Don't give away historic details about yourself • Hacker News Board

Re: Don't give away historic details about yourself

#201

Post by mindslight » Wed, Apr 11, 2018, 4:44 PM UTC

philwelch wrote: post #129

mindslight wrote: post #70

What is with perpetuating this idea that people have some duty to be responsible for companies' broken security practices? You're unable to prevent their fuckups - so you can only take steps to make sure you don't end up on the hook or otherwise severely impacted due to their negligence. It's not my job to avoid repeating public information like mother's maiden name, historical addresses, etc. Nor is it my job to wor…

I don't really see "responsibility" as a useful lens. If you give away information that can be used to reset your passwords, you make it more likely that someone can reset your passwords. Assigning blame is something people do to make themselves feel better after bad things happen. Making it less likely for bad things to happen in the first place may or may not be worth the time and effort, but whether or not you're…

> Assigning blame is something people do to make themselves feel better after bad things happen

Eh, not really. Assigning responsibility is how we align incentives to prevent things from happening in the first place. You are responsible for not disclosing your bank password. You are not responsible for repeating public information that a bank foolishly decided to consider an authentication token.

Personally fretting about whatever broken actions a bank decides to take uses up a disproportionate amount of your time, as you're unable to actually change them. And any success just encourages the bank to continue, as they suffer less from their own idiocy.

Re: Don't give away historic details about yourself

#202

Post by mindslight » Wed, Apr 11, 2018, 4:47 PM UTC

barsonme wrote: post #131

mindslight wrote: post #70

What is with perpetuating this idea that people have some duty to be responsible for companies' broken security practices? You're unable to prevent their fuckups - so you can only take steps to make sure you don't end up on the hook or otherwise severely impacted due to their negligence. It's not my job to avoid repeating public information like mother's maiden name, historical addresses, etc. Nor is it my job to wor…

In a perfect world, sure. But unfortunately so many companies don't do security right, so if we want to be safe we have to take the initiative. I mean, it doesn't have to be an either/or thing, we can pressure companies to change while adhering to best practices like not publicly posting your first car and name of your first pet.

Yes, that initiative is checking your own transactions in a timely manner, so you don't end up losing money. Due to banks' insistence on clinging to an outdated security paradigm (permissive w/ rollback), you can't actually prevent fraudulent transactions from showing up on your account.

Re: Don't give away historic details about yourself

#203

Post by ossguy » Wed, Apr 11, 2018, 5:37 PM UTC

my_first_acct wrote: post #155

gruez wrote: post #124

Earlier quoted context omitted.

use a burner sim like: https://www.twilio.com/wireless/pricing . presumably twillio is harder to social engineer than [big telecom]

The Twilio SIM card is not as useful as you might expect. Unfortunately, Twilio cannot receive SMS messages from short codes [1], which are often used used by the kinds of places (banks etc) that rely on SMS for 2FA. Also, keep in mind that an adversary can grab your text messages even without any social engineering skills; they just need to rent a cell tower somewhere in the world and advertise your number as roamin…

You could use https://jmp.chat/ instead - JMP does support short codes, and you can use is anywhere you have Internet access, regardless of whether you have a SIM or not.

Re: Don't give away historic details about yourself

#204

Post by packet_nerd » Wed, Apr 11, 2018, 6:14 PM UTC

gowld wrote: post #179

jackhack wrote: post #35

Earlier quoted context omitted.

In fact this is a method of stealing people's investment accounts -- a victim with an investment account is identified. That person's phone number is then "captured". The investment account asks for 2FA and the thief now has that phone #, and "authenticates." The next step is to transfer all the money in the account to a third party and disappear. It's disgusting how twisted these criminal activities have become.

You mean how incompetent the banks have become? Everyone has a phone that can a proper 2fa app like Authenticator. using SMS is inexecusable.

I got a Yubikey a few weeks ago and thought I'd switch to an online bank that offered Yibikey login... I spent hours looking and couldn't find any. Not even one. Couldn't even find any offering Google Authenticator. I saw that a few of the biggest banks will ship you an RSA token/similar device if you ask, but not quite what I had in mind.

Re: Don't give away historic details about yourself

#205

Post by philwelch » Wed, Apr 11, 2018, 7:30 PM UTC

mindslight wrote: post #201

philwelch wrote: post #129

Earlier quoted context omitted.

I don't really see "responsibility" as a useful lens. If you give away information that can be used to reset your passwords, you make it more likely that someone can reset your passwords. Assigning blame is something people do to make themselves feel better after bad things happen. Making it less likely for bad things to happen in the first place may or may not be worth the time and effort, but whether or not you're…

> Assigning blame is something people do to make themselves feel better after bad things happen Eh, not really. Assigning responsibility is how we align incentives to prevent things from happening in the first place. You are responsible for not disclosing your bank password. You are not responsible for repeating public information that a bank foolishly decided to consider an authentication token. Personally fretting…

It may or may not be worth the time and effort never to tell anyone your mother’s maiden name, but assigning blame is kind of beside the point. It’s not my responsibility not to get my bike stolen, but if I don’t want my bike stolen, I still lock it up, right?

Re: Don't give away historic details about yourself

#206

Post by ggg9990 » Thu, Apr 12, 2018, 12:57 AM UTC

suprfnk wrote: post #182

Double_a_92 wrote: post #176

Earlier quoted context omitted.

Because calculating a Levenshtein distance is to complicated...

Still rather unsafe, right? "Cambridge" would be closer to "Woodbridge" than "Woodbridge Lane".

But randomly guessing Cambridge is not that likely. A bit of a pointless exercise though since security questions are dumb.

Re: Don't give away historic details about yourself

#207

Post by RugnirViking » Thu, Apr 12, 2018, 11:44 AM UTC

bitL wrote: post #191

lysp wrote: post #186

Earlier quoted context omitted.

Funny story - I had an old short-length insecure password on a website that I hadn't used for years. I decided to log in and change it to a randomly generated secure password. However, they had upgraded their off the shelf software some time over the last 4-5 years to a newer version. The problem was, on their password change page the "new password" field had a minimum length of 8 characters, however the "OLD passwor…

> edited the javascript validation You probably broke law there O_O

How can there be a law that prevents running abritary code on my own box?