4 ms·

The French Family allowance is an interesting case. https://dumbpasswordrules.com/sites/caf-french-family-allowance-fund/ https://dumbpasswordrules.com/sites/c

by lelag 4y ago

The French Family allowance is an interesting case. https://dumbpasswordrules.com/sites/caf-french-family-allowance-fund/ https://dumbpasswordrules.com/sites/caf-french-family-allowa... It looks crazy but actually I think they were trying to solve an insolvable issue. The population that will want to use this website is basically anyone who has children in France. That will include some very computer-illiterate people using god knows what public devices, some of them, very likely infected with all malware known to mankind. They came up with this: have people click on numbers whose place change all the time and whose real values (beside the image shown) are server side. They probably hoped that it would protect the users from at least basic keyloggers attacks.

jeroenhd 4y ago
These types of character input screens do help against some forms of shoulder surfing or maybe even phishing, but only if your password is random and long enough for it not to be brute-forcible. The problem with this method is that most people will keep their passwords short if you make them more difficult to enter. It's easy to watch someone unlock their phone with a PIN or gesture, steal the phone and open it later if the location of the keys never changes. Especially if the fingerprints are left on the screen. If we can make this work with soft materials like rubber, it'd also be a defence against skimmers. It's trivial to see someone's PIN on a payment terminal even after they've already left the store if the keys don't immediately disappate body heat. Aim an infrared camera at the keypad and you'll see which keys were pressed, sometimes even in what order.
- wongarsu 4y ago
  Some physical keypads have a screen behind the keys to shuffle the positions of the buttons (e.g. [1]). That defeats many attacks, including recording the hand movement or infrared cameras (you can see where the person pressed, but you don't know the number that was there). Alternatively you can heat the keypad to reduce the difference between body temperature and keypad. 1: https://jkcorpeng.imweb.me/japan_doorlock/?idx=53 https://jkcorpeng.imweb.me/japan_doorlock/?idx=53
- lelag 4y ago
  An 8 digit code coupled with a gradual rate-limiting system offer probably a decent security trade-off for such a service. They probably use an all digit code so that people can authenticate easily over the phone.

by lelag 4y ago

jeroenhd 4y ago

These types of character input screens do help against some forms of shoulder surfing or maybe even phishing, but only if your password is random and long enough for it not to be brute-forcible. The problem with this method is that most people will keep their passwords short if you make them more difficult to enter. It's easy to watch someone unlock their phone with a PIN or gesture, steal the phone and open it later if the location of the keys never changes. Especially if the fingerprints are left on the screen. If we can make this work with soft materials like rubber, it'd also be a defence against skimmers. It's trivial to see someone's PIN on a payment terminal even after they've already left the store if the keys don't immediately disappate body heat. Aim an infrared camera at the keypad and you'll see which keys were pressed, sometimes even in what order.

wongarsu 4y ago
Some physical keypads have a screen behind the keys to shuffle the positions of the buttons (e.g. [1]). That defeats many attacks, including recording the hand movement or infrared cameras (you can see where the person pressed, but you don't know the number that was there). Alternatively you can heat the keypad to reduce the difference between body temperature and keypad. 1: https://jkcorpeng.imweb.me/japan_doorlock/?idx=53 https://jkcorpeng.imweb.me/japan_doorlock/?idx=53
lelag 4y ago
An 8 digit code coupled with a gradual rate-limiting system offer probably a decent security trade-off for such a service. They probably use an all digit code so that people can authenticate easily over the phone.