Tag Info

Hot answers tagged

19

You are right in that one of the ways an attacker could intercept the code is to hack your phone. An attacker could also: Clone your phone's sim, and request a banking code to be sent to your phone's number. they could also possibly clone a non-sim phone as well Steal your phone. Once they have your phone they could perform transactions Perform a man in ...


10

The whole idea about a second factor/step for authentication is to provide two independent layers of security. Vulnerabilities in one layer should not affect the security of the other. Second factor authentication was designed and used properly in the past but lately it has been weakened by companies who care more about profit than security. SMS messages ...


7

Payment protocols have many variants. However, they mostly boil down to the three following: The card number is just a reference, to be printed on paper. The owner signs with a pen on the paper. The paper may be printed with several technologies, some of them quite primitive (credit cards are embossed so that their number can be copied to paper efficiently ...


6

It's for your security. This way people can't accidentally stay logged into their account, so anyone with access to your computer has full access to your bank account. This way thieves don't have motivation to break into your house to steal your computer not just for the value of the computer, but potentially to get access to your life's savings and use it ...


6

Banks that issue numeric usernames are rather annoying. And while I am more paranoid that most, you're probably right that someone just fat fingered their ID and didn't realize it until they locked you out. To answer the question, some banks do help ensure you are attempting to login with the correct user account. Those "Security Images" you see on some ...


5

They prevented an attack on your account. This is a desired outcome - had they been able to try unlimited passwords, they'd have guessed yours. The attack was stopped in time, costing you a minor inconvenience. If this pattern was repeated in order to seriously inconvenience you, the bank can simply issue you a new random passcode. They aren't as ...


5

Unless you already have experience in the field, then yes, this is too complex for a small web agency. PHP can be used securely, but you have to know what you are doing. As part of a small web agency, I worked on a high security system to manage a bill payment service with many similar requirements to an online banking system. The project never reached ...


5

I agree that this is bad practice. You can make it better practice by scrambling the answers in one of many ways -- making questions about your father refer to your first car and vice versa, and so on, or giving false answers, or given IRRELEVANT answers (if you can remember what your irrelevant answers were), would discourage/prevent social engineering ...


4

It likely depends on what network is being used to process the card. If the network is EFTPOS-like, a PIN is typical. However, if the network is credit-like, a signature is typical (at least, before EMV existed). A lot of cards are dual-branded, and how they are processed can depend on the configuration of the merchant's terminal. It's not likely to be a ...


4

What I think you'll find is that if you're in a country with Chip+PIN deployed, if a merchant takes a signature instead (usually because their Chip+PIN system is down) then the fraud liability moves from the customer to the merchant. So if you have fraudulent transactions on your card where the merchant doesn't have the PIN you can just dispute them and the ...


4

This is mainly to prevent session fixation attacks - if old sessions are thrown away regularly, the less valuable are hijacked sessions (http://en.wikipedia.org/wiki/Session_fixation). I think another reason for the bank sites performing this way is to give users a secure feeling - most of them aren't technically skilled people and this auto-outlogging ...


4

It's been done when using two factor entered into computers (and directly at ATMs; see link at very bottom for the ATM 2-factor SMS problems). KrebsOnSecurity.com blog lists many banking eheists, including this one: https://krebsonsecurity.com/category/smallbizvictims/page/4/ "The year before the cyber theft, Comerica had switched from using digital ...


4

You could generate the passcode by taking a consecutive number and append one or more additional digits to it which are a checksum of the actual number. You can check the validity of a passcode on the client-side by checking if the checksum-digits entered by the user match the actual part of the passcode. One checksum-digit reduces the chance to ...


3

This does not mean that your bank is storing your passwords in a plaintext format. The bank could simply be truncating the input password to a certain length before hashing it. It is a security flaw as there is no good reason to artificially limit the length of passwords, but it might not be as bad storing passwords in plaintext. I would write to them and ...


3

Signing for a credit card transaction is still quite common in countries where they use the magnetic strip on the side rather than the embedded smart card chip (which uses a PIN code). Note that this is a choice of the credit card company. A pin is indeed more secure, but for usability reasons not enforced everywhere (in Europe it is quite common these ...


2

(rather than keep on saying "your daughter", I'll just refer to her in the second person below....) The most likely cause is that the money has been sent to your account by accident (this happens much more often than banks like to admit). If this is the case, then in most jurisdictions (you may want to check further) the money is technically yours. However ...


2

It sounds like her account is being used as an unwitting money mule. In this case, it's likely her account has been compromised and you should check your computers for infection and change the password from a computer that is safe in order to avoid further problems. If the money clears, speak to your bank, do not withdraw it as it may lead to legal ...


2

You are entering your internet banking credentials into an interface owned by a merchant. The iframe comes from POLi, but there's no easy way for an end user to verify that, and the parent page would still have the opportunity to mess with the frame. So you should not enter your credentials on this interface unless you trust: POLi not to store or misuse ...


2

Another reason password entry fields (not limited to banks' web sites; I've seen several native PC applications, notably Lotus Notes, do this) are sometimes filled with random numbers of characters is to prevent anyone from shoulder-surfing the length of one's password and using that information to narrow the scope of passwords to try.


2

It will depend on your bank, obviously, as some will require other authentication for actually transferring funds (several use 2FA, seperate data, text message authorisation), but risks I can think of include: Transferring funds, for banks that would allow that Paying bills, then socially engineering refunds elsewhere Collection of information for identity ...


2

As well as the above answers, it's also to prevent people hopping onto your computer if you're away from your machine. For example, if Bob signs into his online banking in his workplace, then decides to grab a coffee without locking his workstation first; then anyone could walk past and jump straight into his bank account. With the X minute expiration/log ...


2

Session expiry is incorporated into applications to safeguard the user from session hijacking or cookie thefts. Not all users are tech savvy and might not understand what session hijacking or cookie thefts are.So forcing the users to login every few minutes of inactivity is for safeguarding the users information. Banking applications use cookies and ...


2

It's not all that bad. First of all I don't think that Windows XP is more vulnerable than any other software product in the consumer market with the same complexity. Quite to the contrary. An up to date installation of Windows XP is probably as good as it gets for most of us. Don't forget that newer versions of Windows are also vulnerable, most of the time ...


2

Web services can take into account the location of where log in requests are originating from and correlate with your past log in attempts. Similar to how credit card companies will contact you when they notice "unusual activity" on your credit card. This is one piece of logic a organization providing a service on the web can use to address incidents like ...


1

Yes, not connecting them to the Internet is a great firewall. Additionally most of the systems are just dumb terminals connecting to the bank's mainframe systems that actually track the banking information. Compromising a local connection could potentially allow for unauthorized changes to be made on the mainframe systems, but would require that you have ...


1

As a European, I consider my IBAN to be my private information, just like my email address, real name, home address and IP address. I'd like for you to not store any of them, but if you have to, please encrypt them and make sure my information (it's my information, not yours) is secure. So to directly answer your question, yes, encrypt it and don't store ...


1

All these fields are needed to transfer Euros internationally. Both the UK and Latvia are part of SEPA; WP says: SEPA clearance is based on the IBAN bank-account identification and the SWIFT-BIC bank identifier. The bank name and account number can be derived from the IBAN; they are not strictly needed, but it does not hurt to give them.


1

[edited] whilst a card issuer may choose to reuse PAN (long number) to identity a card, a PAN cannot normally be reissued by a different card issuer. The reason for this is because the BIN (first 6 digits) is issued uniquely to a card issuer. There is one exception: If card issuer is bought by another card issuer (e.g. bank 1 buys bank 2) then card ...


1

I read both articles and didn't see SMS banking mentioned anywhere. NFC, Mobile Internet, etc... not sms. So I did a bit more digging and found items such as: SMS Banking - Top Up via SMS which do discus sms and digicel. Lets be clear, sms is not in any way, shape or form secure. But from the articles I've found thus far, you can't do very much through ...


1

Firstly it is refreshing to see people discussing security at this level of detail. Callum Wilson completely nails it in terms of security vs usability. The app does have some problems with usability, we cant offer a password reset, and we can never recover any data if a key is lost. It turns out this is a big weakness in the viability of the app; most ...



Only top voted, non community-wiki answers of a minimum length are eligible