Comment by kumarharsh | Hacker News Reader

Comment by kumarharsh | Hacker News Reader

This situation is so bad in India, that I can't even begin to summarise it... The biggest culprits are financial institutions themselves - they have such stupid requirements for passwords - need to change it regularly, can only contain @#!, need one caps, one small, one number, can't be the same as last 5 times, can't be shorter than 8 chars, but can't be longer than 15 chars either(!?!), etc - that you are either forced to write it down somewhere, or need to necessarily use a password manager. For the less computer savvy people, the second option is a non-starter, so they resort to the first option. And then, these stupid banks and mutual fund companies actively try to sabotage the working of password managers, and even disabling paste on password fields.

And then, there are incredible incidences like this: I received an SMS from a loyalty program a few weeks back:

Login at www.raymondrewards.com with your mobile no. & password <base-64 encoded string> for program benefits. Update your birthday & get 750 bonus pts in your birthday month.

And I just sank in utter despair.

Cant use password manager either for most of them. example ICICI (one of the biggest private bank) doesnt allow you to paste passwords either. Only way to use password manager is to meddle with view source to allow pasting.

Could probably write a small extension that disables paste blocking

Here's the one I use [1]. My Pakistani bank also does every single thing mentioned lol.

1: https://chrome.google.com/webstore/detail/dont-fuck-with-pas...

Keepass can auto type and some extensions can prefill without pasting

I don't use the automatic fill option, but LastPass can usually fill on demand even on no-paste sites.

What is the actual logic behind banning pasting, anyway? Is it just anti-scripting? If so, it seems like locking the account after a small number of bad attempts would be enough.

Honest question:- Does a typical Indian care about privacy/security?

When I was their I had my colleagues mention that most of them find any kind of password a burden to use a service that they see usage drop significantly if they enforce strong password requirements. I don’t think that is a reason not to, I am just saying what the reality seems to be. Hopefully it’s just a subset of population and most of them (increasingly) care about security.

Also are privacy/security laws enforced as strongly in India as other parts of the world?

From the few I just asked; no.

> Honest question:- Does a typical Indian care about privacy/security?

It depends, what you mean by "privacy". A vast majority of Indians grow up in an environment with lack of privacy in personal life. Imagine 3-4 people (or more) in a family growing up in a 2 room accommodation.

Most people I know, have no issues giving away PII: phone numbers, addresses, income-tax identifier, aadhar (social security numbers, for those unaware).

> Also are privacy/security laws enforced as strongly in India as other parts of the world?

Not quite. Law enforcement, and the general public is not really aware of a lot of these laws. Right to privacy being a fundamental right was something that was debated in the courts in 2017.

> A vast majority of Indians grow up in an environment with lack of privacy in personal life. Imagine 3-4 people (or more) in a family growing up in a 2 room accommodation.

That is a good perspective on how your social life in the real world indirectly effects your online world. Thanks for sharing

Yep.

Grew up with 6 people in a 2 bed apartment and our family income put us squarely in the middle class.

My neighbours at one point, had ~8 people in a 1 bedroom. I used to think of myself as the one with the big house.

Privacy was a dream. My parents themselves didn't get privacy, let alone us kids.

How often do you use the airbags, anyway?

This is probably why use one-time-password via SMS is so rampant in many many services. This kind of auth has mostly eliminated large scale hacks, however OTP over SMS still won't help targeted hacking. But in general the public at large are rather safe primarily because of this.

Having said that, subscription based startups struggle due to the the compulsory use of OTP and therefore resort to yearly subscriptions rather than monthly (ex: Amazon Prime).

Reply on news.ycombinator.com