4 ms·
This is the biggest hack since every ATM PIN was leaked: https://pastebin.com/SmJRB8eQ https://pastebin.com/SmJRB8eQ
by kibwen 2y ago
This is the biggest hack since every ATM PIN was leaked: https://pastebin.com/SmJRB8eQ https://pastebin.com/SmJRB8eQ
- tombert 2y agoHoly shit, my PIN is on there. How the hell did that get that?? I was told it was a 1/10,000 chance of someone guessing it.
- ethanjstark 2y agoMine too. Takes me back to when my password was leaked: https://github.com/danielmiessler/SecLists/pull/155 https://github.com/danielmiessler/SecLists/pull/155
- 0xbadcafebee 2y agocould we fix this by adding '\n' to the password? then it wouldn't be guessed, the hackers would just think it was the end of the password
- Y_Y 2y agoThat's why I put a newline in my username.
- hk1337 2y agoDon't worry, I already checked your account and there wasn't anything there to take.
- quietbritishjim 2y agoPINs can be up to 6 digits (at least here in the UK, but I doubt it's country specific), even though the ones they give you by default are only ever 4. So that's only a leak of 1% of them.
- extraduder_ire 2y agoDoes that not cause problems on some card machines? I've come across a few that definitely don't let you put in more than four digits.
- jiggawatts 2y agoThat provides very valuable information: DO NOT TRUST this machine to be secure! Similarly, any web site or app that can’t correctly handle a space character at the end of the password should never be trusted with anything of consequence.
- quietbritishjim 2y agoAre you really worried that a card machine is going to leak your PIN? That doesn't seem to be a common attack vector compared to a third-party skimmer being attached or someone just mugging you and demanding your PIN under threat of physical violence. To answer the actual question: I don't know because I left my PIN at 4 digits, despite knowing I could use more, precisely because I didn't think it would really make my life any more secure.
- jiggawatts 2y agoI'm not worried specifically about the PIN leaking. The concern is that a 4-digit max PIN length is certainly implemented by someone who couldn't be bothered to read the spec for secure credit card transaction handling. It's the equivalent of the "No brown M&Ms" clause or "Canary in the coal mine" test. Nobody actually cares about the M&M color or some dumb bird.
- lxgr 2y ago"Must support 6-digit PINs" is not part of "the spec for secure credit card transaction handling" – which is also not a (or at least one) thing: There are dozens of card networks, and many of them have tons of regional variations. In some markets, issuers only allow 4 digit PINs, and customers don't expect to have to press an "enter" key when they're done entering their 4 digit PIN – so the reasonable implementation is to allow only 4 digit PINs, or you'll be left with people staring at the ATM/POS terminal, waiting for something to happen.
- hamburglar 2y agoHaha, I have a file in my home directory that has every possible SSN because I wanted to be able to tell a friend “I have your SSN in a file on my computer.”