Comments on: Security Through Inanity http://dansdata.blogsome.com/2008/02/01/security-through-inanity/ the blog that is not dansdata.com Sat, 28 Nov 2009 03:15:05 +0000 http://wordpress.org/?v=1.5.1-alpha by: alastair http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-2026 Tue, 05 Feb 2008 08:59:46 +0000 http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-2026 Short version of my own <a href="http://girtby.net/archives/2006/10/24/secrets-of-the-medicare-website" rel="nofollow">Medicare website war story</a>: On the advice of Bruce Schneier, I typed gibberish into the secret questions. Then I found that to get "higher access level" I had to retype two of the five gibberish answers that I had provided earlier. Which meant that I had to dig them out of my firefox autocomplete memory. A bigger fiasco I cannot imagine. No, actually I could, but I don't want to. Short version of my own Medicare website war story: On the advice of Bruce Schneier, I typed gibberish into the secret questions. Then I found that to get "higher access level" I had to retype two of the five gibberish answers that I had provided earlier. Which meant that I had to dig them out of my firefox autocomplete memory.

A bigger fiasco I cannot imagine. No, actually I could, but I don't want to.

]]> by: will.dutt http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-2010 Mon, 04 Feb 2008 09:36:43 +0000 http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-2010 think about tiawan. they have a system already in place but it gets worse. if you don't have this card, you are not a citizen of the nation. eg no school for you and no medicare think about tiawan. they have a system already in place but it gets worse. if you don't have this card, you are not a citizen of the nation. eg no school for you and no medicare

]]> by: demosthien http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1996 Sat, 02 Feb 2008 06:34:53 +0000 http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1996 Just be thankful you don't have your personal information in the UK... Big Brother over here has decided it is a good idea to have a single Identity Card (Australia Card... Anyone?) which will be used to store all of the personal information relating to honest law abiding citizens. There is absolutely no reason why this is not a good idea... Feb 2007 - Government admits 80 passports are lost in the post every month (I have recently been asked to post my actual passport to the Driver's Licencing Authority, I am so looking forward to that). Nov 2007 - Her Majesty's Revenue and Customs (basicly the customs and tax offices combined) had lost CDs containing personal data, with all information on all British families with children under the age of 16 (around 25 million people). HMRC then sent out apology letters that also contained sensitive personal information. The boss of the HM Revenue and Customs has admitted there have been seven other significant data losses in recent years. Sophos conducted a poll of 350 in which 58% of the responses were; "Inevitable". Dec 2007 - The Transport Secretary admitted that the details of three million learner drivers had gone missing when a hard drive was lost in Iowa (raising the question... what was UK drivers info doing in Iowa?). Dec 2007 - CDs with personal information on thousands of benefit claimants were found at the home of a former contractor to the Department of Work and Pensions (that's right... A contractor!). Dec 2007 - The names, dates of birth and national insurance numbers of 45,000 people claiming benefits in west Yorkshire were lost by the Government. Dec 2007 - Department of Health has said that data losses were being dealt with individually by the relevant trusts (hospital management) and that it therefore did not have details of how many patients' records were lost, City and Hackney Primary Care Trust, in east London - has reportedly lost the details of 160,000 children Jan 2008 - Secretary of state for defence Des Browne has admitted that the laptop lost by the Ministry of Defence containing details of up to 600,000 defence personnel was not encrypted, and also that services personnel have previously lost two more laptops containing similar unencrypted recruitment information. I could go on but I think you get the idea. I am so longing to return home to Australia where the worst I have to worry about is a slack security system... Over here they seem to just give out unencrypted laptops/discs, brimming with citizen's personal information, to that bloke outside who wears his underpants on the outside and hope for the best. Just be thankful you don't have your personal information in the UK... Big Brother over here has decided it is a good idea to have a single Identity Card (Australia Card... Anyone?) which will be used to store all of the personal information relating to honest law abiding citizens. There is absolutely no reason why this is not a good idea...

Feb 2007 - Government admits 80 passports are lost in the post every month (I have recently been asked to post my actual passport to the Driver's Licencing Authority, I am so looking forward to that).

Nov 2007 - Her Majesty's Revenue and Customs (basicly the customs and tax offices combined) had lost CDs containing personal data, with all information on all British families with children under the age of 16 (around 25 million people). HMRC then sent out apology letters that also contained sensitive personal information. The boss of the HM Revenue and Customs has admitted there have been seven other significant data losses in recent years. Sophos conducted a poll of 350 in which 58% of the responses were; "Inevitable".

Dec 2007 - The Transport Secretary admitted that the details of three million learner drivers had gone missing when a hard drive was lost in Iowa (raising the question... what was UK drivers info doing in Iowa?).

Dec 2007 - CDs with personal information on thousands of benefit claimants were found at the home of a former contractor to the Department of Work and Pensions (that's right... A contractor!).

Dec 2007 - The names, dates of birth and national insurance numbers of 45,000 people claiming benefits in west Yorkshire were lost by the Government.

Dec 2007 - Department of Health has said that data losses were being dealt with individually by the relevant trusts (hospital management) and that it therefore did not have details of how many patients' records were lost, City and Hackney Primary Care Trust, in east London - has reportedly lost the details of 160,000 children

Jan 2008 - Secretary of state for defence Des Browne has admitted that the laptop lost by the Ministry of Defence containing details of up to 600,000 defence personnel was not encrypted, and also that services personnel have previously lost two more laptops containing similar unencrypted recruitment information.

I could go on but I think you get the idea. I am so longing to return home to Australia where the worst I have to worry about is a slack security system... Over here they seem to just give out unencrypted laptops/discs, brimming with citizen's personal information, to that bloke outside who wears his underpants on the outside and hope for the best.

]]> by: twoflower http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1995 Fri, 01 Feb 2008 23:17:25 +0000 http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1995 If you think it's bad having to answer five such questions, you'd be horrified at a bank I dealt with. I'd been a customer for about ten years when, a year ago, they added this bullshit "security" feature to their online banking site, requiring me to pick (and answer) *sixteen* such questions from their predefined set of of questions -- virtually *all* of which were matters of public record, and could be answered about anybody reasonably-well connected using Google. They would require you to answer one of these questions at random times, or anytime you wanted to do something "novel", like add a new bill to your list of bills that you could pay online. I argued with their phone-support people, and on up the chain to an assistant-to-the-assistant-security-manager, none of whom seemed to have the first understanding of computer security. I switched banks -- chequing, savings, investments, everything -- and left them. The manager of my local branch was very understanding, but powerless to do anything about the policy. If you think it's bad having to answer five such questions, you'd be horrified at a bank I dealt with. I'd been a customer for about ten years when, a year ago, they added this bullshit "security" feature to their online banking site, requiring me to pick (and answer) *sixteen* such questions from their predefined set of of questions -- virtually *all* of which were matters of public record, and could be answered about anybody reasonably-well connected using Google.

They would require you to answer one of these questions at random times, or anytime you wanted to do something "novel", like add a new bill to your list of bills that you could pay online.

I argued with their phone-support people, and on up the chain to an assistant-to-the-assistant-security-manager, none of whom seemed to have the first understanding of computer security.

I switched banks -- chequing, savings, investments, everything -- and left them. The manager of my local branch was very understanding, but powerless to do anything about the policy.

]]> by: adamthebastard http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1993 Fri, 01 Feb 2008 22:57:58 +0000 http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1993 I love this all this 'secure' "multi factor" web authentication is still based on the what you know security system. Of course all it takes is one key logger or one man in the middle attack and it doesn't matter how good your secret questions are the attacker has the answer. The commonwealth bank has slightly better two factor auth. They make my log in with a userid and password to do all my online banking. Then they have my mobile number on file and SMS me a one time use token each time I want to change details or add a new transfer destination. This verifies that I have my phone. So I know something AND I have something, that's two factor auth. There is still the possibility of MITM attacks but it requires more work for the attacker. thedailywtf.com had a whinge on this a while back: http://thedailywtf.com/Articles/WishItWas-TwoFactor-.aspx I love this all this 'secure' "multi factor" web authentication is still based on the what you know security system. Of course all it takes is one key logger or one man in the middle attack and it doesn't matter how good your secret questions are the attacker has the answer.

The commonwealth bank has slightly better two factor auth. They make my log in with a userid and password to do all my online banking. Then they have my mobile number on file and SMS me a one time use token each time I want to change details or add a new transfer destination. This verifies that I have my phone. So I know something AND I have something, that's two factor auth.

There is still the possibility of MITM attacks but it requires more work for the attacker.

thedailywtf.com had a whinge on this a while back:
http://thedailywtf.com/Articles/WishItWas-TwoFactor-.aspx

]]> by: VMax http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1992 Fri, 01 Feb 2008 19:56:57 +0000 http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1992 It's not entirely related to dodgy online security, but I applied for an Australian passport last year using the online system. It's basically a series of standard webforms which generates a pre-filled PDF application form which you've then got to print, sign, take to post office etc. One of the pages in the web-based section (which looks nothing like the final PDF) asks you to enter your email address in a textbox, with the note "Please print clearly in block capitals only" alongside. Well, I typed as clearly as I could... Once I logged in a few days later to check the progress of my application, I noticed my email address had been OCR'd as m1ke&#64;nw.com.aw - so apparently my typing wasn't as clear as I'd thought. It's not entirely related to dodgy online security, but I applied for an Australian passport last year using the online system. It's basically a series of standard webforms which generates a pre-filled PDF application form which you've then got to print, sign, take to post office etc.

One of the pages in the web-based section (which looks nothing like the final PDF) asks you to enter your email address in a textbox, with the note "Please print clearly in block capitals only" alongside. Well, I typed as clearly as I could...

Once I logged in a few days later to check the progress of my application, I noticed my email address had been OCR'd as m1ke@nw.com.aw - so apparently my typing wasn't as clear as I'd thought.

]]> by: chaz http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1991 Fri, 01 Feb 2008 19:14:49 +0000 http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1991 Gotta love the suggestion "How many brothers and sisters do I have?" for a secret question. Do you think it might be possible to have a lucky guess at the answer? Gotta love the suggestion "How many brothers and sisters do I have?" for a secret question. Do you think it might be possible to have a lucky guess at the answer?

]]> by: bmorey http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1990 Fri, 01 Feb 2008 17:56:51 +0000 http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1990 Plus -- the incorrect capitalisation. Plus -- the incorrect capitalisation.

]]> by: trs80 http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1989 Fri, 01 Feb 2008 17:48:18 +0000 http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1989 In Puerto Rico, everyone knows your mother's maiden name http://healthhacker.org/satoroams/?p=788 causing fraud problems for Citibank because their secret question was that. Their solution? Nope, not changing the question, but preventing transfer between Citibank PR and Citibank US. A comment notes you can put anything as the answer to the question, so you could pretend to be descended from the Froblewitzes. In Puerto Rico, everyone knows your mother's maiden name http://healthhacker.org/satoroams/?p=788 causing fraud problems for Citibank because their secret question was that. Their solution? Nope, not changing the question, but preventing transfer between Citibank PR and Citibank US. A comment notes you can put anything as the answer to the question, so you could pretend to be descended from the Froblewitzes.

]]> by: Rob L http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1988 Fri, 01 Feb 2008 16:13:38 +0000 http://dansdata.blogsome.com/2008/02/01/security-through-inanity/#comment-1988 Hurrah! rejoice in another victim of the bowel loosening, wrist grating, teeth shatteringly awful guvmunted "online service" After filling out a twenty page form full of circular logic my login questions were changed along the lines of "How bad is this website?", "how much do you hate this website?" "how would you like to kill those responsible for creating it?" All with VERY memorable answers. Hurrah! rejoice in another victim of the bowel loosening, wrist grating, teeth shatteringly awful guvmunted "online service"
After filling out a twenty page form full of circular logic my login questions were changed along the lines of "How bad is this website?", "how much do you hate this website?" "how would you like to kill those responsible for creating it?" All with VERY memorable answers.

]]>