Tag Info

Does it make the site any more secure? No, it doesn't alter anything other than your ability to conveniently save items from a page. Using a browser's developer mode, turning off JS, overriding this with a different script that disables that pop-up, or just grabbing data off the wire after stripping the SSL will all work. Is it a good general ...

Client side security is just a smokescreen. It will prevent inexperienced people from saving the images or messing with the HTML, but one can easily disable this with a single line of injected javascript. You can mess with the HTML even without this line of JS, using Chrome Inspector. When this trick is used to keep images "secure": I've seen a lot of ...

There are two standard ways to build such a device: Time-based. The device has a secret key K (known only to the device and to your bank). When you press the button, The device computes F(K, T) (where T is the current time) and outputs it as a 6-digit code. Your bank, which also knows K, can compute the same function. To deal with the fact that the ...

I actually think it might compromise security by a fraction. The one who are prevented by the disabling of the button would never be able to compromise the security at all. But disabling the right click might annoy someone who can get past it to do exactly that, and by doing that breaking down a small barrier that might lead the person to continue hacking. ...

The graphical entry of passwords is initially an attempt to thwart keyloggers. When such things began to appear, keyloggers naturally evolved (the people who write keyloggers have not stopped developing them; they adapt to new conditions) and modern keyloggers are also mouseloggers which record, for each click, a partial snapshot of the screen (a small area ...

There are two different perspectives here. Implications for you (an expert user). If you choose your password appropriately, it is possible for you to choose your password in a way that is strong enough. If you choose a random 10-character password, where each character is randomly and independently chosen from a-zA-Z0-9 (62 possibilities), then your ...

WARNING: Do not change your password! This seems exactly what scammers would do to trick you into giving them your password. Do you really think your bank would send a message like this on Friday with a deadline just over the weekend so there is no chance for you to call them for verification?

This is precisely as secure as depositing a check at the ATM. You could go up to an ATM, pop in your debit card and say you're depositing $3500, put a blank piece of paper in a deposit slip and deposit it. Same rules apply with the tech you describe as an ATM: Try to fool it, and when time comes around to actually push the routing numbers and bank account ...

Yes, this is flawed in two ways: It allows an attacker to enumerate usernames simply by trying them and checking the response. It allows an attacker to get your "secret" image using a non-secret piece of information. This amounts to absolutely nothing in terms of security, and is simply theatre. On top of that, I can see another potential hole: the ...

Banks, as well as credit unions, are subject to guidance from the FFIEC, PCI does not necessarily guide or affect banks or credit unions, or the requirements for their members to access their online accounts (your full PAN is probably not even accessible from your Bank's Internet banking site). There are a few things to consider here in terms of risk, which ...

On a banking website I see that they have disabled right-click. Does that make the site any more secure? No. Out of the top of my head: you can use greasemonkey to remove their right-click functionality on page load. you can save the web page, then open it in your favorite editor. you can get the webpage again, using wget (or any other client that ...

I doubt you'd actually need to iterate through all 10,000 combinations either. There is a really nice analysis here on the frequency of different pairs of numbers: http://www.datagenetics.com/blog/september32012/index.html Basically starting with 19XX and working your way through stands a much higher success rate than if the PIN numbers were actually ...

This means they are almost definately storing passwords in plaintext in a 6-character database field. If they were only storing a (salted) hash - as they should - then they wouldn't care about the password length since the hash function would produce a value of a fixed size regardless of the length of the input (password). Your bank is probably still using ...

I am not familiar with this particular bank, but there are a few possibilities. As you suggested it could be to make key logging more difficult. Is this by chance also Flash? They might be doing some client side encryption or something else on the input data before it is sent Their devs may find it easier to code this in flash/actionscript compared to ...

It doesn't prove that you initiated the transaction. It may be evidence, but not proof that you initiated the transaction. Read up on non-repudiation, as explained elsewhere on this site: e.g., How to achieve non-repudiation? and What is the difference between authenticity and non-repudiation Those pages will explain the many limitations and challenges of ...

If you want an 'open' explanation of how the One-Time-Password is derived you can read about the Oath standard and the specification for the algorithm here, http://www.openauthentication.org/specifications. The Vasco/Digipass product supports this specification, and it may be used by your token in this case, however they do support other OTP generation ...

The idea behind this is that it prevents a simple static phishing attack so it does raise the bar to require slightly more complex code to build the phishing site. If done "properly" the image should not be the only image on the page and should have a randomly assigned ID. In theory, this makes it require more effort to phish the page, but doesn't add ...

Surprisingly often web sites foolishly aren't designed to cope with clicks on "Back" or "Forward" browser buttons. For instance, some banking or e-commerce web sites may commit a transaction twice if you hit "Back". In such cases, there may be a case for trying to disable right-click (where these options are included).

EDIT: As pointed out by the comments below PCI doesn't apply to Financial institutions unless they offer credit cards == Sorry, PCI-DSS Compliance only requires a length of 7. I don't have the text in front of me but the section is 8.5.10. Someone else can probable quote the appropriate paragraph.

As others have indicated, it's suggestive of security measures that are not up to modern day standards. However, a risk assessment seems to indicate that the risk of financial harm to individual customers is low (if not zero). This is because the bank has indicated (per Henning Klevjer) that customers will not lose money in the event of a compromise. Can ...

If it isn't even illegal (seeing that the six character password is the only authentication mechanism), it sure is concerning. This low level of security in a bank surprises me! I've taken a look at their security pages where they tell you that they'll pay if your account is comprimised. Anyway, if that bank lost their user credentials, I guess every ...

Summary: Go with a big bank with a good password policy. MFA is a huge plus, but I wouldn't go to a small bank ever. Unfortunately if you are in the US, MFA is not very prevalent in the banking industry (at least for large banks). If you can find it, I would look there. And if you find that in a big bank (top 10), please let me know. =) Having ...

If you want a secure account look at yourself not the bank. Banks rely on insurance to secure deposits, their security is there to keep the premiums low and the insurance will take care of anything that gets past. However if someone gets into your account via identity theft then the insurance will not cover the stolen funds. Therefore if you want a secure ...

One of the things I would look at is what the bank says about their security. That doesn't mean they are actually doing anything about it, but if they are talking about it at least they know it is important to their customers. I would research the security accreditations that the bank has, and the level of certification of its it staff if the information ...

I've never heard of this digipass. I don't use one when I do online banking, so I don't think attack applies in the US. In the US, we do have an ATM card (a magstripe card with some data on it), and if you steal someone's ATM card, one can try various PINs. However, verification of a PIn involves a communication with the bank's mainframe, and if you enter ...

I think this question lends itself to a very high level overview of how multi-factor authentication (MFA) works. Of course, we have to skim over lots and lots of technical detail. In short, here is what happens: The bank programs the token with a unique encryption key. (In this case your Digipass token is made by Vasco, but there are many other companies ...

From the Wikipedia page that Rory McCune linked to: A Harvard study found SiteKey 97% ineffective. In practice, real people don't notice, or don't care, when the SiteKey is missing, according to their results. SiteKey is designed to prevent users from disclosing their login credentials to a phishing site. The rationale is that a phishing site ...

Disabling right-click has no impact on security; its completely trivial to get around, though it alone doesn't open up any security holes. Giving the banking web site the benefit of the doubt -- there possibly could be a non-security effect that they intended from disabling right click. They may want to prevent users from accidentally doing unintended ...

There are several Digipass products; not all of them compute digital signatures with the meaning that cryptographers attach to this expression (i.e. RSA and its ilk). If your token is not plugged into the machine, but just generates a numeric code which you type in, then there is no RSA involved. This does not prevent some documentations from (ab)using the ...

No, if you need secure things,,,don't trust any client side things. As an example if you do only client side validations in a website which needs more security, you gonna be fail. Do both validations, server and clients. And main things is - providing security means its not securing the stuffs. It increase the time to break in the system. By disabling ...