Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We'd lose our security certificate if we allowed pasting

twitter.com

Post reply on HN
Print view View original

161–170 of 225 posts

Re: We'd lose our security certificate if we allowed pasting

#161

Post by danielweber »

crbaker wrote: post #60
danpalmer wrote: post #30

Earlier quoted context omitted.

In the 1980s I don't think hashing passwords was common, it would have taken too much processing power, and the database fields on the mainframe don't support weird characters or a length of more than 8 characters. I wish this wasn't the case, but these systems are so old behind the scenes, that lots of it simply can't be changed without massive re-engineering. I have friends that work for a company who transfer COBO…

It will take these organisation years and lots of money to rebuild their reputations when their security malpractices catch up with them.

I would love this to be true, since it would basically double my net worth, but it's very rare for a security incident to kill a company. Target is the exception, and just required two human sacrifices.

Re: We'd lose our security certificate if we allowed pasting

#162

Post by danielweber »

danpalmer wrote: post #30
DomBlack wrote: post #22

It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…

In the 1980s I don't think hashing passwords was common, it would have taken too much processing power, and the database fields on the mainframe don't support weird characters or a length of more than 8 characters. I wish this wasn't the case, but these systems are so old behind the scenes, that lots of it simply can't be changed without massive re-engineering. I have friends that work for a company who transfer COBO…

It was standard to hash passwords in /etc/passwd back in the 1980s.

Still, when you pin code is limited to 1 million combinations, all the hashing in the world isn't going to save you. You need to keep your DB secure, no matter what, and that's where resources were applied.

Re: We'd lose our security certificate if we allowed pasting

#163

Post by theg2 »

leetrout wrote: post #146
tempodox wrote: post #131

Earlier quoted context omitted.

That was probably to prevent SQL injection, right?

Citi is the same way... Nothing in their policy about what isn't allowed[0] and they updated their system one weekend and my password quit working because it had % in it. I called tech support over it and they offered no additional guidance. https://www.accountonline.com/cards/svc/OutsideView.do?forwa...

Citi Student Loan website maxes out at 6 or 7 characters and is utter garbage on top of that. Worst case though, someone could pay my student loans for me I guess.

Re: We'd lose our security certificate if we allowed pasting

#164

Post by weavie »

quchen wrote: post #3

Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.

You get contact-less now which doesn't need any pin at all, just tap the card on the machine and your purchase is complete.

Re: We'd lose our security certificate if we allowed pasting

#165

Post by danielweber »

jordanthoms wrote: post #50
koyote wrote: post #16

Earlier quoted context omitted.

I have had quite a few sites block my account for three bad password attempts and I had to actually call the company to unlock the account (this was always a financial services company). It's quite annoying as none of the sites warned me about the impending account block after the first or second try. I guess it's an inconvenience that is worth it for the extra anti-brute-force security. Being locked out due to someo…

It's always annoyed me how people set the lockout after n attempts value to ~3 or 4. Why not 100? It makes almost no difference in your chances at brute forcing a password, but means that the real user trying all the passwords they might have used won't get locked out mid way.

If you type a wrong password in "su" on OpenBSD, the binary responds immediately telling me I'm wrong. On Linux, it does this stupid artificial 3 second penalty.

The Linux way sounds better, but the OpenBSD way is better. If you want people to use passwords, don't do petty nagging of them when they make a mistake.

On Linux when I mistype a password, I control-Z the "su" session and launch a new one instead of sitting around like a scolded schoolboy waiting for the binary to give me another chance.

Re: We'd lose our security certificate if we allowed pasting

#166

Post by ceejayoz »

tempodox wrote: post #131
mixedbit wrote: post #47

Reminds me of a password security policy that listed few SQL statements that can't be used in passwords.

That was probably to prevent SQL injection, right?

In the worst possible way - it makes clear that they're vulnerable to it.

Re: We'd lose our security certificate if we allowed pasting

#168

Post by Kudos »

dave84 wrote: post #104
Kudos wrote: post #96

Earlier quoted context omitted.

That's nothing, mine's a 5 digit pin code which they only validate 3 of in a random order (to annoy keyloggers, I assume) plus the last 4 digits of my phone number. Edit: This feels like the scene where Mel Gibson and Rene Russo compare scars in Lethal Weapon 3.

Sounds like AIB. If you use the app they don't even ask for the last 4 digits of your phone number.

Bingo. I wonder what their brute force protection is like, but I'm not going to go pentesting the login of a company I'm in the same legal jurisdiction as.

Re: We'd lose our security certificate if we allowed pasting

#169

Post by dllthomas »

oneeyedpigeon wrote: post #143
tempodox wrote: post #131

Earlier quoted context omitted.

That was probably to prevent SQL injection, right?

Can you really prevent SQL injection via a blacklist?

A finite blacklist? No, I don't think so. A regex blacklist? Yes; trivially if you can be radically overly cautious.

Re: We'd lose our security certificate if we allowed pasting

#170

Post by manicdee »

[deleted] wrote: post #167

[deleted]

Disabling pasting requires disabling JavaScript in a real end-user browser with an end-user who doesn't know how to un-disable pasting.

Never trust the client['s computer]. Disabling pasting is trusting the client's computer. Security in depth ends where the Internet starts.

Post reply on HN