Tag Info

Hot answers tagged

28

You're not comparing apples to apples in your comparison of password strength to your bank PIN. Most traditional passwords strength theologies are predicated on the fact that your username and password is all that stands between you and your precious secure data. These are merely two objects that you know and as such it's in your best interest to have a ...


25

I am not a laywer, but a properly constructed password manager stores passwords approximately as securely as any modern banking system. I can't speak to the legality of using a password manager, but I can say that on a philosophical level, anywhere a personally provided password is acceptable as identification, a (properly constructed) password manager ...


16

I have never heard of this so I can't say for sure, but I would guess that the original premise is flawed: I don't think any bank would have a policy stating they will not insure your account against fraud if you store your password somewhere outside of your own head. Enforcing that rule would require passwords to be easy to remember, and consequently easy ...


13

I'm a lawyer in Germany. Here the special conditions between customer and bank are part of the contract. So we are talking about a clause in these special conditions prohibiting the use of a password manager. I went to the site of my bank, drew the conditions and really, it says, the customer is not allowed to store the password on his PC. So this clause ...


8

Originally it's to do with the difficulty of a brute force attack on the password. Most websites are concerned about the possibility that some attacker might get hold of a file containing everyone's hashed passwords, and conduct an offline brute force attack using that. A properly set up attacker might be able to make millions of guesses per second (exact ...


7

Payment protocols have many variants. However, they mostly boil down to the three following: The card number is just a reference, to be printed on paper. The owner signs with a pen on the paper. The paper may be printed with several technologies, some of them quite primitive (credit cards are embossed so that their number can be copied to paper efficiently ...


7

The card knows this, the reader doesnt. When you put a pin in the reader talks to the microcontroller on the card to verify - which also logs the incorrect attempts. So multiple readers wont help trying to guess somebodies pin! Thats more or less the extent of my knowledge, but an overview of how it works. The underlying protocols I have no knowledge of ...


6

It's for your security. This way people can't accidentally stay logged into their account, so anyone with access to your computer has full access to your bank account. This way thieves don't have motivation to break into your house to steal your computer not just for the value of the computer, but potentially to get access to your life's savings and use it ...


6

I agree that this is bad practice. You can make it better practice by scrambling the answers in one of many ways -- making questions about your father refer to your first car and vice versa, and so on, or giving false answers, or given IRRELEVANT answers (if you can remember what your irrelevant answers were), would discourage/prevent social engineering ...


6

Banks that issue numeric usernames are rather annoying. And while I am more paranoid that most, you're probably right that someone just fat fingered their ID and didn't realize it until they locked you out. To answer the question, some banks do help ensure you are attempting to login with the correct user account. Those "Security Images" you see on some ...


5

They prevented an attack on your account. This is a desired outcome - had they been able to try unlimited passwords, they'd have guessed yours. The attack was stopped in time, costing you a minor inconvenience. If this pattern was repeated in order to seriously inconvenience you, the bank can simply issue you a new random passcode. They aren't as ...


5

Unless you already have experience in the field, then yes, this is too complex for a small web agency. PHP can be used securely, but you have to know what you are doing. As part of a small web agency, I worked on a high security system to manage a bill payment service with many similar requirements to an online banking system. The project never reached ...


4

It likely depends on what network is being used to process the card. If the network is EFTPOS-like, a PIN is typical. However, if the network is credit-like, a signature is typical (at least, before EMV existed). A lot of cards are dual-branded, and how they are processed can depend on the configuration of the merchant's terminal. It's not likely to be a ...


4

What I think you'll find is that if you're in a country with Chip+PIN deployed, if a merchant takes a signature instead (usually because their Chip+PIN system is down) then the fraud liability moves from the customer to the merchant. So if you have fraudulent transactions on your card where the merchant doesn't have the PIN you can just dispute them and the ...


4

You could generate the passcode by taking a consecutive number and append one or more additional digits to it which are a checksum of the actual number. You can check the validity of a passcode on the client-side by checking if the checksum-digits entered by the user match the actual part of the passcode. One checksum-digit reduces the chance to ...


4

There is an OpenPGP standard for encrypting and signing email so that you can provide, confidentiality, integrity and authentication towards the person who is reading your email.


3

A 500 server error might hint that you did something the developers weren't expecting, but it does not mean that there is a vulnerability. Maybe it just outputs a "hacking attempt averted" message in the log and gives you a nondescript error to not give you any useful information. When you are convinced the software is unsafe, you could spread some FUD ...


3

Signing for a credit card transaction is still quite common in countries where they use the magnetic strip on the side rather than the embedded smart card chip (which uses a PIN code). Note that this is a choice of the credit card company. A pin is indeed more secure, but for usability reasons not enforced everywhere (in Europe it is quite common these ...


3

This does not mean that your bank is storing your passwords in a plaintext format. The bank could simply be truncating the input password to a certain length before hashing it. It is a security flaw as there is no good reason to artificially limit the length of passwords, but it might not be as bad storing passwords in plaintext. I would write to them and ...


3

Well really the point of this advice is more along the lines of "Don't put your password anywhere". As otherwise stated, this is a legal statement intended to cover the bank's asses in case the password gets stolen. In the sense of a password manager, it's really nothing more than writing your password in a book and storing it in a safe. If someone were to ...


3

It is only part of the authentication, with the physical presence of the card also being part of the proof. You get locked out after a sequence of failed attempts, so with a 4-digit only PIN the total chance of someone guessing the PIN is generally 0.03%, or 0.003% and 0.0003% for 5- and 6-digit PINs and less than 0.00025% when you have the option of 4-, 5- ...


3

If your debit card has an EMV chip (almost all chips are based on EMV today), it very likely does know your PIN (or at least how to verify an entered PIN). Whether that capability is actually used depends on the type of transaction and terminal; if the terminal is online capable, it might as well verify the PIN directly with your bank's servers, which also ...


2

Another reason password entry fields (not limited to banks' web sites; I've seen several native PC applications, notably Lotus Notes, do this) are sometimes filled with random numbers of characters is to prevent anyone from shoulder-surfing the length of one's password and using that information to narrow the scope of passwords to try.


2

Some online banks, and some other web services, clear the password field and/or replace with a fixed number of characters so that if (for any reason) the login form submission failed or the user double clicked on the Login button then he won't be able to make the same submission again. The "rationale" behind it seems to be that they don't want the password ...


2

Session expiry is incorporated into applications to safeguard the user from session hijacking or cookie thefts. Not all users are tech savvy and might not understand what session hijacking or cookie thefts are.So forcing the users to login every few minutes of inactivity is for safeguarding the users information. Banking applications use cookies and ...


2

It's not all that bad. First of all I don't think that Windows XP is more vulnerable than any other software product in the consumer market with the same complexity. Quite to the contrary. An up to date installation of Windows XP is probably as good as it gets for most of us. Don't forget that newer versions of Windows are also vulnerable, most of the time ...


2

Web services can take into account the location of where log in requests are originating from and correlate with your past log in attempts. Similar to how credit card companies will contact you when they notice "unusual activity" on your credit card. This is one piece of logic a organization providing a service on the web can use to address incidents like ...


2

As well as the above answers, it's also to prevent people hopping onto your computer if you're away from your machine. For example, if Bob signs into his online banking in his workplace, then decides to grab a coffee without locking his workstation first; then anyone could walk past and jump straight into his bank account. With the X minute expiration/log ...


2

It will depend on your bank, obviously, as some will require other authentication for actually transferring funds (several use 2FA, seperate data, text message authorisation), but risks I can think of include: Transferring funds, for banks that would allow that Paying bills, then socially engineering refunds elsewhere Collection of information for identity ...


2

The requirements for passwords which contain digits, symbols and mixtures of upper-and-lower case letters are predicated on the idea that the attacker has a copy of the hashed password. Since the attacker has a copy of the hashed password, the attacker can run millions and millions of guesses against it, based on probing innumerable dictionary entries, plus ...



Only top voted, non community-wiki answers of a minimum length are eligible