3 ms·

I use Coface for work to check credit for potential customers. Instead of a password, they require a 6-digit pin. It can't be auto-filled or entered with the ke

I use Coface for work to check credit for potential customers. Instead of a password, they require a 6-digit pin. It can't be auto-filled or entered with the keyboard. There's an on-screen number pad that you have to click on and the numbers are scrambled - they show up in a different arrangement every time. Such a pain!

ShaneMcGowan 5y ago
Ah yes, the 2005 RuneScape bank method of security, very high tech
hedora 5y ago
You could probably outsource the pin entry to a human or AI based third party service.
- colejohnson66 5y ago
  Such as Amazon’s Mechanical Turk?
_jal 5y ago
I think this is the manifestation of non-logical associations humans make. When I was a kid, a teacher told me learning was supposed to be hard and unpleasant, and I believed her for a long time. Only when I started enjoying myself in spite of that did I see it was wrong, and I started doing well in school, and (more importantly) pursuing my own interests. There's a similar thing with security - people assume good security must be painful, so making it painful becomes a goal. Sometimes this is sincere, sometimes (TSA) intentional theater. But either way, the result is intentional hostility to the people who use the system. I'd bet money they have a one-sentence answer for why it does each of those things ("order is scrambled to prevent shoulder-surfing"), but have done zero testing to determine whether those theories are correct.
- ascar 5y ago
  I always associated these with key logging prevention. What drives me nuts however, is websites/apps that allow me to type my password but not paste it. Like they want to force that a keylogger can grab it? Another favorite of mine are password conposition rules, which do nothing but reduce security and are everywhere :(
benhurmarcel 5y ago
One of my bank has that to login. The worst is that they also force to use the randomized numpad on their mobile app.
Hyulet 5y ago
Yeah. One of my banks uses something like this. Here's how it works: The client can only use numerical passwords. When loading the login page, their site also loads the number pad, which consists in an HTML pad containing the 10 digits. The digits are displayed as base 64 images and in a random order, so it's impossible to determine which digit is which from parsing the HTML alone. In the HTML, the images of the digits are each associated to a random 3 letters string. This string will be sent to the server instead of the plain digit. With the number pad, the site also load a "challenge", and this challenge is sent to the server when connecting. My guess is that this challenge is an encrypted string that indicates what digit corresponds to what 3 letters string. I made a script that logs in to my bank account to get some information and I was able to do it without using OCR on the images of the number pad because the images never change, so their base 64 strings are always the same. I was a bit disappointed when I realized it, I thought that the people who came with such a twisted login form would have added random noise to the image, just for fun.
Vrondi 5y ago
So, they never want users with a disability to be able to use their site. Nice.

ShaneMcGowan 5y ago

Ah yes, the 2005 RuneScape bank method of security, very high tech

hedora 5y ago

You could probably outsource the pin entry to a human or AI based third party service.

colejohnson66 5y ago
Such as Amazon’s Mechanical Turk?

_jal 5y ago

I think this is the manifestation of non-logical associations humans make. When I was a kid, a teacher told me learning was supposed to be hard and unpleasant, and I believed her for a long time. Only when I started enjoying myself in spite of that did I see it was wrong, and I started doing well in school, and (more importantly) pursuing my own interests. There's a similar thing with security - people assume good security must be painful, so making it painful becomes a goal. Sometimes this is sincere, sometimes (TSA) intentional theater. But either way, the result is intentional hostility to the people who use the system. I'd bet money they have a one-sentence answer for why it does each of those things ("order is scrambled to prevent shoulder-surfing"), but have done zero testing to determine whether those theories are correct.

ascar 5y ago
I always associated these with key logging prevention. What drives me nuts however, is websites/apps that allow me to type my password but not paste it. Like they want to force that a keylogger can grab it? Another favorite of mine are password conposition rules, which do nothing but reduce security and are everywhere :(

benhurmarcel 5y ago

One of my bank has that to login. The worst is that they also force to use the randomized numpad on their mobile app.

Hyulet 5y ago

Yeah. One of my banks uses something like this. Here's how it works: The client can only use numerical passwords. When loading the login page, their site also loads the number pad, which consists in an HTML pad containing the 10 digits. The digits are displayed as base 64 images and in a random order, so it's impossible to determine which digit is which from parsing the HTML alone. In the HTML, the images of the digits are each associated to a random 3 letters string. This string will be sent to the server instead of the plain digit. With the number pad, the site also load a "challenge", and this challenge is sent to the server when connecting. My guess is that this challenge is an encrypted string that indicates what digit corresponds to what 3 letters string. I made a script that logs in to my bank account to get some information and I was able to do it without using OCR on the images of the number pad because the images never change, so their base 64 strings are always the same. I was a bit disappointed when I realized it, I thought that the people who came with such a twisted login form would have added random noise to the image, just for fun.

Vrondi 5y ago

So, they never want users with a disability to be able to use their site. Nice.