Tag Info

Hot answers tagged

28

You're not comparing apples to apples in your comparison of password strength to your bank PIN. Most traditional passwords strength theologies are predicated on the fact that your username and password is all that stands between you and your precious secure data. These are merely two objects that you know and as such it's in your best interest to have a ...


28

As Phil stated, you can still use the card using its number (as you would do on-line). Also, some ATM machine won't accept the card if not able to read the magnetic strip. The best thing is to use a credit card: in that case you can block the payment and get a refund.


25

I am not a laywer, but a properly constructed password manager stores passwords approximately as securely as any modern banking system. I can't speak to the legality of using a password manager, but I can say that on a philosophical level, anywhere a personally provided password is acceptable as identification, a (properly constructed) password manager ...


23

Yes, you can. On some places you can find a device called demagnetizer. Just run your card over it (or over a very strong magnet), and the magnetic track will be corrupted and you will only be able to use the chip part of the card.


18

Once you submit that form, the information clearly goes to PayPal. So, yes, your password is definitely sent to PayPal. However, PayPal is saying that that it only uses your bank account credentials to confirm/verify your account. What seems to happen is that PayPal takes your information then sends it to your online banking provider for verification. What ...


16

I have never heard of this so I can't say for sure, but I would guess that the original premise is flawed: I don't think any bank would have a policy stating they will not insure your account against fraud if you store your password somewhere outside of your own head. Enforcing that rule would require passwords to be easy to remember, and consequently easy ...


15

Is my password sent to Paypal? Yep. Giving your password to PayPal may be a breach of your bank's Terms and Conditions and/or make you personally liable for any fraud that takes place through that system. Also PayPal can see the personal information and transaction history associated with that account. Hope you trust PayPal real good now! Or is ...


15

Yes it does work as you say. The chip is "tamper resistant" and will erase the "seed" (secret key) if any attempt is made to attack it. This is often accomplished by having a non-user-replaceable battery and a "trap" that breaks Power to the device once the device is opened, or the chip Surface is removed. The key is then stored in a SRAM, requiring Power to ...


14

Embossed letters are still present on CC to allow to quickly carbon-copy (literally) the card on paper. That's in the (very) old days, but still allowed today, and it will count as PRESENTIAL. Magnetic strip is still there because half of the CC readers still work that way. ATM and TPV outside USA and UE are still missing the chip reader, and even inside ...


13

I'm a lawyer in Germany. Here the special conditions between customer and bank are part of the contract. So we are talking about a clause in these special conditions prohibiting the use of a password manager. I went to the site of my bank, drew the conditions and really, it says, the customer is not allowed to store the password on his PC. So this clause ...


10

YES, but there is a big chance that an (internally chip-capable) ATM (depending on region) will reject the card! The most common 2 problems for an ATM (including chip-capable) to reject a card are: a dirty or scratched magstripe (as shown in spork's answer) an erased or mangled (=invalid) magstripe by exposure to magnets or EMP (they need to emit ...


8

Originally it's to do with the difficulty of a brute force attack on the password. Most websites are concerned about the possibility that some attacker might get hold of a file containing everyone's hashed passwords, and conduct an offline brute force attack using that. A properly set up attacker might be able to make millions of guesses per second (exact ...


8

Your information does go to PayPal, who will likely use it to login to your bank account. That way they can verify your information is valid. However - technically - they can also see other information. Anything you see after logging in (your account balance, the various deposits / withdrawals) is visible to them, and they may or may not store that. ...


7

Payment protocols have many variants. However, they mostly boil down to the three following: The card number is just a reference, to be printed on paper. The owner signs with a pen on the paper. The paper may be printed with several technologies, some of them quite primitive (credit cards are embossed so that their number can be copied to paper efficiently ...


7

The card knows this, the reader doesnt. When you put a pin in the reader talks to the microcontroller on the card to verify - which also logs the incorrect attempts. So multiple readers wont help trying to guess somebodies pin! Thats more or less the extent of my knowledge, but an overview of how it works. The underlying protocols I have no knowledge of ...


7

Don't do this, it will not work in ATM machines in my experience. I've had to get a new debit card mailed in last month because there was a little scratch out of the magnetic strip, although I had not noticed and had used it for daily chip-only and wireless transactions. It wouldn't work in any (Dutch) ATM machine afterwards (I tried my own bank's and ...


6

It's for your security. This way people can't accidentally stay logged into their account, so anyone with access to your computer has full access to your bank account. This way thieves don't have motivation to break into your house to steal your computer not just for the value of the computer, but potentially to get access to your life's savings and use it ...


6

I agree that this is bad practice. You can make it better practice by scrambling the answers in one of many ways -- making questions about your father refer to your first car and vice versa, and so on, or giving false answers, or given IRRELEVANT answers (if you can remember what your irrelevant answers were), would discourage/prevent social engineering ...


6

Banks that issue numeric usernames are rather annoying. And while I am more paranoid that most, you're probably right that someone just fat fingered their ID and didn't realize it until they locked you out. To answer the question, some banks do help ensure you are attempting to login with the correct user account. Those "Security Images" you see on some ...


6

The best practice by far is to chose any of the questions but enter random text as the answers. As others have said in the comments, it is far too easy to discover the answers to most of the well-used questions now. Of course, this requires you to carefully keep track of the answers and be able to get hold of them when required. Generally I use Keepass as ...


5

They prevented an attack on your account. This is a desired outcome - had they been able to try unlimited passwords, they'd have guessed yours. The attack was stopped in time, costing you a minor inconvenience. If this pattern was repeated in order to seriously inconvenience you, the bank can simply issue you a new random passcode. They aren't as ...


5

Unless you already have experience in the field, then yes, this is too complex for a small web agency. PHP can be used securely, but you have to know what you are doing. As part of a small web agency, I worked on a high security system to manage a bill payment service with many similar requirements to an online banking system. The project never reached ...


4

It likely depends on what network is being used to process the card. If the network is EFTPOS-like, a PIN is typical. However, if the network is credit-like, a signature is typical (at least, before EMV existed). A lot of cards are dual-branded, and how they are processed can depend on the configuration of the merchant's terminal. It's not likely to be a ...


4

What I think you'll find is that if you're in a country with Chip+PIN deployed, if a merchant takes a signature instead (usually because their Chip+PIN system is down) then the fraud liability moves from the customer to the merchant. So if you have fraudulent transactions on your card where the merchant doesn't have the PIN you can just dispute them and the ...


4

You could generate the passcode by taking a consecutive number and append one or more additional digits to it which are a checksum of the actual number. You can check the validity of a passcode on the client-side by checking if the checksum-digits entered by the user match the actual part of the passcode. One checksum-digit reduces the chance to ...


4

There is an OpenPGP standard for encrypting and signing email so that you can provide, confidentiality, integrity and authentication towards the person who is reading your email.


3

Well really the point of this advice is more along the lines of "Don't put your password anywhere". As otherwise stated, this is a legal statement intended to cover the bank's asses in case the password gets stolen. In the sense of a password manager, it's really nothing more than writing your password in a book and storing it in a safe. If someone were to ...


3

A 500 server error might hint that you did something the developers weren't expecting, but it does not mean that there is a vulnerability. Maybe it just outputs a "hacking attempt averted" message in the log and gives you a nondescript error to not give you any useful information. When you are convinced the software is unsafe, you could spread some FUD ...


3

Signing for a credit card transaction is still quite common in countries where they use the magnetic strip on the side rather than the embedded smart card chip (which uses a PIN code). Note that this is a choice of the credit card company. A pin is indeed more secure, but for usability reasons not enforced everywhere (in Europe it is quite common these ...


3

This does not mean that your bank is storing your passwords in a plaintext format. The bank could simply be truncating the input password to a certain length before hashing it. It is a security flaw as there is no good reason to artificially limit the length of passwords, but it might not be as bad storing passwords in plaintext. I would write to them and ...



Only top voted, non community-wiki answers of a minimum length are eligible