3 ms·
> I'm not sure what their line of thought it; It's theoretically a defense against key loggers. Of course, if someone has compromised your machine to the point
by morgante 10y ago
> I'm not sure what their line of thought it;
It's theoretically a defense against key loggers. Of course, if someone has compromised your machine to the point where they're tracking key strokes there's no reason to assume they can't also grab your mouse presses and websites.
This isn't even their worst security practice. What truly got me to leave was their security questions: they're presented as multiple choices. My randomly generated string stands out rather obviously next to the "typical" choices.
- pm 10y agoThis is where convenience trumps security. Virgin Money used to require you to enter your password using an on-screen keyboard, except they REARRANGED THE LAYOUT EVERYTIME YOU USED IT. Thank fuck they eventually got rid of it, but it was such an abject pain in the ass, I cringed everytime I needed to log in to view my details.
- MereInterest 10y agoI wouldn't even call it a trade-off between convenience and security, because there is no security gained. This is a trade-off between convenience and stupidity. If someone suspects that a keylogger is there, the entire computer should be assumed to be compromised. Trying to guess the capabilities of the keylogger and working around them is ludicrous.
- LoSboccacc 10y agoYeah it's stairs and ladders. One I saw also randomized the position of numbers on the keypad, so you need now also to track that. Which is pointless anyway because at the point you access the keyboard buffer you can as well install a certificate and get a proxy going