Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Hot answers tagged

157

It looks like the main site is embedding script from Adobe Marketing Cloud directly into the page. While these scripts are loaded from the same server as the main site it looks like that these scripts communicate with external servers using XHR and also download new script from demdex.net and 2o7.net according to the logs of uBlock Origin. Especially the ...


137

Does it make the site any more secure? No, it doesn't alter anything other than your ability to conveniently save items from a page. Using a browser's developer mode, turning off JS, overriding this with a different script that disables that pop-up, or just grabbing data off the wire after stripping the SSL will all work. Is it a good general practice? ...


129

Many low level crimes are ones of opportunity, not planned out attacks. By separating the two needed pieces of mail in time, it forces the attacker to intercept the same person's mail more than once. This prevents a mail thief from simply walking up to homes and looking for credit cards and activating them all in one step. Now suddenly the thief has to ...


90

It is becoming quite commonplace in the US. Many banks and other financial institutions require the caller to provide an identification number that has been set up beforehand to verify they are indeed talking to an authorized user of the account. They used to ask personal information - social security number, old addresses, security questions, etc. Those ...


81

In my opinion, you did the right thing. There is no situation in which you should ever be required to give up a PIN either over the phone or in person, with the exception of typing it into the (HTTPS) bank's website to login to your account or on a physical banking terminal such as an ATM. The entire purpose of a personal-identification-number (PIN) is to ...


81

I feel that ignoring would be the wrong thing to do, but I'm not sure what to do. If you feel that ignoring this is wrong, look up the bank's phone number from a reputable source, e.g. yellow pages or the banks actual website. Call them, and ask. Or submit a contact form on their website, or similar - in short, contact them through a channel not related to ...


67

A 6 digit numerical password doesn't do much. Why 6 Digits? Troy Hunt has an excellent blog about being forced to create weak passwords where he talks about various bad practices including forcing short numerical passwords and puts forward the often used excuse that “We want to allow people to use the same password on the telephone keypad” The only ...


64

Unusual? Yes. Crazy? No. Read on to understand why... I expect your bank has a strong lockout policy, for example, three incorrect login attempts locks the account for 24 hours. If that is the case, a 6-digit PIN is not as vulnerable as you might think. An attacker that tried three PINs every day for a whole year, would still only have about a 0.1% chance ...


64

What your bank gave you is an USB security token with a digital certificate (like these). These are standardized hardware devices which almost every operating system supports plug&play out of the box. They are very common for implementing multi-factor-authentication to high-security systems in enterprise IT. Your web browser uses HTTPS with client-...


62

Assuming that you called them on a published number, I'd say that this sounds like it was an interactive Voice Response (IVR) system, which is pretty common in the banking world. The concept is that the system takes your authentication information before passing you on to a contact centre agent. The benefit of this from a security perspective is that ...


56

A scenario such banks might want to protect you from could be this: you visit your banking website and do your banking stuff. after you are finished you log out and then navigate to some other website to look at cat pictures or whatever. you leave your computer with the cat picture website open. Because there is nothing incriminating on your screen, you ...


45

There are two standard ways to build such a device: Time-based. The device has a secret key K (known only to the device and to your bank). When you press the button, The device computes F(K, T) (where T is the current time) and outputs it as a 6-digit code. Your bank, which also knows K, can compute the same function. To deal with the fact that the ...


42

I would refuse to give out any personal details to anyone that called me as you can't verify who they are. If they need to talk to you then say you can call back. You can then call through on the direct number, which if it is a large bank will be well known and on their website. You could then ask for an extension number to direct your call once you know you ...


40

Why security indicators fail vs. phishing There is no action that can be taken that is economically viable. Put another way, it's too effortful to defend against phishing attacks. See 'So long and no thanks for the externalities' for an example on the US economy and information workers. You are correct that checking for URL correctness is error-prone, and ...


38

DON'T. Unique passwords is one of the most important aspect of password security, as a breach in a different site will not affect other sites for the same user. Unique passwords per site is almost impossible without password managers. In addition, password managers enable longer password. For instance, most of my passwords are unique, 60-character, ...


35

As Phil stated, you can still use the card using its number (as you would do on-line). Also, some ATM machine won't accept the card if not able to read the magnetic strip. The best thing is to use a credit card: in that case you can block the payment and get a refund.


35

The most likely reason is that the backend only supports case-insensitive passwords. To quote OWASP: Occasionally, we find systems where passwords aren't case sensitive, frequently due to legacy system issues like old mainframes that didn't have case sensitive passwords. The chances of this happening are much higher with stodgy old institutions like ...


32

Yes it does work as you say. The chip is "tamper resistant" and will erase the "seed" (secret key) if any attempt is made to attack it. This is often accomplished by having a non-user-replaceable battery and a "trap" that breaks power to the device once the device is opened, or the chip surface is removed. The key is then stored in a SRAM, requiring power to ...


32

A lot of people get a credit card and leave it in the envelope for a considerable amount of time. Further, separating the data complicates life very greatly for a mail thief. To snatch one piece of mail is a crime of opportunity. But to snatch two on separate days requires veritable stalking. Having gotten one piece, the thief must now return to the ...


31

I am not a laywer, but a properly constructed password manager stores passwords approximately as securely as any modern banking system. I can't speak to the legality of using a password manager, but I can say that on a philosophical level, anywhere a personally provided password is acceptable as identification, a (properly constructed) password manager ...


29

You're not comparing apples to apples in your comparison of password strength to your bank PIN. Most traditional passwords strength theologies are predicated on the fact that your username and password is all that stands between you and your precious secure data. These are merely two objects that you know and as such it's in your best interest to have a ...


29

One way it could work is that Chrome supports FIDO U2F without plugin. Given that now Chrome is now the most popular browser and that Chrome runs on Windows, Mac, and Linux, it's not totally incorrect to claim that "it works in any device that has a USB port, Windows, Mac, Linux and more, and to work out of the box". Did they claim that it works in any ...


28

Update 09/2018: While I previously stated that this might be a good option, the world has changed, and the use of EV is no longer a particularly reliable indicator, even given the drawbacks mentioned below. There are articles such as this one from Troy Hunt which explain the full issue, but, in short, browsers are no longer treating EV certificates as ...


28

As there has been some confusion here, I wanted to add another (and hopefully last) answer to consolidate all the information that is flying around. First of all, what kind of PINs are there in today's banking world? Cardholder PINs: This is the PIN that belongs to your debit or credit card. Unsurprisingly, there's also an ISO norm on how to manage PINs ...


27

Yes, you can. On some places you can find a device called demagnetizer. Just run your card over it (or over a very strong magnet), and the magnetic track will be corrupted and you will only be able to use the chip part of the card.


27

There's a couple of things going on here: Bankings sites will use cache-control headers to forbid cacheing of the pages. So when you click back the browser has to reload the page from the server. Some parts of the site may have a strict flow of pages, e.g. you enter transaction details, enter your SMS code, view transaction confirmation. These require ...


26

This will be abused and instead of password dumps we will see attackers trading voice sample dumps and building huge databases of identified voice samples from public documents and places like YouTube. There are also other issues here that make this a bad choice. There's no plausible deniability if someone didn't want to be coerced into authenticating an ...


25

....they don’t require the user to install any software on the machine.... I thought that the ability for a webpage to browse the file system freely without user action is too commonly restricted by default Yes, that should definitely not be possible without smartcard drivers. This is a fundamental security mechanism of any browser. What gives the clou ...


23

Client side security is just a smokescreen. It will prevent inexperienced people from saving the images or messing with the HTML, but one can easily disable this with a single line of injected javascript. You can mess with the HTML even without this line of JS, using Chrome Inspector. When this trick is used to keep images "secure": I've seen a lot of ...


21

WARNING: Do not change your password! This seems exactly what scammers would do to trick you into giving them your password. Do you really think your bank would send a message like this on Friday with a deadline just over the weekend so there is no chance for you to call them for verification?


Only top voted, non community-wiki answers of a minimum length are eligible