Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Post a boarding pass on Facebook, get your account stolen

michalspacek.com

Post reply on HN
Print view View original

101–110 of 313 posts

Re: Post a boarding pass on Facebook, get your account stolen

#101

Post by masklinn »

KGIII wrote: post #66
littlehood wrote: post #59

Earlier quoted context omitted.

Aztec is more compact than QR - does not need margin and because it's optimised for lowercase letters (used a lot for urls). Also has tunable error correction.

Doesn't the QR standard allow lowercase via hex and have a miniature version? I know it has error correction, but I'm not sure if it is tunable. I know it can embed kanji, so it seems odd that lowercase would be much of a problem? Thanks! I am pretty grateful I'm not tasked with implementing these.

It's not that lowercase is a problem, it's that aztec is more efficient at it.

Note that GP is incorrect that you need lowercase to express URLs and qrcode has an "alphanumeric" mode (based around uppercases which works fine), but even then qrcode's alphanumeric mode is slightly less efficient as it needs 5.5 bits per character versus 5 for Aztec.

Kanji has its own qrcode encoding mode (the qrcode encoding modes are numeric, alphanumeric[0], byte, kanji, structured append[1], ECI[2] and Code128[3]).

[0] digits, uppercase ascii letters and 9 symbols

[1] to split messages across multiple codes

[2] additional "local" encodings: https://strokescribe.com/en/ECI.html

[3] https://en.wikipedia.org/wiki/Code_128

Re: Post a boarding pass on Facebook, get your account stolen

#102

Post by ddevault »

JupiterMoon wrote: post #36
sersi wrote: post #11

And this is also why I almost never give my real birth date when registering on websites (except on financial websites or websites where I'm legally obligated to) and I never ever give real answers to the security question.. My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager Security questions weakens the security of an account, they are easil…

> My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager The problem with this is that the "security" question will often be asked over the phone. At this point an answer of "Oh I just mash the keyboard for those" is probably going to get an attacker access to your account..

You don't have to say "oh I just mash the keyboard for those", you can say "it's weird, bear with me" and read it out from your password manager.

Re: Post a boarding pass on Facebook, get your account stolen

#103

Post by meric »

magoon wrote: post #83

Could you imagine a neighbor going around checking everybody’s window and door locks?

No but your mum might pick your phone off your pocket to remind you to be careful when it's hanging out while you two are travelling in a country overseas in a danger area.

Re: Post a boarding pass on Facebook, get your account stolen

#104

Post by meric »

joering2 wrote: post #56

Remind me of my ex-gf I had on my Facebook for a while. She liked to be show off, which I think nowadays is not that big of as deal. But she would literally invite crime to her house! On her public Facebook profile she didn't post her address, BUT she had bunch of photos: her with the Living Complex sign, her next to her doors (with apartment number on it), photos of her inside house with beautiful 85" TV and other e…

It might be you remind her of her failure to listen to your advice - it's about her and not you.

Re: Post a boarding pass on Facebook, get your account stolen

#105

Post by wyager »

ddevault wrote: post #102
JupiterMoon wrote: post #36

Earlier quoted context omitted.

> My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager The problem with this is that the "security" question will often be asked over the phone. At this point an answer of "Oh I just mash the keyboard for those" is probably going to get an attacker access to your account..

You don't have to say "oh I just mash the keyboard for those", you can say "it's weird, bear with me" and read it out from your password manager.

It's not about what you say, it's about what an attacker can get away with saying. And they can almost certainly get away with "I just mash the keyboard."

Re: Post a boarding pass on Facebook, get your account stolen

#106

Post by maxerickson »

ddevault wrote: post #102
JupiterMoon wrote: post #36

Earlier quoted context omitted.

> My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager The problem with this is that the "security" question will often be asked over the phone. At this point an answer of "Oh I just mash the keyboard for those" is probably going to get an attacker access to your account..

You don't have to say "oh I just mash the keyboard for those", you can say "it's weird, bear with me" and read it out from your password manager.

The quote is an attacker attempting to bypass the check.

Re: Post a boarding pass on Facebook, get your account stolen

#107

Post by Sir_Cmpwn »

wyager wrote: post #105
ddevault wrote: post #102

Earlier quoted context omitted.

You don't have to say "oh I just mash the keyboard for those", you can say "it's weird, bear with me" and read it out from your password manager.

It's not about what you say, it's about what an attacker can get away with saying. And they can almost certainly get away with "I just mash the keyboard."

Ah, I see what you mean. Perhaps instead of grabbing a handful of characters from /dev/urandom, you generate a passphrase (a few random dictionary words)?

Re: Post a boarding pass on Facebook, get your account stolen

#108

Post by drdaeman »

raverbashing wrote: post #19
djsumdog wrote: post #13

Earlier quoted context omitted.

"Your mother's maiden name has numbers in it?" (bank teller, DMV person, etc.) "You .. give real answers for your security questions? Seriously?" I do the same thing, real birthday if it's financial or employee related, but for everything else, I'm a few years older on another date. I often pick a security question that I don't have a real legit answer to as well.

Yes, I try to make the fake answer sound legitimate though City you were born? Just pick any (random/unrelated) city instead of 2DXSDGREDV@#! It's easier if you have to go through a person (which is usually forced to go through a script) also easier on the phone

I believe the general recommendation I saw was to type something in lines of "never accept this answer - it's probably someone trying to impersonate me | 2DXSDGREDV@#!" (although it's probably hard to do so if the maximum acceptable length is too short)

Re: Post a boarding pass on Facebook, get your account stolen

#109

Post by ricardobeat »

alkhatib wrote: post #99
cesarb wrote: post #93

Earlier quoted context omitted.

I never quite got this "mother's maiden name" thing. Isn't your mother's maiden name... your mother's current name, minus the extra surname she got when she married? Why is this treated as a hard-to-discover information?

In the US and other countries it's common for a wife to take her husband's last name. Changes from "Jane Doe" to "Jane Smith"

I think he's saying the maiden name is easily found. At least in Brazil, the husband's surname is _appended_ at the end, doesn't replace the maiden one: Jane Doe Smith.
Post reply on HN