Hot answers tagged

64

A 6 digit numerical password doesn't do much. Why 6 Digits? Troy Hunt has an excellent blog about being forced to create weak passwords where he talks about various bad practices including forcing short numerical passwords and puts forward the often used excuse that “We want to allow people to use the same password on the telephone keypad” The only ...


59

Unusual? Yes. Crazy? No. Read on to understand why... I expect your bank has a strong lockout policy, for example, three incorrect login attempts locks the account for 24 hours. If that is the case, a 6-digit PIN is not as vulnerable as you might think. An attacker that tried three PINs every day for a whole year, would still only have about a 0.1% chance ...


54

A scenario such banks might want to protect you from could be this: you visit your banking website and do your banking stuff. after you are finished you log out and then navigate to some other website to look at cat pictures or whatever. you leave your computer with the cat picture website open. Because there is nothing incriminating on your screen, you ...


36

Why security indicators fail vs. phishing There is no action that can be taken that is economically viable. Put another way, it's too effortful to defend against phishing attacks. See 'So long and no thanks for the externalities' for an example on the US economy and information workers. You are correct that checking for URL correctness is error-prone, and ...


28

I was going to suggest that ensuring that the login screen for the online banking system showed the name of the bank in green, in the address bar might work. But then I started wondering if any of the local banks I know about did that properly. It's less encouraging than I'd hoped. For these nine fairly large banks, 6 provide the name of the bank in the ...


26

There's a couple of things going on here: Bankings sites will use cache-control headers to forbid cacheing of the pages. So when you click back the browser has to reload the page from the server. Some parts of the site may have a strict flow of pages, e.g. you enter transaction details, enter your SMS code, view transaction confirmation. These require ...


26

This will be abused and instead of password dumps we will see attackers trading voice sample dumps and building huge databases of identified voice samples from public documents and places like YouTube. There are also other issues here that make this a bad choice. There's no plausible deniability if someone didn't want to be coerced into authenticating an ...


19

This keeps popping up every year as the next big thing. 2016:Citi 2015:ING 2013:Barclays This 2014 paper Automatic speech recognition for under-resourced languages: A survey. Speech Communication by Besacier, L., Barnard, E., Karpov, A., & Schultz, T. (not open access) discusses the state-of-the-art of speaker recognition technologies. The survey ...


16

Original answer This is a bad, bad policy. There are only 106 or a million different 6-digit numbers. That is so too little. It is almost impossible to prevent an offline brute force attack, no matter how slow a hashing algorithm you use. If one attempt takes 1 second, you will crack a password in 11 days. It may also be too little to completely stop a ...


13

It's All About the Security Model We see reference to "Checking for jailbroken/rooted device" in nearly all Mobile Application Security Checklists (e.g OWASP). When comparing it to desktops or web browsers we have to keep in mind that they have different threat models. For example on desktop machines when designing an application we already know that there ...


12

The problem isn't with pasting, it's with copying confidential data. The copy buffer isn't a protected resource and can be accessed fairly freely. That said, account and routing numbers aren't really confidential as you give them out on every check so this idea sounds hair brained. Perhaps they do this to give the impression of security to less informed ...


8

Do Banks Really Give Out New Expiration Dates? Yes. This is a value-added service usually called something like Account Updater (emphasis mine): Serving as an automated, dedicated, and secure clearinghouse, VAU works by establishing a streamlined process for the electronic exchange of updated account information among participating merchants, ...


8

ATMs normally lie on a isolated network directly to the bank that owns the ATM. This is normally enforced by a VPN-router if theres no leased point-to-point line at the location, where the local end does not allow any traffic outside the VPN, even if malicious software on the ATM deliberately tried, and the remote end's firewall is configured to not allow ...


8

PayPal is NOT asking for your bank details. It is Trustly that is asking for your bank details. Trustly is a Swedish company. It operates in Sweden, Finland, Poland, and a few other companies. They have an agreements with Paypal to provide options to top up your Paypal account (similar agreements are made with Skrill/Moneybookers). This is not a scam. Now ...


8

Contrary Opinion: Beware It is highly likely that you as the user have not been made aware of other security measures put in place by your bank in front of your PIN. I know that as for CapitalOne360, which has a similar 4 - 6 digit pin system, I was shocked! But after a while of using the PIN on the same computer, I finally needed to login on an alternate ...


7

This isn't as common now, but quite some time ago a lot of websites were just HTML wrappers around classic terminal (IBM 3270 and the like) applications which were being scraped statefully, and this was especially prevalent in legacy industries where the whole idea of a separation between view and model is very, very new. It's possible that a lot of banking ...


7

Microsoft is supporting Windows XP under certain circumstances As this article states the US Navy has re-upped support for their Windows XP footprint for another year as of 2015. Microsoft is supporting the operating system from several aspects under these special agreements. Security Patches Bug Fixes Customer Technical Support Due to the high level ...


6

Is a 6 digit numerical password secure enough for online banking? No, it is not, not just because of ability of a malicious user to break such an authentication mechanism, but because it violates PCI-DSS compliance standards and the FFIEC guidance on authentication. In addition, multi-factor authentication has been required by FFIEC guidance since 2006. I'...


5

If you want to do home banking on a public network I would always recommend using a VPN. This should protect you against MITM attacks and other funny things that can happen on a public network. There is nothing wrong with using a Windows tablet to connect to your bank. Be sure to install a decent antivirus/malware and install your Windows security updates. ...


5

Well, what they are really supposed to do is look to the most effective physical security measures used in the customary practices of high-security data centers in data processing industries in general, plus implement specific measures & practices that their lawyers tell them are required by the collective body of federal regulations that speak to the ...


5

I'm going to take a contrarian stance, and say yes, it's secure enough, for a bank. Banks usually have lots of money to recover from breaches Banks usually have lots of influence with the government, and can avoid class-action lawsuits (I'm from Canada, and we have only a few, large banks) Banks have lots of customers, and fewer support calls = more money ...


5

Can an attacker get information off the card? Yes, at least some can, and the UK consumer group Which? mentioned in the question did it: Our researchers tested 10 cards (six debit and four credit, from volunteers) to assess security risks. Contactless cards are coded to 'mask' personal data, but using an easily obtainable reader and free software ...


5

So both of your scenarios rely on the attacker having root access to the phone. In security, it's generally considered that once an attacker has root access, it's game over. That said, there are still interesting things to be said about your question. You asked: Is there a situation where the secure element does offer a clear security benefit to this ...


4

The green lock indicates that an Extended Validation Certificate is being used. This means that the organisation has gone through some extended checks before the certificate is issued for their domain. You should be right to be suspicious if this suddenly changes to a DV or OV certificate (Domain Validated or Organisation Validated), which are easier to ...


4

A virtual machine can't protect the guest OS from the host (without specialized hardware features to support it). You will not gain any security from running Linux in a VM if Windows gets infected, and if your VM gets infected then that's still the environment you intended to use for security sensitive things that's new insecure. Have you tried live USB ...


4

Compared to common practices in the sector, your conditions are not that unusual. My bank has similar policies, with two notable differences: the username is NOT my card number. I have received it by mail in a protected envelope, similar to one they used to send my PIN. It's not a real secret though, it can be found on some of the statements as well. my ...


4

I've never heard of just using the date of birth for authentication. It's a bad idea as a date of birth is non-revocable. Meaning if it is "compromised" you can't change it. If it is the only means of authentication for consulting account or transactions it's a REALLY BAD IDEA. But that brings me to my second point. It is, in general, not considered your ...


3

Any form of hacking involves being able to change the underlying operating system or applications. If an attacker were completely prevented from doing this, then attack is impossible. Operating systems have vulnerabilities. They always have, and they always will. But what if the OS and all applications ran off of a medium physically incapable of being ...


3

I work in the IT system of a banking company, and as such I know a bit about what happens. Here is the sequence of events, as I understand it, when a payment goes through: You send the payment information (BIC, PIN, etc.) to the seller's bank; The seller's bank transmits the payment request to your bank; Your bank receives the payment request, and decides ...



Only top voted, non community-wiki answers of a minimum length are eligible