Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stupid security things

troyhunt.com

Post reply on HN
Print view View original

51–60 of 161 posts

Re: Stupid security things

#51

Post by empath75 »

gambiting wrote: post #33

Huh, couple years ago Santander in the UK changed their web layout. No big deal, except that my password wouldn't work anymore - I rang them up, and they said "did you have any special characters in your password? If yes, then they have been removed because the new system does not support special characters. Please use the same password as before, but without special characters". 1) This is one of the largest banks i…

my (former) bank used social security numbers as user accounts, and lets you reset your password over the phone with nothing more than address and birth date.

Re: Stupid security things

#52

Post by girvo »

_jal wrote: post #42
jwilk wrote: post #28

Earlier quoted context omitted.

Do you mean your grandmother's dog?

Precisely. That actually was a typo. Amazingly, a typo that has earned me a -3 downvote so far... People seem really freakishly touchy about word choice around here lately. Honestly, that's likely to make me care less about their delicate sensibilities.

It's likely because the joke didn't add much. Word choice seems to be less important than humour with no other content, from what I've seen over the past few years.

Re: Stupid security things

#53

Post by the_af »

OJFord wrote: post #46
gambiting wrote: post #38

Earlier quoted context omitted.

What do they require then? I've never in my entire life used my credit/debit card without typing in the PIN number(except for contactless payments, of course). I'm in the UK. I think they can be used with a signature too? Maybe? I've never heard of anyone actually signing a bill instead of using the pin, and besides, I don't even sign my cards.

I was made to sign my card for the first time ever recently in order to complete an exchange that required a refund and repurchase... Parent comments are talking about online purchases, for which your PIN is not needed.

I was talking about brick & mortar shops.

Now I've done some reading, and it seems my country (in Latin America) is following US standards. It seems US-issued credit cards only require signatures, even when used abroad, and only recently (as far as I can google it) are they slowly starting to switch to either PIN or chip-based cards. Newly issued cards where I live have chips (this is a relatively recent development), which I'm not sure exactly how are supposed to be safer than magnetic strip cards, and also don't require PINs.

Re: Stupid security things

#54

Post by _jal »

OJFord wrote: post #49
_jal wrote: post #42

Earlier quoted context omitted.

Precisely. That actually was a typo. Amazingly, a typo that has earned me a -3 downvote so far... People seem really freakishly touchy about word choice around here lately. Honestly, that's likely to make me care less about their delicate sensibilities.

I think it's unlikely you're being downvoted for the typo - far more likely for the jokey comment which doesn't really add value to the thread.

Fair enough. It just seemed of a piece with some other recent interactions I've had here.

Re: Stupid security things

#55

Post by r1ch »

Neliquat wrote: post #2

The number of webmasters who wanted me to set up ssl to 'secure' their site, while the backend emailed cc info in the clear to the orders dept is larger than I have digits, even the extra adolecent joke ones.

Reminds me of Cloudflare's "Flexible SSL", where backend connections aren't encrypted at all.

Re: Stupid security things

#56

Post by Tistron »

the_af wrote: post #47
gambiting wrote: post #38

Earlier quoted context omitted.

What do they require then? I've never in my entire life used my credit/debit card without typing in the PIN number(except for contactless payments, of course). I'm in the UK. I think they can be used with a signature too? Maybe? I've never heard of anyone actually signing a bill instead of using the pin, and besides, I don't even sign my cards.

Yes, they require a signature. I'm not saying this is a safe practice, just that I've never seen a store where they asked me for a pin code for major credit cards such as Visa, Amex and (I'm pretty sure, but I don't have one) MasterCard. And I'm talking not only my own country, but also the US and several countries in Europe. When I was in the UK some years ago, they didn't ask me for my pin code when I used my Visa…

I believe it is possible to use a cc here without the pin if you show ID and sign a receipt. I think I've seen it for people who've forgotten their code and tourists who don't know their code.

Re: Stupid security things

#57

Post by TorKlingberg »

throwaway6845 wrote: post #30

This is pretty horrifying. But almost as bad: websites that insist on over-elaborate security measures for trivial stuff. Take a bow, HM Revenue & Customs: > You’ve got a new message from HMRC > Dear Fred > You have a new message from HMRC about Self Assessment. > To view it, sign in to your HMRC online account. For security reasons, we have not included a link with this email. > Why you got this email > You chose to…

I don't mind the login security, but it logs you out after only a couple of minutes of inactivity, clearing the page. Can anyone do anything tax related without spending a few minutes looking at papers or a spreadsheet?

Re: Stupid security things

#58

Post by dewey »

bArray wrote: post #10

@troyhunt: Have you seen the latest leak by Atlassian? I got an email on 4th April, 2017 that reads as follows: Hello, This weekend, our Security Intelligence Team detected an incident affecting HipChat.com that may have resulted in unauthorized access to user account information (including name, email address and hashed password). Atlassian ID is used to manage access to your HipChat.com account and other Atlassian…

He has.

https://twitter.com/troyhunt/status/856603660737945601

Re: Stupid security things

#59

Post by IshKebab »

gumby wrote: post #19

> and I know for a fact 90% of the sites I personally sign up to online also follow that same process. This is a totally legit response. After all if something goes wrong they must have followed "best practices". No reasonable person would expect them to do more. And it's true (if you only consider the needs of the business). This is a solid strategy for getting lawsuits dismissed. I've seen it in physical security t…

> This is a totally legit response.

Apart from the fact that it is totally untrue?

Re: Stupid security things

#60

Post by kwhitefoot »

OJFord wrote: post #40
djtriptych wrote: post #4

That "What is the name of your grandmother's dog?" security question made me lol @ work. This really makes me want to write a "Stupid security questions generator" website.

Why is that funny or bad? If your grandmother is living and has a single dog, as 'security questions' go that would strike me as being pretty good.

If your grandmother is alive and has one dog and you use that dog's name as the answer you are not terribly secure because this information is easy to obtain. It's only virtue is that it is, supposedly, easier for you to remember.
Post reply on HN