61–70 of 161 posts
That "What is the name of your grandmother's dog?" security question made me lol @ work. This really makes me want to write a "Stupid security questions generator" website.
Why is that funny or bad? If your grandmother is living and has a single dog, as 'security questions' go that would strike me as being pretty good.
This is pretty horrifying. But almost as bad: websites that insist on over-elaborate security measures for trivial stuff. Take a bow, HM Revenue & Customs: > You’ve got a new message from HMRC > Dear Fred > You have a new message from HMRC about Self Assessment. > To view it, sign in to your HMRC online account. For security reasons, we have not included a link with this email. > Why you got this email > You chose to…
People elsewhere in the world: whatever anybody tells you when they're crapping on the UK Government Digital Service, make sure they're not using HMRC as an example. Famously HMRC resists everything GDS has ever tried to do, and after GDS built a entire system for secure gov ID login which is deliberately not tied to a single vendor, HMRC refused to use it and instead is building another one, which is locked to a sin…
I guess HMRC took one look and said "this not sufficiently bureaucratic for our needs". In general I liked the HMRC much better than the IRS, but I was sort of shocked to receive a paper cheque for my refund as it was the only time I ever saw a check in the UK. They have their ways I guess.
Huh, couple years ago Santander in the UK changed their web layout. No big deal, except that my password wouldn't work anymore - I rang them up, and they said "did you have any special characters in your password? If yes, then they have been removed because the new system does not support special characters. Please use the same password as before, but without special characters". 1) This is one of the largest banks i…
They (as seems to be standard) ask you to enter 3 characters in positions of their choosing, so they need plaintext to be able to do that. It's clearly not as secure as it could be, and it's annoying to work out too - I wish they'd just do normal 2FA. Those plastic keyfobs HSBC use are even worse.
If I were designing a new product today, I would never consider having usernames and passwords. While it is a shame Mozilla killed Persona before it could even have a chance, it is still way, way more reasonable to use third party signin buttons than to try to do it on your own. Again. Brokenly. For the thousandth time per person.
It is a shame that one button alone does not work, but just OpenID connect includes Google, MS, and Amazon (so one login backend and three click buttons and you are covering probably 99% of people, who will have one of those three accounts).
I think:
* companies running a website and collects customer data must have an incident response plan laid out.
If we punish bad service providers reported by consumers, why can't we do the same? We are talking about companies ignoring and downplaying even the most low-hanging fruit vulnerability, and companies that don't understand web security because the workers there have no clues what they are dealing. If we can't raise our cyber security awareness and education domestically, then we fail at being a top technology leader in this world. I don't expect every company hires a security engineer, perhaps under some managed services.
@troyhunt: Have you seen the latest leak by Atlassian? I got an email on 4th April, 2017 that reads as follows: Hello, This weekend, our Security Intelligence Team detected an incident affecting HipChat.com that may have resulted in unauthorized access to user account information (including name, email address and hashed password). Atlassian ID is used to manage access to your HipChat.com account and other Atlassian…
No, they couldn't have gotten people's passwords. They could have their passwords _encrypted with a random salt_. Which is, frankly, useless.
I remember when cookies was where every site kept their cached credentials in plaintext. It was so popular you didn't need a password manager, just a cookie and form manager. In case most of you didn't know/forgot: a large amount of the modern security practices on the web are due to browsers making it easy for sites to attack users, and making MITM trivial. The most common attack vector is literally the browser and…
I've lost count of how many websites I've used that were blatantly insecure. Sometimes you have no choice but to do it, like when I had to apply for a Brazil travel visa. Their SSL certificate has expired, and has been expired for years now.
I feel like we need laws in place on software and hardware security. Laws to punish crimes is good, but we also need some regulation, simple ones, to govern how companies have the obligation to manage software and hardware security. I think: * companies running a website and collects customer data must have an incident response plan laid out. If we punish bad service providers reported by consumers, why can't we do t…