Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We'd lose our security certificate if we allowed pasting

twitter.com

Post reply on HN
Print view View original

181–190 of 225 posts

Re: We'd lose our security certificate if we allowed pasting

#181

Post by aianus »

mcv wrote: post #154
NateDad wrote: post #111

Earlier quoted context omitted.

Wire transfers tend to have a $35-$50 fee and require you to schlep down to the bank during business hours and fill out annoying paperwork. So, yeah, we don't use them except in emergencies.

Do we have a misunderstanding of the meaning of "wire transfer" here? Surely you can just send money to someone else's account through the bank's internet banking website? How else do you pay for stuff like rent, and, well, anything, really?

In Canada you can email people money up to $2000 but it costs $1.50 per transfer so I tend not to use it. You can also pay most bills from large institutions online (utilities, credit cards, tuition, taxes, etc).

I've paid rent using cash, checks, and pre-authorized debit (you give them your bank account number and sign a contract and they withdraw from your account every month). For vehicles or property it's usually a certified check. Anything else goes on my credit cards.

Re: We'd lose our security certificate if we allowed pasting

#182

Post by Dylan16807 »

nwh wrote: post #64
V-2 wrote: post #49

Earlier quoted context omitted.

Given that they've requested you to change password to conform to the new rule, I believe you were within these 99%? ;)

No, it could have just been random. They've reduced their keyspace massively by doing that. Six characters, all numbers, no ascending or descending. 123849 is invalid as an example, as is 954391.

Massively? For every 3 digits you look at, they're only blocking about 26 out of 1000 possible values. Factor in that there are 4 starting points to apply the restriction to, and you get roughly 10% of passwords being blocked. That's only a sixth of a bit of entropy being lost. Barely anything.

Re: We'd lose our security certificate if we allowed pasting

#183

Post by [deleted] »

manicdee wrote: post #170
[deleted] wrote: post #167

[deleted]

Disabling pasting requires disabling JavaScript in a real end-user browser with an end-user who doesn't know how to un-disable pasting. Never trust the client['s computer]. Disabling pasting is trusting the client's computer. Security in depth ends where the Internet starts.

[deleted]

Re: We'd lose our security certificate if we allowed pasting

#184

Post by dalore »

manicdee wrote: post #170
[deleted] wrote: post #167

[deleted]

Disabling pasting requires disabling JavaScript in a real end-user browser with an end-user who doesn't know how to un-disable pasting. Never trust the client['s computer]. Disabling pasting is trusting the client's computer. Security in depth ends where the Internet starts.

One could argue that a cross site scripting attack could use someone else's browser to paste to the site. So disabling paste disables one (small) vector for an attacker to use someone else's computer to attack.

Re: We'd lose our security certificate if we allowed pasting

#185

Post by Nursie »

zAy0LfpBZLC8mAC wrote: post #130
lostcolony wrote: post #39

Earlier quoted context omitted.

It's better for the user when it comes to challenging a fraudulent purchase, but in terms of security, it's worse. That was the point.

There is no such thing as just "security". If the expected loss of funds for the user is lower, it is more secure - for the user.

Actually that's subjective. If the overall fraud is lower then (potentially, I'm sure this doesn't actually happen) fees, charges, interest rates etc could be lower for all users, therefore they would benefit from security that lowered the overall cost of fraud and the overall number of incidences of fraud, even if individuals that directly experience fraud are worse off.

Re: We'd lose our security certificate if we allowed pasting

#186

Post by rwhitman »

dalore wrote: post #184
manicdee wrote: post #170

Earlier quoted context omitted.

Disabling pasting requires disabling JavaScript in a real end-user browser with an end-user who doesn't know how to un-disable pasting. Never trust the client['s computer]. Disabling pasting is trusting the client's computer. Security in depth ends where the Internet starts.

One could argue that a cross site scripting attack could use someone else's browser to paste to the site. So disabling paste disables one (small) vector for an attacker to use someone else's computer to attack.

This - I just realized the thing I was working on was supposed to be used in a public setting.

Re: We'd lose our security certificate if we allowed pasting

#187

Post by santosha »

freditup wrote: post #127
a_bonobo wrote: post #38

Earlier quoted context omitted.

Same goes for Virgin Mobile (at least here in Australia), which ALSO requires you to only use numbers. Last week they forced me to change my password due to an "important change" - ascending or descending numbers were not allowed anymore. I guess they had a look at their plain text password database and realized that 99% of their users used 123456. Edit: Australia seems to be using the US system: http://www.bitdefend…

I have Virgin Mobile in the US (it's one of the cheapest options with good quality phones), and it seems the same. It made me set a 6-digit PIN as my password, and my phone number is my username. Here are the requirements listed on their website: Your Account PIN must be: -6 numbers (no letters or special characters) -no more than 3 identical numbers in a row (222) -no more than 3 sequential numbers (such as 234) If…

This is funny because these restrictions reduce the total number of possibilities. I get that the idea was to stop commonly used passwords, but that's what they should have done - disallowed the top N common ones.

Re: We'd lose our security certificate if we allowed pasting

#188

Post by fluidcruft »

nwh wrote: post #89
Shivetya wrote: post #81

Earlier quoted context omitted.

so 741963 would pass? Not sure how that rule your stated actually functions, I am probably over thinking it. I am curious what simple pattern people will adapt to once you eliminate simple sequences. It has got to be predictable, as in someone could put math behind it.

Any run of three characters in sequence, forward or reverse, is marked as invalid. 123 876 432 would all mark the whole password as invalid, even if they only take up half the string. Yours would pass though, yes.

His is two vertical runs along the keypad. The forbidden ones are horizontal runs. That's why it's stupid. Any modeling of passwords humans would generate for use on a keypad should forbid 741 by the same logic that forbids 123.

Re: We'd lose our security certificate if we allowed pasting

#189

Post by u124556 »

freehunter wrote: post #175
ajuc wrote: post #117

Earlier quoted context omitted.

Date of birth probably. Now half of their passwords has 19xx in the same position. I'm of the opinion that everybody should be given public and private key at birth.

It's called name and social security number :)

But those are both public

Re: We'd lose our security certificate if we allowed pasting

#190

Post by rwhitman »

manicdee wrote: post #170
[deleted] wrote: post #167

[deleted]

Disabling pasting requires disabling JavaScript in a real end-user browser with an end-user who doesn't know how to un-disable pasting. Never trust the client['s computer]. Disabling pasting is trusting the client's computer. Security in depth ends where the Internet starts.

Deleted my comment but I just realized why we did this -

The product I was working on was to be used on a shared public browser / kiosk. The reason was to prevent one user from pasting in the previous user's password.

Post reply on HN