Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thanks FedEx, this is why we keep getting phished

troyhunt.com

Post reply on HN
Print view View original

511–520 of 576 posts

Re: Thanks FedEx, this is why we keep getting phished

#511

Post by droopyEyelids »

tonymet wrote: post #291

This reinforces the need for "mutual trust security" that I've been calling for now for years. All of the significant authentication schemes are built to validate the customer, and none validate the vendor. When your bank or mobile provider gives you a call : how do you know it's them? They start asking you for personal data right away, but you have no idea who you are sharing information with. We need "mutual authen…

This is included webauthn, which is the basis for both passkeys and fido2 auth.

To sign in, you are sent a 'challenge', and must sign it and return it. The challenge includes a "Relaying Party Identifier" (RPID) which is basically the domain of the site requesting authentication.

That way, if a phishing domain prompts you for auth, they can not proxy your response because the RPID you signed will not match the authentic domain, and therefore be invalid.

Re: Thanks FedEx, this is why we keep getting phished

#512

Post by skjoldr »

Reading these comments makes me thankful for the existence of Nova Poshta in Ukraine. Two years of open war, and they still consistently deliver packages overnight across roughly a third of the country, and are doing their best transporting international shipments to and from Europe. Very focused on keeping things moving and avoiding losing any parcels.

Re: Thanks FedEx, this is why we keep getting phished

#513

Post by WorldMaker »

sib wrote: post #469
WorldMaker wrote: post #347

Earlier quoted context omitted.

With built in emoji entry keywords in every modern OS how many devices are left that can't type emoji? Even if you plan to restrict to Unicode Version N - 1 or N - 2 where N is the current version to avoid "user can't type password on older hardware", the proportion of emoji you can reliably type today on just about any device is huge.

I'm pretty sure that most of the on-screen keyboards for TV / streaming device platforms don't support emoji. (I've spent about 6 years of my career running video streaming services... People watch a lot of video on TVs, it turns out, so you probably don't want to let them put these sorts of characters into their passwords when they sign up on mobile or computer devices.)

For better and a (lot) worse most of the TV / streaming device platforms are Android-derived and have access to emoji keyboards if not intentionally disabled, even on TV form factors. I realize it is a wide spectrum of users and a long tail of devices, but at some point again it isn't a technical reason that we are banning emoji from passwords but a political and lowest common denominator reason.

I'm not trying to invalidate your personal experience. You've seen a lot of good social reasons users probably "can't" be trusted with emoji passwords. but at a purely technical level the number of OSes in 2023 that can't pop up an emoji keyboard if asked is incredibly slim and the number that can't have an emoji keyboard in user space as a software addon is even slimmer. If a device doesn't support at least UTF-8 encodings in 2024 that's an entirely different can of worms (and probably a bad sign for the security of the device itself).

Both the Xbox and PS4+ have emoji keyboards. Apple TV has an emoji keyboard. Almost every version of Android TV and Samsung Tizen and Roku and Fire OS and ….

Go ahead, tell me you have a lot of customer support problems that you don't want to support emoji in passwords. That I can believe. I can't believe it's a technical problem in 2023. Emoji are universal enough now in 2024 that OSes are broken if they can't send/receive emoji and don't have some sort of keyboard to input them. Even if we are still turning off the emoji buttons on password fields because we don't trust users to do it for social reasons rather than technical ones.

Re: Thanks FedEx, this is why we keep getting phished

#514

Post by WorldMaker »

bitfilped wrote: post #453
WorldMaker wrote: post #393

Earlier quoted context omitted.

Windows 7 market share is barely at 3% on the internet per statcounter.com. Third place doesn't mean "popular", especially not right now. There's quite a bit of convenience, and some concomitant security, to using emoji in passwords. Emoji are high entropy code points that are easily visually distinguishable across most language boundaries. A "short" password of just emoji is going to have way higher entropy and be w…

3% of the internet is still an incredibly large amount of people.

Sure? But what definition of "popular" does "large amount of people" meet? "Of or relating to the general public"? The general public is using Windows 10 and 11. "Suitable to the majority"? Again, the vast majority is 10 and 11. Same for "frequently encountered or accepted" and "commonly liked or approved": the most frequently encountered is Windows 10. So too is the most "commonly liked". 3% is still 3% and far and away a minority and definitely not in any way "popular", by any definition I can find.

Re: Thanks FedEx, this is why we keep getting phished

#515

Post by tonymet »

droopyEyelids wrote: post #511
tonymet wrote: post #291

This reinforces the need for "mutual trust security" that I've been calling for now for years. All of the significant authentication schemes are built to validate the customer, and none validate the vendor. When your bank or mobile provider gives you a call : how do you know it's them? They start asking you for personal data right away, but you have no idea who you are sharing information with. We need "mutual authen…

This is included webauthn, which is the basis for both passkeys and fido2 auth. To sign in, you are sent a 'challenge', and must sign it and return it. The challenge includes a "Relaying Party Identifier" (RPID) which is basically the domain of the site requesting authentication. That way, if a phishing domain prompts you for auth, they can not proxy your response because the RPID you signed will not match the authen…

This is good but how to make it work for phone, email and txt messages ?

Re: Thanks FedEx, this is why we keep getting phished

#516

Post by UberFly »

skjoldr wrote: post #512

Reading these comments makes me thankful for the existence of Nova Poshta in Ukraine. Two years of open war, and they still consistently deliver packages overnight across roughly a third of the country, and are doing their best transporting international shipments to and from Europe. Very focused on keeping things moving and avoiding losing any parcels.

They must have extra motivation to excel and help the local effort in what ever way they can. Too many entities elsewhere see their duty to others, their country and company as a burden.

Re: Thanks FedEx, this is why we keep getting phished

#517

Post by ipqk »

bsimpson wrote: post #415
habosa wrote: post #219

FedEx may have the worst and least secure digital platform for a major company. Some examples I’ve noticed: 1. I moved into a 10-unit apartment building and wanted to set up FedEx Delivery Manager. I just put in my new address, no verification whatsoever, and I was immediately given access to the previous tenant’s delivery instructions which included the buildings private garage code. Any thief could have done the sa…

You're reminding me of the time I realized that Schwab (a massive American bank/broker) truncated all passwords to 8 characters.

Years ago I found a glaring security hole in schwab where when imputing a security question answer, if you got it wrong you could just hit the back button and try again.

to their credit, they took me seriously and I believe they fixed it reasonably promptly.

Re: Thanks FedEx, this is why we keep getting phished

#518

Post by jiggawatts »

thomastjeffery wrote: post #463
jiggawatts wrote: post #40

Earlier quoted context omitted.

It is. If they use their main domain, their normal corporate email will get blocked by anti-spam filters. So everyone uses a different, unrelated domain for bulk mails.

So use a different domain for corporate email. The only reason not to is if you are prioritizing the identifiability of your corporate email over the identifiability of your actual customer-facing operations .

Well, of course.

If the CFO gets their mail dropped, they'll fire the IT guy.

If a customer is a bit cranky... nothing happens.

Re: Thanks FedEx, this is why we keep getting phished

#519

Post by int_19h »

Enginerrrd wrote: post #423
bsimpson wrote: post #415

Earlier quoted context omitted.

You're reminding me of the time I realized that Schwab (a massive American bank/broker) truncated all passwords to 8 characters.

Bonus points are given when they handle truncating your password differently in the initial validation vs authentication and it fails silently!

Or, even more hilariously, that said truncation happens on the client, and varies between different clients that they have. I personally ran into this with Wells Fargo, where their mobile app would leave one more (or one less, I don't remember exactly now) character than their website.

Re: Thanks FedEx, this is why we keep getting phished

#520

Post by int_19h »

filoleg wrote: post #451
toss1 wrote: post #279

Earlier quoted context omitted.

Re password reset workflow issues: I had an account at a bank where password reset always failed. I had to go through a VERY convoluted process with customer website support to get it fixed. It turned out that the problem was that my registered email address was just two characters (my initials) to the left of the "@", e.g., ab@mydomain.com. They allowed me to enter and use it throughout the system without any error…

This comment just unlocked a new fear of mine. I specifically got a custom domain and email address for any non-personal/"professional" comms, which is essentially just me@ .com. At least with non-ASCII characters in passwords, while I think it is stupid to not handle those properly, I can at least see some sort of an excuse there, no matter how weak it is. All it takes to mess this up is not thinking about handling…

FWIW I have an email that is me@...org, and I've been using it for over a decade now without a single issue despite having lots of accounts created using it.
Post reply on HN