10 ms·
The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fum
by morgante 10y ago
The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login.
I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.
- BinaryIdiot 10y ago> don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. Wow that's just insane. I'm glad I haven't run across any services like that. I'm not sure what their line of thought it; it only inconveniences normal users. A person attempting to try multiple passwords can likely figure out how to get around that restriction without issue.
- morgante 10y ago> I'm not sure what their line of thought it; It's theoretically a defense against key loggers. Of course, if someone has compromised your machine to the point where they're tracking key strokes there's no reason to assume they can't also grab your mouse presses and websites. This isn't even their worst security practice. What truly got me to leave was their security questions: they're presented as multiple choices. My randomly generated string stands out rather obviously next to the "typical" choices.
- pm 10y agoThis is where convenience trumps security. Virgin Money used to require you to enter your password using an on-screen keyboard, except they REARRANGED THE LAYOUT EVERYTIME YOU USED IT. Thank fuck they eventually got rid of it, but it was such an abject pain in the ass, I cringed everytime I needed to log in to view my details.
- MereInterest 10y agoI wouldn't even call it a trade-off between convenience and security, because there is no security gained. This is a trade-off between convenience and stupidity. If someone suspects that a keylogger is there, the entire computer should be assumed to be compromised. Trying to guess the capabilities of the keylogger and working around them is ludicrous.
- LoSboccacc 10y agoYeah it's stairs and ladders. One I saw also randomized the position of numbers on the keypad, so you need now also to track that. Which is pointless anyway because at the point you access the keyboard buffer you can as well install a certificate and get a proxy going
- phlo 10y agoIt's a valid defense against hardware keyloggers, ignoring that you're way more likely to encounter a software keylogger. If your account is interesting enough for criminals to break into your computer room and attach dongles to your PC (I'm imagining a Mission: Impossible style break here), congratulations: you've clearly made some good financial decisions in life :-)
- iamphilrae 10y agoNot unrealistic to assume a scenario where a disgruntled IT technician installs countless hardware key loggers throughout an open plan office. Could be easier and less noticeable than trying to circumvent the business-grade antivirus.
- iancarroll 10y agoThis one at least makes some sort of sense; it's designed to prevent keyloggers from reading your password when you type it in. You can just MiTM the connection though.
- fpoling 10y agoModern keyloggers track mouse and take screenshots on clicks.
- bruce_one 10y agoI know of some of those sites that randomise the location of keys and then hide the key labels on mousedown, I assume to try and avert that issue. (Curious as to whether it would actually work though.)
- joosters 10y agoIt still doesn't work when the bank asks for different characters the next time you connect.
- phlo 10y agoIt doesn't. Today's banking malware will capture the form values on submit, either as text or as a screenshot. And it will do so, silently, every time you log in. All this scheme does is limit an attacker to gathering three letters per login attempt. Given an eight-letter password, three logins will probably disclose most of it; or at least enough for an attacker to pass the challenge when he tries to log in. In addition, if the attacker is actually interested in your data, he can easily inject a fake "wrong password" message after your first attempt and have you try again, gathering 6 characters per login.
- digi_owl 10y agoGah, i have seen one too many asian made online game do this. First you enter a password, then you have to enter a pin using a on screen numpad with jumbled placements. And likely the game will be doing all manner of things client side, thus it is cheaters all over the place.
- mng2 10y agoHSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...
- elsurudo 10y agoNot necessarily – they could be hash + salting multiple permutations
- Strilanc 10y agoNo amount of salting is going to make a 3-character recognizer secure.
- wlievens 10y agoThe 1, 6, 7 is random
- Retr0spectrum 10y agoThat's irrelevant.
- yk 10y agoThe problem is, if you have a bunch of partial passwords 1, 2, 3; 1, 2, 4; ... you can just brute force three character combinations of the passwords, which just takes something half a second (times the number of rounds) if you write your password cracker in bash. So your complexity goes from 52^n for a n character password consisting of lower and upper case to n/3* 52^3 which is a lot more manageable.
- OJFord 10y agoBut three strikes and your out - out to the physical bank with proof of ID to change it.
- zaius 10y agoFWIW Tradeking no longer do this. Not sure when it changed, but I haven't had any issues using a password manager with them since.
- scurvy 10y agoTreasuryDirect formerly had this and it drove me nuts. That and the crazy drogan's decoder ring they forced you to use.