Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We'd lose our security certificate if we allowed pasting

twitter.com

Post reply on HN
Print view View original

171–180 of 225 posts

Re: We'd lose our security certificate if we allowed pasting

#171

Post by aianus »

mcv wrote: post #141
aianus wrote: post #115

Earlier quoted context omitted.

All of the bank accounts I have in Canada let me send $2000 with nothing but a password. They also won't let me use non-alphanumeric passwords and don't support any two-factor authentication. Same in the US. Of course, if anyone did try to steal my money this way, the bank would reverse the transfer and give it back to me.

Sounds very insecure for a bank. Will they really automatically reverse any transfer you object to? What if they don't control the target account? What if there's no money on the other account anymore? What if it was a legitimate payment, you got what you ordered, and then you had the payment reversed? I see a big hornet's nest of potential problems in a system like that.

I guess they try to pull it back and if it's not possible they eat the cost. I imagine any bank that tried to force people to use 2FA and/or get rid of the zero-liability policy would lose a lot of customers.

Re: We'd lose our security certificate if we allowed pasting

#172

Post by etimberg »

randlet wrote: post #72
dougedey wrote: post #43

Earlier quoted context omitted.

My bank (TD Canada) used to have this policy. Luckily it changed. However, they didn't tell me (or anyone) so I've been telling everyone I know to update their password to be longer.

TD's password is still HORRIBLE. It is case insensitive and ignores anything after the first 8 characters and doesn't allow special characters. If my password is "aBc123De" I can log in by entering the password "ABC123DEFOOBARBAZ".

I tried it with a new password today. The requirements were between 8 an 32 characters and some special characters allowed.

I just tried with all lower case letters and it rejected it. Prior to changing my password however, I experienced everything you described. They must have 2 systems and setting a new password must switch you to the new system. Can't fathom why they don't just mandate everyone changing their passwords.

Re: We'd lose our security certificate if we allowed pasting

#173

Post by sehrope »

a_bonobo wrote: post #38
fdej wrote: post #29

They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.

Same goes for Virgin Mobile (at least here in Australia), which ALSO requires you to only use numbers. Last week they forced me to change my password due to an "important change" - ascending or descending numbers were not allowed anymore. I guess they had a look at their plain text password database and realized that 99% of their users used 123456. Edit: Australia seems to be using the US system: http://www.bitdefend…

Purely a guess but I think they only allow for numbers because it's a phone company. If they intend for people to enter their password/pin on their mobile phone then limiting it to only digits that you can type from any phone is understandable. Now I'm not saying it's a good idea but at least there is some sense to it.

In no particular order my usual gripes with passwords and auth in general are:

    * Disabling clipboard copy/paste (because now I can't use my password manager)
    * Length limitations (anything less than 32 characters is a a limitation)
    * Requiring punctuation or "special characters" (they're annoying and don't add real security ... just use a longer password)
    * Lack of two-factor (preferably TOTP)
The password limit is really the scariest one. Short passwords are much easier to crack. Also, I have a sinking feeling that every site that says a password must be a specific max length is storing it in plaintext. Otherwise why the heck would it matter what the length is?

Re: We'd lose our security certificate if we allowed pasting

#174

Post by nknighthb »

mcv wrote: post #154
NateDad wrote: post #111

Earlier quoted context omitted.

Wire transfers tend to have a $35-$50 fee and require you to schlep down to the bank during business hours and fill out annoying paperwork. So, yeah, we don't use them except in emergencies.

Do we have a misunderstanding of the meaning of "wire transfer" here? Surely you can just send money to someone else's account through the bank's internet banking website? How else do you pay for stuff like rent, and, well, anything, really?

No. You cannot.

Rent is usually paid by check, though poorer people who may not have bank accounts of any kind often use cash, too. Large-scale landlords (corporations renting many units) sometimes take credit cards or be able to setup automatic debit from a bank account. Obviously this sacrifices a good deal of control and if they screw up (intentionally or otherwise) you get to deal with all sorts of shit.

"Electronic bill payment" in the US often means your bank mails the receiver a check. Some subset of businesses are setup to turn that into a direct transfer. In no case has it ever been worth the hassle. I try very hard to avoid anything that can't be paid for with a credit card, since that is, by far, the lowest-friction payment method in the US.

Everything else, cash, check, credit/debit card, or sometimes direct debit. Only active businesses are going to be set up to take cards or do direct debits. If you want to give money to an individual, you give them cash or a check.

American banking is radically behind.

Re: We'd lose our security certificate if we allowed pasting

#175

Post by freehunter »

ajuc wrote: post #117
Shivetya wrote: post #81

Earlier quoted context omitted.

so 741963 would pass? Not sure how that rule your stated actually functions, I am probably over thinking it. I am curious what simple pattern people will adapt to once you eliminate simple sequences. It has got to be predictable, as in someone could put math behind it.

Date of birth probably. Now half of their passwords has 19xx in the same position. I'm of the opinion that everybody should be given public and private key at birth.

It's called name and social security number :)

Re: We'd lose our security certificate if we allowed pasting

#176

Post by cLeEOGPw »

wzdd wrote: post #36
DomBlack wrote: post #22

It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…

The last bank backend I worked around was composed of several interacting systems, written 30 or 40 years ago in COBOL, which ran batch jobs overnight and communicated with each other by writing files to disk. We were strongly encouraged to get the format of the file exactly right, or the batch job in question wouldn't run and nobody would be able to sort it out until morning. Passwords weren't involved but, if they…

So it's a problem where the system must be kept up running no matter what and refactoring everything might cost more than having some security threats? Or is it just plain greed and "while it's working now, why fix it?" kind of thing.

Re: We'd lose our security certificate if we allowed pasting

#177

Post by kevinburke »

freditup wrote: post #127
a_bonobo wrote: post #38

Earlier quoted context omitted.

Same goes for Virgin Mobile (at least here in Australia), which ALSO requires you to only use numbers. Last week they forced me to change my password due to an "important change" - ascending or descending numbers were not allowed anymore. I guess they had a look at their plain text password database and realized that 99% of their users used 123456. Edit: Australia seems to be using the US system: http://www.bitdefend…

I have Virgin Mobile in the US (it's one of the cheapest options with good quality phones), and it seems the same. It made me set a 6-digit PIN as my password, and my phone number is my username. Here are the requirements listed on their website: Your Account PIN must be: -6 numbers (no letters or special characters) -no more than 3 identical numbers in a row (222) -no more than 3 sequential numbers (such as 234) If…

Yeah, I wrote about this a few years ago and got a lot of press for it. They didn't really fix it, but at least they started rate limiting by IP address. https://kev.inburke.com/kevin/open-season-on-virgin-mobile-c...

Re: We'd lose our security certificate if we allowed pasting

#178

Post by timdierks »

The tweeter (probably a non-technical support person, so go gently on him or her as an individual) has revised the statement:

"@passy I'm mistaken about the website security certificate but avoiding pasting of passwords is good practice & protects our customers 1/2" https://twitter.com/BritishGasHelp/status/463679554306203648

"@passy especially when using public computers. Alpha numerical policy ensures your protection without making special characters necessary^S" https://twitter.com/BritishGasHelp/status/463681274092462080

Re: We'd lose our security certificate if we allowed pasting

#179

Post by Nursie »

abritishguy wrote: post #69
Nursie wrote: post #45

Earlier quoted context omitted.

>> One of the reason that card issuers were so keen to switch to Chip&PIN/EMV is that the liability was turned over to the user. Not really true. The main reason was the switch in liability to the merchant, if the merchant accepted a transaction without using EMV and PIN. AFAICT the Cambridge research isn't really that relevant, it doesn't really give you practical attacks, and it's not so much a crack on the chip se…

Cambridge University Computer Science student here. Not all of the research that has been done has been published, I've seen some very impressive demos! In any case the published research absolutely does give you practical attacks e.g. http://www.cl.cam.ac.uk/research/security/banking/nopin/ or http://www.cl.cam.ac.uk/research/security/banking/intercepto...

I have no doubt you're right, and the banks absolutely should not reject fraud reports based on PIN.

I've had a read of the first paper there, the nopin one, and it reads like a really preventable flaw in the IAD, which (as it's issuer specific) could be very easily fixed without the involvement of terminal vendors. I agree with the conclusion that the TVR is a flawed concept though, I had always assumed (never having worked directly for an issuer) that there would be enough data in the IAD to marry up the terminal and card perspectives on what had happened.

And on the second one I'd be the first to agree that SDA and offline-plaintext PIN are a bad idea, I could have told you that when I did my first implementation in 2001!

--edit-- I had actually assumed that by now the cost differential between SDA/plaintext and DDA(or CDA)/encrypted cards would be so small that nobody would use the SDA cards any more. Guess I was wrong!

Re: We'd lose our security certificate if we allowed pasting

#180

Post by fluidcruft »

freditup wrote: post #127
a_bonobo wrote: post #38

Earlier quoted context omitted.

Same goes for Virgin Mobile (at least here in Australia), which ALSO requires you to only use numbers. Last week they forced me to change my password due to an "important change" - ascending or descending numbers were not allowed anymore. I guess they had a look at their plain text password database and realized that 99% of their users used 123456. Edit: Australia seems to be using the US system: http://www.bitdefend…

I have Virgin Mobile in the US (it's one of the cheapest options with good quality phones), and it seems the same. It made me set a 6-digit PIN as my password, and my phone number is my username. Here are the requirements listed on their website: Your Account PIN must be: -6 numbers (no letters or special characters) -no more than 3 identical numbers in a row (222) -no more than 3 sequential numbers (such as 234) If…

Phew. Dodged the bullet on forbidding vertical and diagonal strobes of the keypad.
Post reply on HN