3 ms·
The actual authentication mechanism is left up to the card issuer. But using the card's PIN would be considered insecure due to the risk of malware/key-loggers
by Reason077 11y ago
The actual authentication mechanism is left up to the card issuer. But using the card's PIN would be considered insecure due to the risk of malware/key-loggers intercepting it.
My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers.
- paulhart 11y agoWhich may mean that either the bank is storing your password as plaintext (or is hashing every three character combination possible, which would also help a hacker figure out the plaintext).
- ceejayoz 11y ago> My bank asks for three random characters from my online banking password... That's terrifying, really. They shouldn't have any way of getting that data out of the hashed password.
- Reason077 11y agoWell, it's a bank. If a hacker can penetrate to the point that they can read passwords directly out of the bank's account database, then you have far greater things to worry about than just a compromised password.
- ceejayoz 11y agoUnhashed passwords means a SQL injection hole goes from "I can read some interesting transaction histories and balances" to "I can log in and make bank transfers in everyone's account". There's a reason bcrypt one-way hashing is the recommended standard for any web app.