Comment by crazygringo | Hacker News Reader

Comment by crazygringo | Hacker News Reader

Parent Full thread

This whole saga proves it's too hard for companies to implement effective security policies on their own.

What's needed right away is a "badge of security approval" from an independent third party, which verifies not just the technological side, but the customer-service side too. Including things like:

- password policies (e.g. not limiting to 16 characters)

- hashing and salting passwords

- standards for security questions (these are usually so horribly written)

- standards for identity verification if you've forgotten password AND sercurity question answers (most sites will not be big enough to bother with this, so you just lose your account, but Facebook/Apple/Google/etc. need to have a common model, so inconsistencies between companies can't be exploited)

- policies for sending out password-reset emails, adding/changing e-mail addresses, with appropriate user notification

- waiting periods between changing emails and passwords, so you can't just go and change everything about an account all at once

- special unique privileges to initiate operations that can delete large amounts of data (like a special second password, or extra security questions, for deleting your account, remote wipe, etc.)

These are just vague ideas off the top of my head, not an actual proposal. But we really need a set of "best practices", and a way of identifying that companies are actually following those best practices.

A secure "lock" icon in the browser bar is no longer enough.

I think "Security questions" need to be completely destroyed and the earth salted. Then we have a long talk about them before bringing them back in a very careful, limited format.

Bank Of America is horrible in this. First off, if someone else tries to log in using your username 3 times, it locks you out of your account. You need access to your email to get back in.

But it demands you re-create three security questions after that. I chose a simple username so other people stumble across it a lot. So I have to go through this process frequently, and there is nothing I can do to stop it.

How securely are they storing this PII? Probably not at all. I try to give the exact same questions and answers every time to limit what BoA knows about me, but someone compromising by BoA account might be able to learn that information and use it to cascade attacks into other services. (They display by secret questions and their answers to me in plaintext.)

There is no reason for banks to have any security questions at all, or even passwords. They can mail security tokens to all their customers and rely on the postal office validating the identity of the customer. And if the security token breaks or is lost they can just mail a new one.

This is what all or virtually all Swedish banks do.

Only websites where the users need instant access or you have a low profit per user cannot afford security tokens. Banks are obviously not included here.

My bank (a credit union actually) requires you to come in to a branch office during normal business hours if you need to get your password or ATM PIN number changed, or if you've tried the wrong password too many times and locked your account.

They also use two-factor auth on logins from new computers (or when you've cleared your cookies).

No, they can't rely on the post office. The workers there aren't paid that well, after all, and some of them would probably be quite happy to take money on the side to make a few security tokens disappear into the hands of a fraudster.

They already send credit and debit cards in the mail. Is this substantively different? Do we have widespread problems of postal workers stealing credit or debit cards? What's in place to prevent that, and why couldn't the banks use similar measures with an OTP device?

Security questions are pretty useless for protecting access as well. They're typically information that is easily available to a lot of people you wouldn't want to have access to your account.

Which is why I type random data I wouldn't remember and don't write that stuff down either whenever I'm asked to provide an answer to a "security question". They're the worst idea someone could think of to implement a security scheme. I am appalled at the fact that most (all ??) of the big names on the internet use them. Even google who should know BETTER what with all the first class software engineer they have.

I don't mind the ones where you can set your own questions but things like maiden names and first schools are asking for trouble.

The comedian Lucy Porter does a nice sketch about setting your own security question, claiming that one of hers was "Are you really going out dressed like that?" to which the answer was "You're not my real dad, you can't tell me what to wear."

Be careful with that strategy, as sometimes sites will force you to provide answers to security questions to access your account. Probably better to treat each question as its own password, despite the hassle.

As far as best practices wrt. security, I've been a long-time fan of the OWASP ASVS checklist: http://code.google.com/p/owasp-asvs/wiki/Verification

Both apple and amazon are in violation of V2.9: "Verify that users can safely change their credentials using a mechanism that is at least as resistant to attack as the primary authentication mechanism."

Clearly the secondary authentication controls are weaker than the primary authentication controls.

It would be so awesome if all the common web app providers published ASVS compliance reports. Never gonna happen though.

How would they be any better than current "effective security" badges? People see "Verified by VeriSign" and "TRUSTe" all the time, I don't think they'd treat a new one any better.

What's needed right away is a "badge of security approval" from an independent third party, which verifies not just the technological side, but the customer-service side too.

That sounds so good and the appeal of this kind of problematic scheme is what makes security such a hard, one that we likely won't see easily solved.

Aside from the usefulness or not of the stuff on your checklist, any "badge of security approval" is basically outsourced security. And that won't work because any wholesale security provider must provide one-size-fits-all security and one-size-fits-all fails because it must either so secure no one could break and so be far too unwieldy for most uses or it must be fairly flimsy and so fail exactly when the use case becomes critical (and of course trusting any third party expands your perimeter of trust in a fashion that you might not aware of).

The physical locks and strong boxes we have are scaled according to what we're facing and still real human beings to keep an idea of whether they are really secure. I live in a good neighborhood. I've lived in bad neighborhoods. It's part of becoming an adult. The lock on my gate is flimsy but it's enough. But I watch to see if the neighborhood is going down hill, if there's some factor which would make me a target. It's a paltry measure but it actually has pretty well. My security level can't be carte blanch guaranteed by anyone. Even if I hire security service, I'm not ultimately leaving everything to them.

Outsourced security won't work in the sense of entirely outsourced security*. The information age can't really get away from the "rings of trust" situation where the most highly entities can not really, should not be trusted to give away their trustedness on a wholesale basis. Some people can and should rely on outsourced security but the biggest targets should not and cannot.

And it is all a matter of levels. Average consumers can trust the browser bar (more than a lot of things) because they aren't special targets. That's OK.

If I'm going to trust some expert to certify that other websites are following specific best practices, I'd prefer the expert simply implement those best practices, and I'd log into everywhere else by their OpenID.

Reply on news.ycombinator.com