161–170 of 450 posts
Luckily middle click paste on unix seems to bypass everything. It doesn't trigger not copy events (so the website can't mess with the text), nor paste events. Just the way it should be.
I feel like I'm missing a GUI-limb when I'm on Windows and don't have the highlight buffer/middle-click paste...
Earlier quoted context omitted.
You realize that this is trivial to brute force, though.
No. You limit to 3 attempts per user before you go to the bank to show ID. Why do hacker news people think they are better at security than multi billion dollar banks?
Many banks (I work for one of them) follow reasonable best practices, allow or require strong passwords, store them safely and require sensible second security factors. Others are decades behind in security, using nonsensical security schemes like the ones morgante and mng2 described above or requiring your password to be letters and numbers only between 6 to 8 characters.
If you care about security, stick with the banks who do as well. Make sure their password guidelines are in order, go with the ones that make you use a second factor, and if you ever see any hints they're storing your password in plain text, run.
Earlier quoted context omitted.
You realize that this is trivial to brute force, though.
No. You limit to 3 attempts per user before you go to the bank to show ID. Why do hacker news people think they are better at security than multi billion dollar banks?
Earlier quoted context omitted.
The problem is, if you have a bunch of partial passwords 1, 2, 3; 1, 2, 4; ... you can just brute force three character combinations of the passwords, which just takes something half a second (times the number of rounds) if you write your password cracker in bash. So your complexity goes from 52^n for a n character password consisting of lower and upper case to n/3* 52^3 which is a lot more manageable.
But three strikes and your out - out to the physical bank with proof of ID to change it.
Earlier quoted context omitted.
The problem is, if you have a bunch of partial passwords 1, 2, 3; 1, 2, 4; ... you can just brute force three character combinations of the passwords, which just takes something half a second (times the number of rounds) if you write your password cracker in bash. So your complexity goes from 52^n for a n character password consisting of lower and upper case to n/3* 52^3 which is a lot more manageable.
But three strikes and your out - out to the physical bank with proof of ID to change it.
Earlier quoted context omitted.
Barclays in the UK does 2fa if you order it, otherwise this strange bit with just parts of the password. They also have the most complicated 2fa I've seen. You get a pocket-calculator-like device where you need to insert your card (chip and pin type), then you enter your personal code, and then you do a challenge-response thing where you enter a code generated from the website into the device, and it responds with a…
> You get a pocket-calculator-like device where you need to insert your card (chip and pin type), then you enter your personal code, and then you do a challenge-response thing where you enter a code generated from the website into the device, and it responds with a number you have to type into the website. Such a thing is rather common in The Netherlands, though it's often not a second factor but just the way you log…
These devices are very common in Germany as well but I heard they are phased out and replaced with a solution using a mobile phone.
> have a built-in camera to automatically read an image from the website instead.
In Germany we have a variant that has five photo diodes along one edge. You hold it against a flickering pattern on your screen. This works reasonably well. In my experience it is about equally fast as typing, just a little less reliable.
The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.
This one at least makes some sort of sense; it's designed to prevent keyloggers from reading your password when you type it in. You can just MiTM the connection though.
All this scheme does is limit an attacker to gathering three letters per login attempt. Given an eight-letter password, three logins will probably disclose most of it; or at least enough for an attacker to pass the challenge when he tries to log in.
In addition, if the attacker is actually interested in your data, he can easily inject a fake "wrong password" message after your first attempt and have you try again, gathering 6 characters per login.
Earlier quoted context omitted.
How does this prevent key logging attacks? You still type in those characters. And secondly, that just immediately made it a hell of a lot easier to brute force your way through the passwords!
It asks for different characters from the password each time. So it'll ask for the 1st, 4th, and 5th characters. Next time you go to login it'll ask from 2nd, 8th, 14th. So a key logger is only getting a small portion of the password each time.
Earlier quoted context omitted.
It's amazing to me how insecure email is these days. If you know somebody's email, and you have a plausible reason to have a conversation with them, you can very easily take over their email account and reset the password on every account attached to it. I often wonder how much the security of email (and by extension, every other account online) depends on people just not knowing how simple and easy it is to break in…
Could you give an example of how it is possible to take over an email account just by having an e-mail conversation with the owner?
Earlier quoted context omitted.
HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...
They can use Shamir's Secret Sharing to achieve this with no plaintext. see http://willtracz.co.uk/shamir-secret-sharing-and-passwords
Above is on the page you're linking to.