except annoy their more technically advanced users.

Do they think a brute force attack is done by someone copy-pasting in passwords?