6 ms·

So this worked for me, but I hadn't tried since a couple weeks ago (maybe the all-caps thing was fixed by yesterday?). What's funny is that the subsequent step

by danso 7y ago

So this worked for me, but I hadn't tried since a couple weeks ago (maybe the all-caps thing was fixed by yesterday?). What's funny is that the subsequent step (verifying tax info) had a couple of other old-school slightly bad practices: - Blocking copy-paste of my bank account information - Input value for income can't contain commas or a dollar sign - Obscuring input field of SSN as if it were a password (I suppose this might not seem wrong to some folks, but technically SSN isn't a password and most other sites I've used don't treat it like a password)

robomartin 7y ago
An old college friend of mine from 30+ years ago used to write his SSN on every college book he bought. He also used an engraver to etch his SSN into every tool he owned. The SSN was't all that important back then. I can't say when it became something of potential value. Sadly he passes many years ago. His wife called me in desperation. She needed to get rid of and donate a bunch of tools and hardware filling their garage. However, everything had his SSN on it, I mean, he had an amazing collection of Snap-on tools with his SSN engraved on everything, down to the screwdrivers. She trust me implicitly. We took everything out of their garage and donated it to our local high school's robotics club. The caveat was: The kids had to help me grind off the SSN from every single tool they got. That was an interesting week.
- nhumrich 7y ago
  > cant say when it became something of value As soon as banks started allowing SSNs themselves instead of requiring an SSN card for establishing lines of credit.
- contravariant 7y ago
  Maybe this is a silly question, but exactly what was the risk? If knowing a random SSN is problematic then it's not exactly hard to just generate a couple yourself.
  - gt_grc 7y ago
    I used to work for a credit bureau, and a lender once asked us to build an application that could pull credit files based on SSN only. (Pulling a credit file normally requires multiple identifiers.) Fortunately, someone foresaw the very problem that you mentioned, and we declined to build it.
- Spooky23 7y ago
  You wasted a week. :) SSN for deceased people is published broadly in various forms.
  - robomartin 7y ago
    Well, I had to honor a widow’s request.
- deleted 7y ago
  [deleted]
nikanj 7y ago
One day I will find the security consultant who keeps going around companies and telling them that letting me paste content is insecure. On many platforms I use a password like "Fart123!!" because I can't paste "$3f4[FEsz$%643we]]SFv" from my password manager.
- RonanTheGrey 7y ago
  Firefox's "Don't Fuck with Paste" extension is a lifesaver. It disables all the event handlers on the page and the input that prevent pasting. Kind of a sledgehammer but when you're pasting someone's 26-digit account number, I mean.. you don't want to copy that by hand. Plus I use Bitwarden, which auto-fills the boxes so I don't need to paste passwords at least.
  - lstamour 7y ago
    I wish I could say this 2014 article was completely out of date, but while some folks have updated, far too many sites still haven’t: https://www.troyhunt.com/the-cobra-effect-that-is-disabling/ https://www.troyhunt.com/the-cobra-effect-that-is-disabling/ If you’re writing a little JS snippet to “fix” this, https://gist.github.com/nuxero/6dda1287ccfb91999e9f8c42d7246fd3 https://gist.github.com/nuxero/6dda1287ccfb91999e9f8c42d7246... or https://gist.github.com/SukkaW/26dc57f3bf3d7f17a89763dcd9f7d3a1 https://gist.github.com/SukkaW/26dc57f3bf3d7f17a89763dcd9f7d... might also help. It should be possible to add this to iOS using the Shortcuts app. https://support.apple.com/en-us/guide/shortcuts/apd218e2187d/ios https://support.apple.com/en-us/guide/shortcuts/apd218e2187d... Though... I’m not entirely sure you can block pasting in Safari on iOS. I can’t say I’ve noticed it there, perhaps the native keyboard password manager integration avoids it.
    - aspenmayer 7y ago
      I recently had a broken phone screen and had to find a password entry workaround. On iOS pasting in fields that show the iOS keyboard seems to always be enabled, but rotation of the keyboard in landscape mode is disabled on some password entry fields for some reason. A quick workaround is the notes app for a quick copy paste and the calculator app for numbers if needed, although I wish there was a way to toggle comma separation in the iOS calculator.
codegeek 7y ago
In fall of 2000 when I started college, we used to have SSN numbers publicly listed as student ids :). I never thought much of it back then. Good old days when you didn't have to worry about being identity hacked.
- Traubenfuchs 7y ago
  What's with Americans getting a magic number that can apparently ruin their lives? What harmful thing can an attacker do with it that doesn't require further identity verification? Is this an urban legend?
  - AnIdiotOnTheNet 7y ago
    Basically, many institutions have horrifically poor standards for verification and will accept nothing (or not much) more than an SSN. SSNs were never meant to be a secret.
  - linuxftw 7y ago
    It's an artifact of the unregulated credit system. Credit reporting agencies starting using SSN as an identifier for consumers, thus it gets pasted everywhere. Back before the financial crisis, there was little to no oversight. If someone got your SSN and some basic info, they could open up credit accounts in your name very easily. Most upstanding places like Banks would require some form of ID. But what about the cashier at K-Mart when you were filling out an in-store credit application? They were much less caring. Same with used car dealers, and tons of other places.
  - earthboundkid 7y ago
    In America, it is very easy for corporations to put the blame for their bad security practices onto consumers and for consumers to just shrug and accept the blame. So, for example, "I" had "my identity" "stolen" according to Verizon. In reality, some criminals learned facts about me and then Verizon happily let them run up thousands of dollars in phone charges in a two month period. (I assume this is part of a larger scam where a 900 number pockets the charges?) This had nothing to do with me, but Verizon then polluted my credit history by falsely reporting the unpaid charges as being mine. So even though there were clearly two parties at fault—the criminals for the fraud and Verizon for not verifying the ID of the person getting the phone line and then falsely harming my credit reputation—I, an uninvolved third party, was made to do the legwork of cleaning up the mess. It's really scandalous that we allow this, but the PR of "identity theft" has been quite good at brainwashing the public.
dak1 7y ago
Every time I encounter a site that disables pasting something, I just disable JavaScript, paste it, and then re-enable. Obviously not a solution for non-technical users, though.
renaudg 7y ago
Here's another input filtering bad practice that most US front-end devs don't seem to know about (but really should when they build global websites) Don't assume a specific keyboard layout when you're trying to filter out non-numeric values in a text field I use a French keyboard, and numbers on the top keyboard row are accessed with Shift. A unmodified keypress in this row is for various accented characters, quotes, parentheses and a few others. In other words, it's the opposite of a US/UK keyboard. Almost every week I come across a website (including a large US stock broker) whose numeric fields seem to block out modifier keys. I have to switch my Macbook to US layout just to type those in (because conveniently, they also disable pasting in those fields of course) This is very widespread (is that part of a popular front-end framework maybe ?) and difficult to report, because most devs in English-speaking countries never experience the issue first-hand.
- earthboundkid 7y ago
  I didn't know that about the French keyboard. The Japanese keyboard is mostly a mess because they have to shove a bunch of extra characters into the same physical space, but the one thing I miss is that they have @ as an unshifted character. It's very convenient for that. I'd gladly trade away unshifted ` for unshifted @.
  - renaudg 7y ago
    @ is also unshifted on the French keyboard.

by danso 7y ago

robomartin 7y ago

An old college friend of mine from 30+ years ago used to write his SSN on every college book he bought. He also used an engraver to etch his SSN into every tool he owned. The SSN was't all that important back then. I can't say when it became something of potential value. Sadly he passes many years ago. His wife called me in desperation. She needed to get rid of and donate a bunch of tools and hardware filling their garage. However, everything had his SSN on it, I mean, he had an amazing collection of Snap-on tools with his SSN engraved on everything, down to the screwdrivers. She trust me implicitly. We took everything out of their garage and donated it to our local high school's robotics club. The caveat was: The kids had to help me grind off the SSN from every single tool they got. That was an interesting week.

nhumrich 7y ago
> cant say when it became something of value As soon as banks started allowing SSNs themselves instead of requiring an SSN card for establishing lines of credit.
contravariant 7y ago
Maybe this is a silly question, but exactly what was the risk? If knowing a random SSN is problematic then it's not exactly hard to just generate a couple yourself.
- gt_grc 7y ago
  I used to work for a credit bureau, and a lender once asked us to build an application that could pull credit files based on SSN only. (Pulling a credit file normally requires multiple identifiers.) Fortunately, someone foresaw the very problem that you mentioned, and we declined to build it.
Spooky23 7y ago
You wasted a week. :) SSN for deceased people is published broadly in various forms.
- robomartin 7y ago
  Well, I had to honor a widow’s request.
deleted 7y ago
[deleted]

nikanj 7y ago

One day I will find the security consultant who keeps going around companies and telling them that letting me paste content is insecure. On many platforms I use a password like "Fart123!!" because I can't paste "$3f4[FEsz$%643we]]SFv" from my password manager.

RonanTheGrey 7y ago
Firefox's "Don't Fuck with Paste" extension is a lifesaver. It disables all the event handlers on the page and the input that prevent pasting. Kind of a sledgehammer but when you're pasting someone's 26-digit account number, I mean.. you don't want to copy that by hand. Plus I use Bitwarden, which auto-fills the boxes so I don't need to paste passwords at least.
- lstamour 7y ago
  I wish I could say this 2014 article was completely out of date, but while some folks have updated, far too many sites still haven’t: https://www.troyhunt.com/the-cobra-effect-that-is-disabling/ https://www.troyhunt.com/the-cobra-effect-that-is-disabling/ If you’re writing a little JS snippet to “fix” this, https://gist.github.com/nuxero/6dda1287ccfb91999e9f8c42d7246fd3 https://gist.github.com/nuxero/6dda1287ccfb91999e9f8c42d7246... or https://gist.github.com/SukkaW/26dc57f3bf3d7f17a89763dcd9f7d3a1 https://gist.github.com/SukkaW/26dc57f3bf3d7f17a89763dcd9f7d... might also help. It should be possible to add this to iOS using the Shortcuts app. https://support.apple.com/en-us/guide/shortcuts/apd218e2187d/ios https://support.apple.com/en-us/guide/shortcuts/apd218e2187d... Though... I’m not entirely sure you can block pasting in Safari on iOS. I can’t say I’ve noticed it there, perhaps the native keyboard password manager integration avoids it.
  - aspenmayer 7y ago
    I recently had a broken phone screen and had to find a password entry workaround. On iOS pasting in fields that show the iOS keyboard seems to always be enabled, but rotation of the keyboard in landscape mode is disabled on some password entry fields for some reason. A quick workaround is the notes app for a quick copy paste and the calculator app for numbers if needed, although I wish there was a way to toggle comma separation in the iOS calculator.

codegeek 7y ago

In fall of 2000 when I started college, we used to have SSN numbers publicly listed as student ids :). I never thought much of it back then. Good old days when you didn't have to worry about being identity hacked.

Traubenfuchs 7y ago
What's with Americans getting a magic number that can apparently ruin their lives? What harmful thing can an attacker do with it that doesn't require further identity verification? Is this an urban legend?
- AnIdiotOnTheNet 7y ago
  Basically, many institutions have horrifically poor standards for verification and will accept nothing (or not much) more than an SSN. SSNs were never meant to be a secret.
- linuxftw 7y ago
  It's an artifact of the unregulated credit system. Credit reporting agencies starting using SSN as an identifier for consumers, thus it gets pasted everywhere. Back before the financial crisis, there was little to no oversight. If someone got your SSN and some basic info, they could open up credit accounts in your name very easily. Most upstanding places like Banks would require some form of ID. But what about the cashier at K-Mart when you were filling out an in-store credit application? They were much less caring. Same with used car dealers, and tons of other places.
- earthboundkid 7y ago
  In America, it is very easy for corporations to put the blame for their bad security practices onto consumers and for consumers to just shrug and accept the blame. So, for example, "I" had "my identity" "stolen" according to Verizon. In reality, some criminals learned facts about me and then Verizon happily let them run up thousands of dollars in phone charges in a two month period. (I assume this is part of a larger scam where a 900 number pockets the charges?) This had nothing to do with me, but Verizon then polluted my credit history by falsely reporting the unpaid charges as being mine. So even though there were clearly two parties at fault—the criminals for the fraud and Verizon for not verifying the ID of the person getting the phone line and then falsely harming my credit reputation—I, an uninvolved third party, was made to do the legwork of cleaning up the mess. It's really scandalous that we allow this, but the PR of "identity theft" has been quite good at brainwashing the public.

dak1 7y ago

Every time I encounter a site that disables pasting something, I just disable JavaScript, paste it, and then re-enable. Obviously not a solution for non-technical users, though.

renaudg 7y ago

Here's another input filtering bad practice that most US front-end devs don't seem to know about (but really should when they build global websites) Don't assume a specific keyboard layout when you're trying to filter out non-numeric values in a text field I use a French keyboard, and numbers on the top keyboard row are accessed with Shift. A unmodified keypress in this row is for various accented characters, quotes, parentheses and a few others. In other words, it's the opposite of a US/UK keyboard. Almost every week I come across a website (including a large US stock broker) whose numeric fields seem to block out modifier keys. I have to switch my Macbook to US layout just to type those in (because conveniently, they also disable pasting in those fields of course) This is very widespread (is that part of a popular front-end framework maybe ?) and difficult to report, because most devs in English-speaking countries never experience the issue first-hand.

earthboundkid 7y ago
I didn't know that about the French keyboard. The Japanese keyboard is mostly a mess because they have to shove a bunch of extra characters into the same physical space, but the one thing I miss is that they have @ as an unshifted character. It's very convenient for that. I'd gladly trade away unshifted ` for unshifted @.
- renaudg 7y ago
  @ is also unshifted on the French keyboard.