Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stupid security things

troyhunt.com

Post reply on HN
Print view View original

111–120 of 161 posts

Re: Stupid security things

#111

Post by thaumasiotes »

apeace wrote: post #34
throwaway6845 wrote: post #30

This is pretty horrifying. But almost as bad: websites that insist on over-elaborate security measures for trivial stuff. Take a bow, HM Revenue & Customs: > You’ve got a new message from HMRC > Dear Fred > You have a new message from HMRC about Self Assessment. > To view it, sign in to your HMRC online account. For security reasons, we have not included a link with this email. > Why you got this email > You chose to…

One could argue this is actually a good security practice. It's bad to train users that their bank/whoever will be sending them links via email, because then when the user gets a phishing email, they will have no way to tell the difference. If users can be trained to see "Login to your bank account to see the message", that's much better for their own security.

> It's bad to train users that their bank/whoever will be sending them links via email, because then when the user gets a phishing email, they will have no way to tell the difference.

I got an email using the PayPal template headed "Dear PayPal Customer" once. The copying was so faithful that it preserved the footer at the bottom noting "Communications from PayPal will always address you by your name, never as 'Dear Customer' or similar".

So there can still be ways to tell the difference. Point of interest: would it be more alarming to the PayPal-using public generally if their fake emails omitted that footer, or if the fake emails preserved the footer while still addressing the victim as "dear customer", as happened with mine? You, the phisher, can't avoid having some difference between your email and legitimate email, but you can choose how much and what kind.

Re: Stupid security things

#112

Post by BinaryIdiot »

cookiecaper wrote: post #108
BinaryIdiot wrote: post #83

Earlier quoted context omitted.

I used to work at a life insurance company that had a sessions page for the developers that wasn't locked down at all. If you could get someone's id you could go directly to this page and set your user id to that. Done. They also had a contest for their agents and the database they used to store all of the entries and information was an access database that happened to be sitting in the public directory for the websi…

Yes, most medium-or-smaller sized companies, including ones in fields that should take security seriously like insurance and lending, will have tons of stuff like this. It shouldn't surprise anyone at this point.

Even large companies depending on how you want to classify one as "large". Back when Palm announced their new phone, the Palm Pre, I was given early developer access on their developer portal. I reported to them multiple security vulnerabilities including one that allowed anyone to change a simple integer in the URL and instantly see everyone's SSN / TIN, payment information, etc. It took them 3 months to fully resolve, too (their first fix was simply changing a GET call to a POST, sigh). They never even disclosed it to anyone despite my pleas (I should have but was still sorta green back then and didn't think it through).

Re: Stupid security things

#113

Post by pmtarantino »

sphinx65 wrote: post #21

Wow, that might be the worst I've ever seen. Does anyone here buy from auction sites often? Those are a nightmare, they let the sellers do pretty much anything and very few accept paypal (they're THAT stingy) - sellers on liveauction.com routinely ask buyers to provide credit card info over email. It looks like a lot of sellers are flocking to these because ebay is too strict, wait, I mean "sane".

Recently I won an auction at Galabid.com. They use Stripe and after putting my credit card, it was denied (I think because it was a large payment and I have no limits). Unfortunately, the Stripe JS popup didn't let me change the card. I don't know why - I tried incognito, diff browsers, but it was helpless. I had to send another Card number and all its data through email or the items were going to be auctioned again if I didn't pay in 24hs.

Re: Stupid security things

#114

Post by OJFord »

IshKebab wrote: post #63
OJFord wrote: post #44

Earlier quoted context omitted.

They (as seems to be standard) ask you to enter 3 characters in positions of their choosing, so they need plaintext to be able to do that. It's clearly not as secure as it could be, and it's annoying to work out too - I wish they'd just do normal 2FA. Those plastic keyfobs HSBC use are even worse.

I like the plastic keyfobs. They're much more secure than using your phone as 2FA. Basically the only thing keeping HSBC/1st direct secure.

I'm not convinced they're more secure, but they're most certainly a UX nightmare.

Re: Stupid security things

#115

Post by joncp »

krupan wrote: post #97

Why do we still use passwords? When I connect to Amazon.com I don't ask them for a username and password to verify they really are Amazon. I verify their certificate. Why can't I authentic with a certificate too?

Imagine your grandmother managing her certs. Ain't gonna happen.

Re: Stupid security things

#116

Post by OJFord »

gknoy wrote: post #80
tudorconstantin wrote: post #76

Earlier quoted context omitted.

When you want to retrieve the password for an account you created 5 years ago, but you only remember creating it between 5 and 15 years ago and you have 2 dog loving grandma's each of whom have 2-3 old doggos all the time....well, good luck in remembering and identifying the correct name of the possible 10-15 dogs

This is a case where you think of an _idealized_ grandma, and her perfectly preserved dog, `Mr. Mycroft Applebottom III`, who has been sitting on her mantlepiece since you were in gradeschool. [0] The site doesn't have to know you're making it up. 0: Obviously, it'd be better if your idealized grandma spoke with your password generator beforehand, and therefore named her dog something less guessable, like `ff627f056c…

That's a good suggestion actually: just remember that you always ignore the question, and you've saved the actual securely generated answer as 'sitename-sec-question' or whatever.

Re: Stupid security things

#117

Post by OJFord »

peterjlee wrote: post #71
kwhitefoot wrote: post #60

Earlier quoted context omitted.

If your grandmother is alive and has one dog and you use that dog's name as the answer you are not terribly secure because this information is easy to obtain. It's only virtue is that it is, supposedly, easier for you to remember.

I'd argue this is one of the more secure questions compared to other common questions like "Your mother's maiden name" or "The make of your first car".

Exactly. I don't know how to go about finding out someone's (not personally known to me) grandmother's dog's name, but if I know someone's name then mother's maiden name is easy in the UK.

Re: Stupid security things

#118

Post by Nadya »

cookiecaper wrote: post #110
krupan wrote: post #97

Why do we still use passwords? When I connect to Amazon.com I don't ask them for a username and password to verify they really are Amazon. I verify their certificate. Why can't I authentic with a certificate too?

This has been implemented before. I briefly maintained a legacy project that supported it via IE. In practice, it's a nightmare. Users constantly lose their certs and require manual re-auth. There was a complex install process to get the new cert in place. Usernames and passwords were still a thing; the cert was just to verify that you're coming from an authenticated computer. Something like your proposal may work if…

>Something like your proposal may work if it involves a one-way hash of biometric data (fingerprint scan) so that people can't "lose their cert", but that comes with its own problems too.

Such as biometrics make terrible passwords because they can't be changed. Once compromised (3d printed fingerprints anyone? [0]) then you are forever compromised. Just in case someone wanted an example of why biometrics are terrible.

[0] http://www.novetta.com/wp-content/uploads/2015/10/NovettaBio...

Re: Stupid security things

#119

Post by thaumasiotes »

BinaryIdiot wrote: post #85
jfoutz wrote: post #72

Earlier quoted context omitted.

I don't know if it's a good practice or not, but i usually just pick a word to use for all security questions, that's totally unrelated to the question. ex. I what town did you first meet your best friend? "potato".

This is sorta what I do except I use a unique answer for each one and I store the question and answer in my password manager. Sometimes I use a straight up password generator for the answers. Hope I never have to give those out over the phone.

> Sometimes I use a straight up password generator for the answers. Hope I never have to give those out over the phone.

I filled the security answer for my Blizzard account with random ascii garbage, which I didn't record, confident that I would always know my password.

That was true. But Blizzard disabled my account for purchasing time codes with a credit card other than the one that my account designated "preferred payment". (The card I was paying with was also listed under my account, but it wasn't "preferred". I have no idea what attack they think they're defending against.)

I had to call in. Phone-based customer service accepted "I don't think I can give you the answer to the security question" as a valid answer.

Security!

Re: Stupid security things

#120

Post by dsacco »

BinaryIdiot wrote: post #85
jfoutz wrote: post #72

Earlier quoted context omitted.

I don't know if it's a good practice or not, but i usually just pick a word to use for all security questions, that's totally unrelated to the question. ex. I what town did you first meet your best friend? "potato".

This is sorta what I do except I use a unique answer for each one and I store the question and answer in my password manager. Sometimes I use a straight up password generator for the answers. Hope I never have to give those out over the phone.

I've had to do it a few times, because I do that same thing. They usually respond with exasperation and say something like, "No, sir we need your security answer not your password." Then it's my turn to be exasperated and say, "No, check again, that's the answer." Very fun.
Post reply on HN