New answers tagged

5

So both of your scenarios rely on the attacker having root access to the phone. In security, it's generally considered that once an attacker has root access, it's game over. That said, there are still interesting things to be said about your question. You asked: Is there a situation where the secure element does offer a clear security benefit to this ...


1

Your scheme isn't terribly likely to work because not all ATMs keep the card, many are swipe. Any thief that sees two pins will think only one is valid, and can easily bypass your scheme by just using an ATM that you swipe the card instead of the ATM taking it.


2

Anything you can do to mitigate the threat of usage after the physical-theft of the card is a great idea. Making them take longer by making them make mistakes and/or trying in multiple places is a solid idea. That is, aside from the ultimate mitigation of keeping your bank's phone numbers in your phone so you can contact them immediately to report card theft....


5

Can an attacker get information off the card? Yes, at least some can, and the UK consumer group Which? mentioned in the question did it: Our researchers tested 10 cards (six debit and four credit, from volunteers) to assess security risks. Contactless cards are coded to 'mask' personal data, but using an easily obtainable reader and free software ...


1

I've been doing professional pentesting for quite a while covering many of the banks having a permit here in Switzerland. Traditionally they were using username/password only. Then they switched to TAN (transaction authentication number) handed out on paper. I just know 2 remaining banks in Switzerland which are still doing this. There are two reasons: (1) ...


1

Most banks would ideally to use multiple stages of authentication. These are classified as: Something you know (password) Something you have (card / token / phone) Something you are (biometric) By asking for a DoB, your bank is restricting itself to only one source. Considering that once a password is known it is hard to assume that the attacker cannot ...


4

I've never heard of just using the date of birth for authentication. It's a bad idea as a date of birth is non-revocable. Meaning if it is "compromised" you can't change it. If it is the only means of authentication for consulting account or transactions it's a REALLY BAD IDEA. But that brings me to my second point. It is, in general, not considered your ...


1

In the big picture it may actually be more secure. When we computer people talk about security we talk about bit of entropy, hash algorithms, brute force attempts and the like. It's easy to forget one simple, unavoidable rule. People are stupid! All of that goes out the window when a user writes down their password, pin number, and security question/...


1

it is not secure enough from global point of view. Think to have system trying to log to 100000 accounts, using one password number. Why many banks rely on it, is above my undertstanding. Even viewing your account (without ability to withdraw any money) can actually make harm (address, ballance,...). Another problem is that even locking your account can be ...


0

Yes its fine, but only if its part of multi-factor authentication* and includes a system of side-channel verification on user actions**. All less secure solutions are in my opinion not adequate in a modern internet bank and does not address infected computers, MIBs etc. *For example that you have to vouch for the computer you are using, through your ...


3

It seems like weak security, but in reality a brute force hack is not feasible for online banking. Banks use very robust fraud detection systems, and very rigorous monitoring. Account lockout typically requires a phone call to re-activate, unlike many other online systems which simply use a time-based lockout. They will also almost certainly be using anti-...


2

If as you pointed in notes: Someone entering my account is still not able to make a payment before it goes through another security mechanism (which we will assume to be good). Then it is likely that the only thing the 6-digit password protects is the account balance and history. For comparison: my Japanese bank sends me my account history printed, in ...


8

Contrary Opinion: Beware It is highly likely that you as the user have not been made aware of other security measures put in place by your bank in front of your PIN. I know that as for CapitalOne360, which has a similar 4 - 6 digit pin system, I was shocked! But after a while of using the PIN on the same computer, I finally needed to login on an alternate ...


6

Is a 6 digit numerical password secure enough for online banking? No, it is not, not just because of ability of a malicious user to break such an authentication mechanism, but because it violates PCI-DSS compliance standards and the FFIEC guidance on authentication. In addition, multi-factor authentication has been required by FFIEC guidance since 2006. I'...


59

Unusual? Yes. Crazy? No. Read on to understand why... I expect your bank has a strong lockout policy, for example, three incorrect login attempts locks the account for 24 hours. If that is the case, a 6-digit PIN is not as vulnerable as you might think. An attacker that tried three PINs every day for a whole year, would still only have about a 0.1% chance ...


5

I'm going to take a contrarian stance, and say yes, it's secure enough, for a bank. Banks usually have lots of money to recover from breaches Banks usually have lots of influence with the government, and can avoid class-action lawsuits (I'm from Canada, and we have only a few, large banks) Banks have lots of customers, and fewer support calls = more money ...


4

Compared to common practices in the sector, your conditions are not that unusual. My bank has similar policies, with two notable differences: the username is NOT my card number. I have received it by mail in a protected envelope, similar to one they used to send my PIN. It's not a real secret though, it can be found on some of the statements as well. my ...


63

A 6 digit numerical password doesn't do much. Why 6 Digits? Troy Hunt has an excellent blog about being forced to create weak passwords where he talks about various bad practices including forcing short numerical passwords and puts forward the often used excuse that “We want to allow people to use the same password on the telephone keypad” The only ...


16

Original answer This is a bad, bad policy. There are only 106 or a million different 6-digit numbers. That is so too little. It is almost impossible to prevent an offline brute force attack, no matter how slow a hashing algorithm you use. If one attempt takes 1 second, you will crack a password in 11 days. It may also be too little to completely stop a ...


3

Thanks to comments from @Anders (thx!), I'm unsure if the password generator is a shared service or a personal authentication token like digipass or SecureID. Password generator is a shared service In this situation, Alice can only get the signed response H(R,K) by proving to the password generator that she is Alice by presenting her PIN. If Alice knew K, ...



Top 50 recent answers are included