|
I know of a certain national bank that only allows letters and numbers. No punctuation or special characters. I swear they actually WANT their customers to have their accounts ripped off.
|
|
|
|
|
Dave Kreskowiak wrote: I swear they actually WANT their customers to have their accounts ripped off.
It really does feel that way in some of these cases, because the logic they use is so bad.
I also know that many only allow your password to be only 16 chars in length (or shorter) even though password length is the one thing that actually strengthens passwords. It's crazy.
|
|
|
|
|
I know some than only use a PIN 
M.D.V. 
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
Nelek wrote: I know some than only use a PIN
And that is a perfect additional example of the contrast you find. Some sites remove functionality that is completely safe, other sites just open the door for the thieves. 
|
|
|
|
|
I completely understand your frustration. I also hate websites (mostly banks) that disable pasting on their websites and just for gigs, they'll need me to type certain things like account numbers, BSB code, etc. twice.
I use Don't F*** With Paste[^] extension on Chrome and tell them straight off. I'll copy, paste, cut, do whatever the hell I want on my computer. I will treat any entity that assumes an intellectual high-ground (while knowing next to nothing about security in reality) with great disdain, and will override their "security rules" with extreme prejudice.
I'd have rambled on a bit more if this was the soapbox, but the kid sister is watching so I'll go play merry-go-round instead. 
|
|
|
|
|
Rajesh R Subramanian wrote: I will treat any entity that assumes an intellectual high-ground (while knowing next to nothing about security in reality) with great disdain, and will override their "security rules" with extreme prejudice.
I think disabling paste in password boxes are a great idea when it comes to securing customers, their data and money. Please tell me what you think of me now (give your best shot!). 
BTW, thanks for that extension.
"It is easy to decipher extraterrestrial signals after deciphering Javascript and VB6 themselves.", ISanti[ ^]
|
|
|
|
|
|
Raj is (or was?) a nice guy.
Come to think of it, with Aussies and their compulsive behaviour to shorten up words, you might as well be referred to as Raj.
"It is easy to decipher extraterrestrial signals after deciphering Javascript and VB6 themselves.", ISanti[ ^]
|
|
|
|
|
lw@zi wrote: Come to think of it, with Aussies and their compulsive behaviour to shorten up words, you might as well be referred to as Raj.
It's kind of why I said it's likely to be "another Raj". That, and the outsourcing to India.
|
|
|
|
|
Thanks! It is very refreshing to hear from others who really loathe these bad policies too.
|
|
|
|
|
Does your password manager not offer an option to simulate keystrokes to enter your password, rather than blindly relying on the clipboard?
(I have no idea - I don't use a password manager - at least nothing that'll try to type in anything for me out of "convenience")
|
|
|
|
|
dandy72 wrote: Does your password manager not offer an option to simulate keystrokes
Simulating keystrokes is more difficult in an Android app and it is the Android app that they (bank) removed the paste ability from.
|
|
|
|
|
I see.
As far as I'm concerned...considering the number of Android devices out there that have known exploits that'll never be patched, because OEMs can't be bothered...all banks should block Android altogether.
I rarely side with banks, but Android device vendors are downright irresponsible. IMNSHO.
|
|
|
|
|
Ok, I can accept that Android devices are vulnerable. That's fine.
But, then, the resolution for the bank is not to disallow pasting...it is to disallow the use of an Android device altogether. In other words, they shouldn't have ever created an Android app in the first place. I would accept that decision more readily than the blocking paste solution.
But then that would mean they needed to block the web site from Android Web browsers too. 
It would be interesting and funny if the bank just came out and said, "Sorry, you can only use our e-banking via Apple devices."
|
|
|
|
|
|
raddevus wrote:
I contacted them (via their Twitter support) and explained that this is a security fallacy that pasting is dangerous.
Write a piece for the local newspaper, based on facts, explaining how the bank either does not take security seriously, or is run by incompetents.
And be sure to name the bank by name 
Bastard Programmer from Hell 
If you can't read my code, try converting it here[^]
"If you just follow the bacon Eddy, wherever it leads you, then you won't have to think about politics." -- Some Bell.
|
|
|
|
|
|
If you get the paper to publish your letter... 
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
You better stock up on lawyers then
Bastard Programmer from Hell
If you can't read my code, try converting it here[^]
"If you just follow the bacon Eddy, wherever it leads you, then you won't have to think about politics." -- Some Bell.
|
|
|
|
|
Eddy Vluggen wrote: You better stock up on lawyers then
Exactly why I have not written the article.
However, did you see the update to my post?
I found an article from the National Cyber Security Centre which also has links to Troy Hunt's explanation on why pasting is safe and important and it has a link to a Wired article 2015 which has very interesting info on why pasting should(must) be available in apps.
|
|
|
|
|
So, if I find the tweet, I'll know the bank by name?
Bastard Programmer from Hell
If you can't read my code, try converting it here[^]
"If you just follow the bacon Eddy, wherever it leads you, then you won't have to think about politics." -- Some Bell.
|
|
|
|
|
|
I don't have/use twitter; I assumed all tweets were public
Bastard Programmer from Hell
If you can't read my code, try converting it here[^]
"If you just follow the bacon Eddy, wherever it leads you, then you won't have to think about politics." -- Some Bell.
|
|
|
|
|
raddevus wrote: But how could the paste functionality EVER be an exposure?
In order to paste, you have to have previously copied your password to the clipboard, and it stays there until cleared. That's a security risk right there.
Actually, I've been concerned about copying my password to the clipboard for a while now.
|
|
|
|
|
patbob wrote: and it stays there until cleared
Not if you're using a decent password manager. For example, KeyPass gives you a 30-second countdown, and then clears the clipboard.
Although quite how that will work with the new "Cloud Clipboard" feature remains to be seen. 
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
