17 ms·
TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out. The
by eloisius 10y ago
TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out.
Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers.
[1]: https://community.tradeking.com/forum/categories/suggestions/topics/664-new-tradeking-login-password-on-screen-keyboard-why/forum_posts https://community.tradeking.com/forum/categories/suggestions...
- blazespin 10y agoCause key loggers don't track mouse clicks. Lol. Two factor is their best bet.
- jsudhams 10y agoVIrtual keyboard changes the character location every time it shows so unless u record click for log time or screen record it is difficult
- takeda 10y agoMalware can still be capable to take screenshot of the screen. If it would log mouse clicks I would imagine it would at least take screenshot if not a video.
- underwater 10y agoKnowing when to take a screenshot, uploading and storing it, and extracting the password is a lot more work than dumping a text file and grepping for bofa.com.
- Retra 10y agoPsh, only if you're not also logging keys.
- leshow 10y agoyou just need to take a screenshot when the mouse clicks
- okletsgoyayok 10y agoYeah, this is really shitty malware design.
- TeMPOraL 10y agoDoes it randomize its DOM elements too?
- azinman2 10y agoWow that's a terrible UX -- randomized keyboard every time? Talk about an incentive to NOT login!
- eli 10y agoHSBC does this too. Even though, duh, any sort of targeted malware could trivially record what you're clicking on.
- natermer 10y agoWhich why you run screaming away from these sorts of organizations. If they are too fucking stupid to implement a password text field correctly just imagine the byzantine nightmares that their infrastructure is. All you are doing is volunteering to be part of the next major security breach.
- eli 10y agoThey also have the silly "Security Image" which is supposed to alert me to a phishing site because I'm supposed to notice its absence. I'm guessing that's been effective roughly never.
- TeMPOraL 10y agoAny idea how it works and what makes it (supposedly) impossible for a phishing site to copy?
- mattkrause 10y agoI think the idea is that you enter your username and the site replies with the security image that you've chosen. If the image matches, you then enter your password. By itself, this doesn't rule out a man-in-the-middle attack, but it might prevent an attacker from setting up bonkofamerica.com and using it capture valid username/password pairs "offline", which could be reused on the real site. Of course, this depends on people noticing (and caring) that the image is missing or incorrect, so who knows...
- tcdent 10y agoSet up your own site, remove any mention of the reference image, watch users continue normally. "Huh, they must have finally gotten rid of that dumb thing."
- gvurrdon 10y agoAnother one that is a great pain are the sites that insist upon asking for three letters from one's password to log in. This is all very well if one has an insecure password, but when I've created a 20-character password containing all the necessary characters then this makes it rather more difficult to enter the required values.
- ghurtado 10y ago> three letters from one's password to log in Could you explain how this works? I've never ran into this and I'm curious as to what it solves / they claim it solves.
- takeda 10y agoI never used them, but my guess they try to make one time passwords from your passwords. They probably ask to enter e.g. 3rd, 6th and 8th letter of the password. Supposedly if someone logs it it supposedly won't be as useful, because next time it will ask for different letters. Not sure why won't they use rsa keys or similar technology. Also if it is the way I think it is, then you know that your passwords aren't hashed on their servers.
- TeMPOraL 10y ago> Also if it is the way I think it is, then you know that your passwords aren't hashed on their servers. Only if the developers are extremely lazy. A proper implementation would precompute a series of hashes for different subsets of the password and store them in the database instead. Similar to how Facebook stores both the password and its reversed-case form as a convenience feature for people who forget to turn their CAPS LOCK off.
- boulos 10y agoBut how many subsets would you do? With enough of them (and particularly relative to password length) this would leak a lot about your password. For say an 8 character password, do these things ask you to enter more than 4 characters?
- monochromatic 10y agohttp://www.treasurydirect.gov http://www.treasurydirect.gov as well.
- jameshart 10y agoIt seems astonishing to me to attempt to include in your threat model "login must be secure even on a system which has malware on it". If a system is infected with a keylogger, the LAST thing you want to do is allow the client to log in.
- ianferrel 10y agoHow would you prevent a client from logging in from an infected system?
- Natanael_L 10y agoThat's not really the point, it is more of a comment on that there's no point in assisting it.
- tacatabro 10y agoYeah, but according to the reaction, usability outweighs minimal security in this case. Although keyloggers cannot be used anymore, RAM-scraping is still possible. Simply scan the browser's memory for URL query strings and POST bodies and you're done - even works with HTTPS pages.
- phlo 10y agoEither you employ some sort of malware detection on your login page. Modern trojans mostly inject stuff into web pages, so things like Trusteer Pinpoint will scan the DOM and report back anomalies. Based on those reports you block the user from logging in or send them to a safe sandbox so they can't do any damage to their accounts. Alternatively, you can work with your clients' ISPs. Most malware still exhibits visible communication patterns, either by getting in touch with other bots or by contacting command-and-control servers. Once you get ISPs to notice that sort of behaviour, they can sandbox their clients and have them clean up their systems before they reach the Internet (and disclose all of their data).
- zhengyi13 10y ago
- joshuakcockrell 10y agoQuote from the CEO's blog[1]: > I agree, it’s a little more inconvenient than before.... but for now we’re asking you to accept a little inconvenience for the sake of greatly enhanced security. This gives people incentive to pick the shortest possible easiest to input password. Definitely not good for "greatly enhanced security". [1] http://community.tradeking.com/members/bigdog/blogs/7546-a-word-on-our-secure-login http://community.tradeking.com/members/bigdog/blogs/7546-a-w...
- dvcrn 10y agoMost of banking software in Korea is doing the same thing. I had to type my password every single time with a randomly arranged keyboard. Eventually I switched to the only bank that didn't do this.
- sho_hn 10y agoLiving here: Which?
- cocoflunchy 10y agoEvery bank in France does this too... and my bank (BNP) also forces me to change my (6-digits) password after 80 logins for "security reasons", which only has the effect of me choosing easy-to-remember passwords.
- seanmcdirmid 10y agoScreen loggers then...heck a spy camera.
- madmax96 10y agoThis is the most idiotic thing I've ever heard of. Whoever was responsible for this decision this should lose their job.