Tag Info

Hot answers tagged

120

Does it make the site any more secure? No, it doesn't alter anything other than your ability to conveniently save items from a page. Using a browser's developer mode, turning off JS, overriding this with a different script that disables that pop-up, or just grabbing data off the wire after stripping the SSL will all work. Is it a good general ...


20

There are two standard ways to build such a device: Time-based. The device has a secret key K (known only to the device and to your bank). When you press the button, The device computes F(K, T) (where T is the current time) and outputs it as a 6-digit code. Your bank, which also knows K, can compute the same function. To deal with the fact that the ...


19

You are right in that one of the ways an attacker could intercept the code is to hack your phone. An attacker could also: Clone your phone's sim, and request a banking code to be sent to your phone's number. they could also possibly clone a non-sim phone as well Steal your phone. Once they have your phone they could perform transactions Perform a man in ...


18

Client side security is just a smokescreen. It will prevent inexperienced people from saving the images or messing with the HTML, but one can easily disable this with a single line of injected javascript. You can mess with the HTML even without this line of JS, using Chrome Inspector. When this trick is used to keep images "secure": I've seen a lot of ...


14

I actually think it might compromise security by a fraction. The one who are prevented by the disabling of the button would never be able to compromise the security at all. But disabling the right click might annoy someone who can get past it to do exactly that, and by doing that breaking down a small barrier that might lead the person to continue hacking. ...


11

The graphical entry of passwords is initially an attempt to thwart keyloggers. When such things began to appear, keyloggers naturally evolved (the people who write keyloggers have not stopped developing them; they adapt to new conditions) and modern keyloggers are also mouseloggers which record, for each click, a partial snapshot of the screen (a small area ...


11

There are two different perspectives here. Implications for you (an expert user). If you choose your password appropriately, it is possible for you to choose your password in a way that is strong enough. If you choose a random 10-character password, where each character is randomly and independently chosen from a-zA-Z0-9 (62 possibilities), then your ...


11

WARNING: Do not change your password! This seems exactly what scammers would do to trick you into giving them your password. Do you really think your bank would send a message like this on Friday with a deadline just over the weekend so there is no chance for you to call them for verification?


10

The whole idea about a second factor/step for authentication is to provide two independent layers of security. Vulnerabilities in one layer should not affect the security of the other. Second factor authentication was designed and used properly in the past but lately it has been weakened by companies who care more about profit than security. SMS messages ...


9

This is precisely as secure as depositing a check at the ATM. You could go up to an ATM, pop in your debit card and say you're depositing $3500, put a blank piece of paper in a deposit slip and deposit it. Same rules apply with the tech you describe as an ATM: Try to fool it, and when time comes around to actually push the routing numbers and bank account ...


9

Yes, this is flawed in two ways: It allows an attacker to enumerate usernames simply by trying them and checking the response. It allows an attacker to get your "secret" image using a non-secret piece of information. This amounts to absolutely nothing in terms of security, and is simply theatre. On top of that, I can see another potential hole: the ...


8

Banks, as well as credit unions, are subject to guidance from the FFIEC, PCI does not necessarily guide or affect banks or credit unions, or the requirements for their members to access their online accounts (your full PAN is probably not even accessible from your Bank's Internet banking site). There are a few things to consider here in terms of risk, which ...


7

On a banking website I see that they have disabled right-click. Does that make the site any more secure? No. Out of the top of my head: you can use greasemonkey to remove their right-click functionality on page load. you can save the web page, then open it in your favorite editor. you can get the webpage again, using wget (or any other client that ...


7

Payment protocols have many variants. However, they mostly boil down to the three following: The card number is just a reference, to be printed on paper. The owner signs with a pen on the paper. The paper may be printed with several technologies, some of them quite primitive (credit cards are embossed so that their number can be copied to paper efficiently ...


6

I doubt you'd actually need to iterate through all 10,000 combinations either. There is a really nice analysis here on the frequency of different pairs of numbers: http://www.datagenetics.com/blog/september32012/index.html Basically starting with 19XX and working your way through stands a much higher success rate than if the PIN numbers were actually ...


6

This means they are almost definately storing passwords in plaintext in a 6-character database field. If they were only storing a (salted) hash - as they should - then they wouldn't care about the password length since the hash function would produce a value of a fixed size regardless of the length of the input (password). Your bank is probably still using ...


6

It's for your security. This way people can't accidentally stay logged into their account, so anyone with access to your computer has full access to your bank account. This way thieves don't have motivation to break into your house to steal your computer not just for the value of the computer, but potentially to get access to your life's savings and use it ...


6

Banks that issue numeric usernames are rather annoying. And while I am more paranoid that most, you're probably right that someone just fat fingered their ID and didn't realize it until they locked you out. To answer the question, some banks do help ensure you are attempting to login with the correct user account. Those "Security Images" you see on some ...


5

I am not familiar with this particular bank, but there are a few possibilities. As you suggested it could be to make key logging more difficult. Is this by chance also Flash? They might be doing some client side encryption or something else on the input data before it is sent Their devs may find it easier to code this in flash/actionscript compared to ...


5

It doesn't prove that you initiated the transaction. It may be evidence, but not proof that you initiated the transaction. Read up on non-repudiation, as explained elsewhere on this site: e.g., How to achieve non-repudiation? and What is the difference between authenticity and non-repudiation Those pages will explain the many limitations and challenges of ...


5

Unless you already have experience in the field, then yes, this is too complex for a small web agency. PHP can be used securely, but you have to know what you are doing. As part of a small web agency, I worked on a high security system to manage a bill payment service with many similar requirements to an online banking system. The project never reached ...


5

I agree that this is bad practice. You can make it better practice by scrambling the answers in one of many ways -- making questions about your father refer to your first car and vice versa, and so on, or giving false answers, or given IRRELEVANT answers (if you can remember what your irrelevant answers were), would discourage/prevent social engineering ...


5

They prevented an attack on your account. This is a desired outcome - had they been able to try unlimited passwords, they'd have guessed yours. The attack was stopped in time, costing you a minor inconvenience. If this pattern was repeated in order to seriously inconvenience you, the bank can simply issue you a new random passcode. They aren't as ...


4

If you want an 'open' explanation of how the One-Time-Password is derived you can read about the Oath standard and the specification for the algorithm here, http://www.openauthentication.org/specifications. The Vasco/Digipass product supports this specification, and it may be used by your token in this case, however they do support other OTP generation ...


4

The idea behind this is that it prevents a simple static phishing attack so it does raise the bar to require slightly more complex code to build the phishing site. If done "properly" the image should not be the only image on the page and should have a randomly assigned ID. In theory, this makes it require more effort to phish the page, but doesn't add ...


4

It's been done when using two factor entered into computers (and directly at ATMs; see link at very bottom for the ATM 2-factor SMS problems). KrebsOnSecurity.com blog lists many banking eheists, including this one: https://krebsonsecurity.com/category/smallbizvictims/page/4/ "The year before the cyber theft, Comerica had switched from using digital ...


4

What I think you'll find is that if you're in a country with Chip+PIN deployed, if a merchant takes a signature instead (usually because their Chip+PIN system is down) then the fraud liability moves from the customer to the merchant. So if you have fraudulent transactions on your card where the merchant doesn't have the PIN you can just dispute them and the ...


4

It likely depends on what network is being used to process the card. If the network is EFTPOS-like, a PIN is typical. However, if the network is credit-like, a signature is typical (at least, before EMV existed). A lot of cards are dual-branded, and how they are processed can depend on the configuration of the merchant's terminal. It's not likely to be a ...


4

This is mainly to prevent session fixation attacks - if old sessions are thrown away regularly, the less valuable are hijacked sessions (http://en.wikipedia.org/wiki/Session_fixation). I think another reason for the bank sites performing this way is to give users a secure feeling - most of them aren't technically skilled people and this auto-outlogging ...


4

You could generate the passcode by taking a consecutive number and append one or more additional digits to it which are a checksum of the actual number. You can check the validity of a passcode on the client-side by checking if the checksum-digits entered by the user match the actual part of the passcode. One checksum-digit reduces the chance to ...



Only top voted, non community-wiki answers of a minimum length are eligible