Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We'd lose our security certificate if we allowed pasting

twitter.com

Post reply on HN
Print view View original

21–30 of 225 posts

Re: We'd lose our security certificate if we allowed pasting

#21

Post by krzrak »

crashandburn4 wrote: post #15
morsch wrote: post #4

Earlier quoted context omitted.

It's secured by a four digit password and self destruction after three consecutive invalid PIN entries. Which is plenty secure against brute force. Or is that just the way it works around here?

I actually rely on this self destruction, I have a scrap of paper in my wallet with "Pin Numbers" written on it along with 3 random four digit numbers, gives me minor peace of mind that if my wallet is lost and found by someone that wants to try and use them, hopefully they'll lose them to an atm rather than using them online.

Awesome idea :)

Re: We'd lose our security certificate if we allowed pasting

#22

Post by DomBlack »

It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc.

Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains.

I understand perhaps the view is some people are not good at remembering passwords and so would forget a complicated password - but they are unlikely to use a long password or special characters if that's the case.

Or am I just missing something major here?

Re: We'd lose our security certificate if we allowed pasting

#23

Post by danpalmer »

praptak wrote: post #18
PeterisP wrote: post #7

Earlier quoted context omitted.

Well, it's not like my card is hooked up to the internet for everybody to try and log in. PIN isn't particularly vulnerable to brute force anyway, as number of failed authorisation attempts is strictly limited to something like 3, and a fraudster has to risk capture by being physically present at each attempt or 'trying out' a stolen card, and having their face recorded on cameras. I haven't seen any advantages for u…

> Now, checking "signature" instead of chip&pin, now that's an example of blind trust. If even. I cannot find the original report, but there was a guy who tried all kinds of weird signatures including "I STOLE THIS CARD" and it only took purchasing 3 most expensive TVs and signing "NOT AUTHORIZED" for someone to question him. Unoriginal report: http://www.getrichslowly.org/blog/2006/07/29/the-credit-card...

Interestingly, the signature could be argued to be better in some cases:

Under British law, a forged signature is never your fault, and the bank/merchant/card processor are liable (I can't remember exactly which, I think it depends). One of the reason that card issuers were so keen to switch to Chip&PIN/EMV is that the liability was turned over to the user. As they thought EMV was "unhackable", always a dangerous thought, it was always assumed that the user had told someone their PIN. It wasn't until relatively recently that the Cambridge University security research group showed that it was crackable, and the banks/etc started taking liability in some cases again.

Re: We'd lose our security certificate if we allowed pasting

#24

Post by nodata »

DomBlack wrote: post #22

It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…

What if the password is one character long?

Re: We'd lose our security certificate if we allowed pasting

#25

Post by nraynaud »

eyko wrote: post #12
morsch wrote: post #4

Earlier quoted context omitted.

It's secured by a four digit password and self destruction after three consecutive invalid PIN entries. Which is plenty secure against brute force. Or is that just the way it works around here?

Unless you buy online, in which case you just need the "last 3 digits on the back of your card".

it's not a password, and it doesn't give the same insurance. There were some proposal of at home card readers in the 2000, but it never got very far, it was not really practical to secure either. I think the current trend of scratch credit card could be onto something for online buying, it's a temporary credit card number valid just for a few hours, and then it's deleted from the bank system.

Re: We'd lose our security certificate if we allowed pasting

#26

Post by mikecb »

praptak wrote: post #18
PeterisP wrote: post #7

Earlier quoted context omitted.

Well, it's not like my card is hooked up to the internet for everybody to try and log in. PIN isn't particularly vulnerable to brute force anyway, as number of failed authorisation attempts is strictly limited to something like 3, and a fraudster has to risk capture by being physically present at each attempt or 'trying out' a stolen card, and having their face recorded on cameras. I haven't seen any advantages for u…

> Now, checking "signature" instead of chip&pin, now that's an example of blind trust. If even. I cannot find the original report, but there was a guy who tried all kinds of weird signatures including "I STOLE THIS CARD" and it only took purchasing 3 most expensive TVs and signing "NOT AUTHORIZED" for someone to question him. Unoriginal report: http://www.getrichslowly.org/blog/2006/07/29/the-credit-card...

It was John Hargrave from zug.com, but I think zug is no longer with us.

Re: We'd lose our security certificate if we allowed pasting

#27

Post by omh »

crashandburn4 wrote: post #15
morsch wrote: post #4

Earlier quoted context omitted.

It's secured by a four digit password and self destruction after three consecutive invalid PIN entries. Which is plenty secure against brute force. Or is that just the way it works around here?

I actually rely on this self destruction, I have a scrap of paper in my wallet with "Pin Numbers" written on it along with 3 random four digit numbers, gives me minor peace of mind that if my wallet is lost and found by someone that wants to try and use them, hopefully they'll lose them to an atm rather than using them online.

I like that idea.

Unfortunately it doesn't prevent them using them online as well. At least for my cards, if I lock out the PIN I can still use them for non-PIN purchases.

Re: We'd lose our security certificate if we allowed pasting

#28

Post by kalleboo »

koyote wrote: post #16
chopin wrote: post #5

Earlier quoted context omitted.

Cards are way different. They combine something you have (the card) with something you know (the PIN). After three false attempts to enter the PIN you have to unlock the card going a different route. In such a scenario, 4 digits are fine. You can't lock accounts only protected by a password and accessible by anyone (via internet) this way as this would invite for Denial-of-Service attacks (locking your account with t…

I have had quite a few sites block my account for three bad password attempts and I had to actually call the company to unlock the account (this was always a financial services company). It's quite annoying as none of the sites warned me about the impending account block after the first or second try. I guess it's an inconvenience that is worth it for the extra anti-brute-force security. Being locked out due to someo…

> I have had quite a few sites block my account for three bad password attempts and I had to actually call the company to unlock the account (this was always a financial services company).

GoDaddy does this. It's the main reason I left them (before all the more recent shenanigans)

Re: We'd lose our security certificate if we allowed pasting

#30

Post by danpalmer »

DomBlack wrote: post #22

It always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering password…

In the 1980s I don't think hashing passwords was common, it would have taken too much processing power, and the database fields on the mainframe don't support weird characters or a length of more than 8 characters.

I wish this wasn't the case, but these systems are so old behind the scenes, that lots of it simply can't be changed without massive re-engineering. I have friends that work for a company who transfer COBOL applications from mainframes to JVM COBOL running on standard servers, it's a massive task, and takes years and lots of money.

Post reply on HN