Tag Info

Hot answers tagged

123

Does it make the site any more secure? No, it doesn't alter anything other than your ability to conveniently save items from a page. Using a browser's developer mode, turning off JS, overriding this with a different script that disables that pop-up, or just grabbing data off the wire after stripping the SSL will all work. Is it a good general ...


28

You're not comparing apples to apples in your comparison of password strength to your bank PIN. Most traditional passwords strength theologies are predicated on the fact that your username and password is all that stands between you and your precious secure data. These are merely two objects that you know and as such it's in your best interest to have a ...


28

As Phil stated, you can still use the card using its number (as you would do on-line). Also, some ATM machine won't accept the card if not able to read the magnetic strip. The best thing is to use a credit card: in that case you can block the payment and get a refund.


25

I am not a laywer, but a properly constructed password manager stores passwords approximately as securely as any modern banking system. I can't speak to the legality of using a password manager, but I can say that on a philosophical level, anywhere a personally provided password is acceptable as identification, a (properly constructed) password manager ...


23

There are two standard ways to build such a device: Time-based. The device has a secret key K (known only to the device and to your bank). When you press the button, The device computes F(K, T) (where T is the current time) and outputs it as a 6-digit code. Your bank, which also knows K, can compute the same function. To deal with the fact that the ...


23

Yes, you can. On some places you can find a device called demagnetizer. Just run your card over it (or over a very strong magnet), and the magnetic track will be corrupted and you will only be able to use the chip part of the card.


20

You are right in that one of the ways an attacker could intercept the code is to hack your phone. An attacker could also: Clone your phone's sim, and request a banking code to be sent to your phone's number. they could also possibly clone a non-sim phone as well Steal your phone. Once they have your phone they could perform transactions Perform a man in ...


18

Client side security is just a smokescreen. It will prevent inexperienced people from saving the images or messing with the HTML, but one can easily disable this with a single line of injected javascript. You can mess with the HTML even without this line of JS, using Chrome Inspector. When this trick is used to keep images "secure": I've seen a lot of ...


18

Once you submit that form, the information clearly goes to PayPal. So, yes, your password is definitely sent to PayPal. However, PayPal is saying that that it only uses your bank account credentials to confirm/verify your account. What seems to happen is that PayPal takes your information then sends it to your online banking provider for verification. What ...


16

I have never heard of this so I can't say for sure, but I would guess that the original premise is flawed: I don't think any bank would have a policy stating they will not insure your account against fraud if you store your password somewhere outside of your own head. Enforcing that rule would require passwords to be easy to remember, and consequently easy ...


15

Is my password sent to Paypal? Yep. Giving your password to PayPal may be a breach of your bank's Terms and Conditions and/or make you personally liable for any fraud that takes place through that system. Also PayPal can see the personal information and transaction history associated with that account. Hope you trust PayPal real good now! Or is ...


14

The graphical entry of passwords is initially an attempt to thwart keyloggers. When such things began to appear, keyloggers naturally evolved (the people who write keyloggers have not stopped developing them; they adapt to new conditions) and modern keyloggers are also mouseloggers which record, for each click, a partial snapshot of the screen (a small area ...


14

I actually think it might compromise security by a fraction. The one who are prevented by the disabling of the button would never be able to compromise the security at all. But disabling the right click might annoy someone who can get past it to do exactly that, and by doing that breaking down a small barrier that might lead the person to continue hacking. ...


14

Embossed letters are still present on CC to allow to quickly carbon-copy (literally) the card on paper. That's in the (very) old days, but still allowed today, and it will count as PRESENTIAL. Magnetic strip is still there because half of the CC readers still work that way. ATM and TPV outside USA and UE are still missing the chip reader, and even inside ...


13

I'm a lawyer in Germany. Here the special conditions between customer and bank are part of the contract. So we are talking about a clause in these special conditions prohibiting the use of a password manager. I went to the site of my bank, drew the conditions and really, it says, the customer is not allowed to store the password on his PC. So this clause ...


11

WARNING: Do not change your password! This seems exactly what scammers would do to trick you into giving them your password. Do you really think your bank would send a message like this on Friday with a deadline just over the weekend so there is no chance for you to call them for verification?


11

There are two different perspectives here. Implications for you (an expert user). If you choose your password appropriately, it is possible for you to choose your password in a way that is strong enough. If you choose a random 10-character password, where each character is randomly and independently chosen from a-zA-Z0-9 (62 possibilities), then your ...


11

The whole idea about a second factor/step for authentication is to provide two independent layers of security. Vulnerabilities in one layer should not affect the security of the other. Second factor authentication was designed and used properly in the past but lately it has been weakened by companies who care more about profit than security. SMS messages ...


10

YES, but there is a big chance that an (internally chip-capable) ATM (depending on region) will reject the card! The most common 2 problems for an ATM (including chip-capable) to reject a card are: a dirty or scratched magstripe (as shown in spork's answer) an erased or mangled (=invalid) magstripe by exposure to magnets or EMP (they need to emit ...


9

Yes, this is flawed in two ways: It allows an attacker to enumerate usernames simply by trying them and checking the response. It allows an attacker to get your "secret" image using a non-secret piece of information. This amounts to absolutely nothing in terms of security, and is simply theatre. On top of that, I can see another potential hole: the ...


9

The chip embedded in the smart card locks itself after a defined number of incorrect PIN entries, typically between 3 and 10 attempts.


9

This is precisely as secure as depositing a check at the ATM. You could go up to an ATM, pop in your debit card and say you're depositing $3500, put a blank piece of paper in a deposit slip and deposit it. Same rules apply with the tech you describe as an ATM: Try to fool it, and when time comes around to actually push the routing numbers and bank account ...


8

Banks, as well as credit unions, are subject to guidance from the FFIEC, PCI does not necessarily guide or affect banks or credit unions, or the requirements for their members to access their online accounts (your full PAN is probably not even accessible from your Bank's Internet banking site). There are a few things to consider here in terms of risk, which ...


8

Originally it's to do with the difficulty of a brute force attack on the password. Most websites are concerned about the possibility that some attacker might get hold of a file containing everyone's hashed passwords, and conduct an offline brute force attack using that. A properly set up attacker might be able to make millions of guesses per second (exact ...


8

Your information does go to PayPal, who will likely use it to login to your bank account. That way they can verify your information is valid. However - technically - they can also see other information. Anything you see after logging in (your account balance, the various deposits / withdrawals) is visible to them, and they may or may not store that. ...


7

I doubt you'd actually need to iterate through all 10,000 combinations either. There is a really nice analysis here on the frequency of different pairs of numbers: http://www.datagenetics.com/blog/september32012/index.html Basically starting with 19XX and working your way through stands a much higher success rate than if the PIN numbers were actually ...


7

On a banking website I see that they have disabled right-click. Does that make the site any more secure? No. Out of the top of my head: you can use greasemonkey to remove their right-click functionality on page load. you can save the web page, then open it in your favorite editor. you can get the webpage again, using wget (or any other client that ...


7

Payment protocols have many variants. However, they mostly boil down to the three following: The card number is just a reference, to be printed on paper. The owner signs with a pen on the paper. The paper may be printed with several technologies, some of them quite primitive (credit cards are embossed so that their number can be copied to paper efficiently ...


7

The card knows this, the reader doesnt. When you put a pin in the reader talks to the microcontroller on the card to verify - which also logs the incorrect attempts. So multiple readers wont help trying to guess somebodies pin! Thats more or less the extent of my knowledge, but an overview of how it works. The underlying protocols I have no knowledge of ...


7

Don't do this, it will not work in ATM machines in my experience. I've had to get a new debit card mailed in last month because there was a little scratch out of the magnetic strip, although I had not noticed and had used it for daily chip-only and wireless transactions. It wouldn't work in any (Dutch) ATM machine afterwards (I tried my own bank's and ...



Only top voted, non community-wiki answers of a minimum length are eligible