Tag Info

Hot answers tagged

31

The most likely reason is that the backend only supports case-insensitive passwords. To quote OWASP: Occasionally, we find systems where passwords aren't case sensitive, frequently due to legacy system issues like old mainframes that didn't have case sensitive passwords. The chances of this happening are much higher with stodgy old institutions ...


28

As Phil stated, you can still use the card using its number (as you would do on-line). Also, some ATM machine won't accept the card if not able to read the magnetic strip. The best thing is to use a credit card: in that case you can block the payment and get a refund.


23

Yes, you can. On some places you can find a device called demagnetizer. Just run your card over it (or over a very strong magnet), and the magnetic track will be corrupted and you will only be able to use the chip part of the card.


19

Yes it does work as you say. The chip is "tamper resistant" and will erase the "seed" (secret key) if any attempt is made to attack it. This is often accomplished by having a non-user-replaceable battery and a "trap" that breaks Power to the device once the device is opened, or the chip Surface is removed. The key is then stored in a SRAM, requiring Power to ...


18

Once you submit that form, the information clearly goes to PayPal. So, yes, your password is definitely sent to PayPal. However, PayPal is saying that that it only uses your bank account credentials to confirm/verify your account. What seems to happen is that PayPal takes your information then sends it to your online banking provider for verification. What ...


15

Typically, it is a choice between usability and security. Users have a surprising amount of trouble with capitals in password so capitalizing password before hashing them makes it easier on the user. Of course, that also decreases the maximum entropy of a password of a given length. To compensate, you should use longer passwords... If you're lot limited to ...


15

Is my password sent to Paypal? Yep. Giving your password to PayPal may be a breach of your bank's Terms and Conditions and/or make you personally liable for any fraud that takes place through that system. Also PayPal can see the personal information and transaction history associated with that account. Hope you trust PayPal real good now! Or is ...


14

Embossed letters are still present on CC to allow to quickly carbon-copy (literally) the card on paper. That's in the (very) old days, but still allowed today, and it will count as PRESENTIAL. Magnetic strip is still there because half of the CC readers still work that way. ATM and TPV outside USA and UE are still missing the chip reader, and even inside ...


11

YES, but there is a big chance that an (internally chip-capable) ATM (depending on region) will reject the card! The most common 2 problems for an ATM (including chip-capable) to reject a card are: a dirty or scratched magstripe (as shown in spork's answer) an erased or mangled (=invalid) magstripe by exposure to magnets or EMP (they need to emit ...


8

Don't do this, it will not work in ATM machines in my experience. I've had to get a new debit card mailed in last month because there was a little scratch out of the magnetic strip, although I had not noticed and had used it for daily chip-only and wireless transactions. It wouldn't work in any (Dutch) ATM machine afterwards (I tried my own bank's and ...


8

Your information does go to PayPal, who will likely use it to login to your bank account. That way they can verify your information is valid. However - technically - they can also see other information. Anything you see after logging in (your account balance, the various deposits / withdrawals) is visible to them, and they may or may not store that. ...


8

The basic reason is because despite all these issues they don't regularly suffer breaches or theft enough for it to be a market differentiator. Weakened passwords still fend off most online attacks against customer accounts when paired with their system lockouts, multi-factor authentication, and other intrusion controls. Most banking customer passwords ...


8

Do Banks Really Give Out New Expiration Dates? Yes. This is a value-added service usually called something like Account Updater (emphasis mine): Serving as an automated, dedicated, and secure clearinghouse, VAU works by establishing a streamlined process for the electronic exchange of updated account information among participating merchants, ...


7

The best practice by far is to chose any of the questions but enter random text as the answers. As others have said in the comments, it is far too easy to discover the answers to most of the well-used questions now. Of course, this requires you to carefully keep track of the answers and be able to get hold of them when required. Generally I use Keepass as ...


6

One of the reasons that banks often have case insensitivity in their passwords is because of phone banking: banks existed FAR before the internet existed, even before telephones were a thing. So once telephones became widespread, many major banks allowed people to to banking stuff via the telephone. it makes sense: all you need is two account numbers and a ...


5

I do not see an increased risk of attack due to being an ISO certified organization. ANSI (The governing standards body) does not release ISO certified organizations business names. There are organizations that offer you the ability to look up an ISO 27001 certified organization but those organizations have elected to register voluntarily. I would ...


4

The SecurID token has a "seed" value assigned to it, and is programmed with a specific algorithm that generates numbers based on the seed and its system clock. The seed value is also stored in a file that is shipped with the token. Upon receiving the token, System Administrators import the seed file to the authentication server. Since the SecurID token ...


3

Banks are usually not known to work in an agile way and quickly follow the latest developments. Like with lots of other large companies there is lots of paper work involved if somebody tries to change something, which costs efforts, man power, time and thus money. I don't think that a system administrator just can decide to change the ciphers. Instead it ...


3

I guess the most concise answer to this question is: They are insured. Currently industry standards don't require PFS and therefore insurances pay even if the bank had no PFS. There was a similar question on 30c3, about why the banks are using Windows XP as their operating system. Those standards can also be a reason why banks can't implement new methods ...


3

Anti-skimming techniques are just a subset of anti-fraud techniques. Anti-fraud in ATMs is the collection of defense mechanism against payment card fraud. It includes anti-skimming devices, cameras embedded in ATMs, measures to prevent shoulder surfing, etc. Anti-skimming devices in particular are devices installed on or embedded in the ATM. They prevent ...


3

While there are aspects of truth in what you say, you have to look at the bigger picture and look at where banks have liabilities and risks. Banks look to minimise the risk down to a certain level (eg there is a fraud appetite that is accepted by banks, as to try and reduce it further costs more and more, rapidly becoming unworkable) and many of these ...


3

The website is using SHA1 certificates to provide security. The new Chrome browser is showing it as a weak algorithm, because most of the organizations are already migrated to SHA2 certificates. It is just a warning, it does not mean that it would be a non-secured connection.


2

If you live in an area where no ATM and other cash terminal needs the magnetic strip, you can use a strong magnet to scramble the magnet strip. I personally have done this using a recycled neodymium magnet out of a decommissioned hard drive. Note: never put your debit card in a microwave if you intend to use it afterwards.


2

“Chip and PIN” banking cards have a chip, as the name indicates. The chip performs cryptographic operations and stores secret keys. The chip isn't just storage, it's a processor and the storage is not directly accessible from the outside. The chip is physically protected against duplication — it's embedded in a protective layer and designed to self-destruct ...


2

I would start by looking at the OWASP Top 10. Of course there is (a lot) more to it than just having a list. There might also be regulations in your country which should be considered. I highly recommend you to look into this first. Have you thought about the following: Two factor authentication: How are you going to implement this? (Token list, SMS ...


2

After all of us effectively signed a "don't ever disclose your login details to anybody else under any circumstances, or else" agreement with our banks, how is this possible? Sofort AG is a german company, so I'll focus on Germany: There was an antitrust proceeding, and as a result of it, most banks changed their terms and conditions to allow this (at ...


2

Currently, the only way to protect against ACH are detective controls which should be in place at the business and the bank. Most fraud gets detected after accounts get reconciled or after a customer complains that his account was used without authorization. In case of a bank, if a company only uses it for payroll payments and those payments occur once a ...


2

Banks have real money losses, a significant amount of this comes from unauthorized access to bank accounts so they have financial incentives to make it harder for users to lose their password by storing it in the browser at their local internet cafe/library/etc.


1

I think it is here, under 1020.410 (i), which states: If the originator's bank has knowledge that the person placing the payment order is not the originator, the originator's bank shall obtain and retain a record of the originator's taxpayer identification number (e.g., social security or employer identification number) or, if none, alien identification ...



Only top voted, non community-wiki answers of a minimum length are eligible