Tag Info

Hot answers tagged

31

The most likely reason is that the backend only supports case-insensitive passwords. To quote OWASP: Occasionally, we find systems where passwords aren't case sensitive, frequently due to legacy system issues like old mainframes that didn't have case sensitive passwords. The chances of this happening are much higher with stodgy old institutions ...


28

As Phil stated, you can still use the card using its number (as you would do on-line). Also, some ATM machine won't accept the card if not able to read the magnetic strip. The best thing is to use a credit card: in that case you can block the payment and get a refund.


28

You're not comparing apples to apples in your comparison of password strength to your bank PIN. Most traditional passwords strength theologies are predicated on the fact that your username and password is all that stands between you and your precious secure data. These are merely two objects that you know and as such it's in your best interest to have a ...


25

I am not a laywer, but a properly constructed password manager stores passwords approximately as securely as any modern banking system. I can't speak to the legality of using a password manager, but I can say that on a philosophical level, anywhere a personally provided password is acceptable as identification, a (properly constructed) password manager ...


23

Yes, you can. On some places you can find a device called demagnetizer. Just run your card over it (or over a very strong magnet), and the magnetic track will be corrupted and you will only be able to use the chip part of the card.


19

Yes it does work as you say. The chip is "tamper resistant" and will erase the "seed" (secret key) if any attempt is made to attack it. This is often accomplished by having a non-user-replaceable battery and a "trap" that breaks Power to the device once the device is opened, or the chip Surface is removed. The key is then stored in a SRAM, requiring Power to ...


18

Once you submit that form, the information clearly goes to PayPal. So, yes, your password is definitely sent to PayPal. However, PayPal is saying that that it only uses your bank account credentials to confirm/verify your account. What seems to happen is that PayPal takes your information then sends it to your online banking provider for verification. What ...


16

I have never heard of this so I can't say for sure, but I would guess that the original premise is flawed: I don't think any bank would have a policy stating they will not insure your account against fraud if you store your password somewhere outside of your own head. Enforcing that rule would require passwords to be easy to remember, and consequently easy ...


15

Is my password sent to Paypal? Yep. Giving your password to PayPal may be a breach of your bank's Terms and Conditions and/or make you personally liable for any fraud that takes place through that system. Also PayPal can see the personal information and transaction history associated with that account. Hope you trust PayPal real good now! Or is ...


14

Embossed letters are still present on CC to allow to quickly carbon-copy (literally) the card on paper. That's in the (very) old days, but still allowed today, and it will count as PRESENTIAL. Magnetic strip is still there because half of the CC readers still work that way. ATM and TPV outside USA and UE are still missing the chip reader, and even inside ...


14

Typically, it is a choice between usability and security. Users have a surprising amount of trouble with capitals in password so capitalizing password before hashing them makes it easier on the user. Of course, that also decreases the maximum entropy of a password of a given length. To compensate, you should use longer passwords... If you're lot limited to ...


13

I'm a lawyer in Germany. Here the special conditions between customer and bank are part of the contract. So we are talking about a clause in these special conditions prohibiting the use of a password manager. I went to the site of my bank, drew the conditions and really, it says, the customer is not allowed to store the password on his PC. So this clause ...


11

YES, but there is a big chance that an (internally chip-capable) ATM (depending on region) will reject the card! The most common 2 problems for an ATM (including chip-capable) to reject a card are: a dirty or scratched magstripe (as shown in spork's answer) an erased or mangled (=invalid) magstripe by exposure to magnets or EMP (they need to emit ...


8

Don't do this, it will not work in ATM machines in my experience. I've had to get a new debit card mailed in last month because there was a little scratch out of the magnetic strip, although I had not noticed and had used it for daily chip-only and wireless transactions. It wouldn't work in any (Dutch) ATM machine afterwards (I tried my own bank's and ...


8

Originally it's to do with the difficulty of a brute force attack on the password. Most websites are concerned about the possibility that some attacker might get hold of a file containing everyone's hashed passwords, and conduct an offline brute force attack using that. A properly set up attacker might be able to make millions of guesses per second (exact ...


8

Your information does go to PayPal, who will likely use it to login to your bank account. That way they can verify your information is valid. However - technically - they can also see other information. Anything you see after logging in (your account balance, the various deposits / withdrawals) is visible to them, and they may or may not store that. ...


7

The card knows this, the reader doesnt. When you put a pin in the reader talks to the microcontroller on the card to verify - which also logs the incorrect attempts. So multiple readers wont help trying to guess somebodies pin! Thats more or less the extent of my knowledge, but an overview of how it works. The underlying protocols I have no knowledge of ...


7

The best practice by far is to chose any of the questions but enter random text as the answers. As others have said in the comments, it is far too easy to discover the answers to most of the well-used questions now. Of course, this requires you to carefully keep track of the answers and be able to get hold of them when required. Generally I use Keepass as ...


6

One of the reasons that banks often have case insensitivity in their passwords is because of phone banking: banks existed FAR before the internet existed, even before telephones were a thing. So once telephones became widespread, many major banks allowed people to to banking stuff via the telephone. it makes sense: all you need is two account numbers and a ...


5

I do not see an increased risk of attack due to being an ISO certified organization. ANSI (The governing standards body) does not release ISO certified organizations business names. There are organizations that offer you the ability to look up an ISO 27001 certified organization but those organizations have elected to register voluntarily. I would ...


4

There is an OpenPGP standard for encrypting and signing email so that you can provide, confidentiality, integrity and authentication towards the person who is reading your email.


4

The SecurID token has a "seed" value assigned to it, and is programmed with a specific algorithm that generates numbers based on the seed and its system clock. The seed value is also stored in a file that is shipped with the token. Upon receiving the token, System Administrators import the seed file to the authentication server. Since the SecurID token ...


3

Anti-skimming techniques are just a subset of anti-fraud techniques. Anti-fraud in ATMs is the collection of defense mechanism against payment card fraud. It includes anti-skimming devices, cameras embedded in ATMs, measures to prevent shoulder surfing, etc. Anti-skimming devices in particular are devices installed on or embedded in the ATM. They prevent ...


3

If your debit card has an EMV chip (almost all chips are based on EMV today), it very likely does know your PIN (or at least how to verify an entered PIN). Whether that capability is actually used depends on the type of transaction and terminal; if the terminal is online capable, it might as well verify the PIN directly with your bank's servers, which also ...


3

Banks are usually not known to work in an agile way and quickly follow the latest developments. Like with lots of other large companies there is lots of paper work involved if somebody tries to change something, which costs efforts, man power, time and thus money. I don't think that a system administrator just can decide to change the ciphers. Instead it ...


3

I guess the most concise answer to this question is: They are insured. Currently industry standards don't require PFS and therefore insurances pay even if the bank had no PFS. There was a similar question on 30c3, about why the banks are using Windows XP as their operating system. Those standards can also be a reason why banks can't implement new methods ...


3

A 500 server error might hint that you did something the developers weren't expecting, but it does not mean that there is a vulnerability. Maybe it just outputs a "hacking attempt averted" message in the log and gives you a nondescript error to not give you any useful information. When you are convinced the software is unsafe, you could spread some FUD ...


3

Well really the point of this advice is more along the lines of "Don't put your password anywhere". As otherwise stated, this is a legal statement intended to cover the bank's asses in case the password gets stolen. In the sense of a password manager, it's really nothing more than writing your password in a book and storing it in a safe. If someone were to ...


3

It is only part of the authentication, with the physical presence of the card also being part of the proof. You get locked out after a sequence of failed attempts, so with a 4-digit only PIN the total chance of someone guessing the PIN is generally 0.03%, or 0.003% and 0.0003% for 5- and 6-digit PINs and less than 0.00025% when you have the option of 4-, 5- ...


2

The requirements for passwords which contain digits, symbols and mixtures of upper-and-lower case letters are predicated on the idea that the attacker has a copy of the hashed password. Since the attacker has a copy of the hashed password, the attacker can run millions and millions of guesses against it, based on probing innumerable dictionary entries, plus ...



Only top voted, non community-wiki answers of a minimum length are eligible