Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Innovation Nation: WePay is the anti-PayPal

money.cnn.com

Post reply on HN
Print view View original

51–54 of 54 posts

Re: Innovation Nation: WePay is the anti-PayPal

#51

Post by count »

nwmcsween wrote: post #49
poet wrote: post #39

Earlier quoted context omitted.

I think it should probably company policy at a financial institution not to allow someone in a different control on a handheld device to access the servers.

I use layered security (in the sense of servers) with a password lifetime of 10 days. I deal with servers daily and the issue of compromise has been twice in on firewall containers/servers which was fine as the systems in place found it, found the issue with the net facing software and I fixed it. Practicality doesn't mean no security.

If you're using SSH, you should be using keys, and not passwords.

Re: Innovation Nation: WePay is the anti-PayPal

#52

Post by sophacles »

sbov wrote: post #40
pinksoda wrote: post #14

I really hope WePay destroys PayPal. They have screwed myself and my friends too many times. The homepage layout is all wrong though. Poor element placement, messy typography, and the color scheme is off. It looks amateur and unpolished. All those SEO'd subpages are worthless if they don't convert. Also: - Upgrade to Nginx 0.7.67, there was a lot of bug fixes in 0.7.65 and 0.7.66. - Limit the number of login attempts…

> - Don't show "That email address was not found" when someone tries to recover a password. You are giving out too much info, which can be used maliciously. Does this really matter if a site only allows 1 registered user per email address? I can farm this information by trying to sign up a new account.

Even if this is true[1], it never hurts to consciously limit the places where information flows out of your system. The idea is that securing one point is easier than securing n points.

[1] I don't doubt the flow of information, but the rate at which that information can be leaked through a signup page can be severely limited compared to a password recovery page.

Re: Innovation Nation: WePay is the anti-PayPal

#53

Post by nwmcsween »

count wrote: post #51
nwmcsween wrote: post #49

Earlier quoted context omitted.

I use layered security (in the sense of servers) with a password lifetime of 10 days. I deal with servers daily and the issue of compromise has been twice in on firewall containers/servers which was fine as the systems in place found it, found the issue with the net facing software and I fixed it. Practicality doesn't mean no security.

If you're using SSH, you should be using keys, and not passwords.

Those aren't mutally exclusive

Re: Innovation Nation: WePay is the anti-PayPal

#54

Post by count »

nwmcsween wrote: post #53
count wrote: post #51

Earlier quoted context omitted.

If you're using SSH, you should be using keys, and not passwords.

Those aren't mutally exclusive

Can you require keys AND passwords? I haven't been able to figure out how to get that to function - if passwords are allowed, it lets you in with or without a key, from what I can tell. I'd be happy to be wrong though!
Post reply on HN