forums.gentoo.org password security

[NeddySeagoon]

Don't your banks use one time passwords or two factor authentication?

I've been using it since 2003. I put my chip and pin card into a card reader.
It checks my PIN and gives me a one time password.
It locks my card if I get the PIN wrong three times too, just like a cash machine :(
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[Tony0945]

[Hu]

Regarding the issue of e-mailing the password clear text, I look at it through this decision tree:

1. Is the password sent cleartext? If no, continue. If yes, be unhappy briefly.
   
2. Does the forum support a password reset feature, implemented by sending an e-mail to the account on record? If no, stop and be safe. If yes, continue.
   
3. Do I trust that the e-mail account cannot be modified (messages deleted or blocked from delivery) by untrusted users? If no, continue and be unhappy. If yes, continue and be cautiously optimistic.
   
4. Do I trust that the e-mail account cannot be read by untrusted users? If no, stop and be unhappy with the generally terrible state of e-mail security. If yes, stop and be happy.

From there, I conclude that while it is not desirable that the forum send the original password, that the existence of a password reset mechanism, which can be triggered by anyone who knows my forum account name and e-mail address of record, is a greater threat. An untrusted user who can never read my e-mail cannot retrieve the initial password (which I can change at whim) nor use the password reset mechanism against me. An untrusted user who can read my e-mail is not only able to extract the initial password (which, again, I can change), but can use the "recovery" feature against me at any later point, and there's nothing I can do about that other than try to make them unable to read my e-mail. Using a good e-mail password is necessary, but insufficient, for that purpose. It also requires that the message be kept safe in transit (TLS at every step) and that it come to rest on a system that only transfers the message to me (in particular, that only people I trust not to read the e-mail can be allowed to have root on the machine which stores the message). Effectively, that means I need to run a mail server just to mitigate the password reset problem. Note that none of the password reset problems are at all unique to this forum. Almost every place I've seen that does e-mail based password reset is similarly terrible. A few will insist on a "secret question and answer" as part of it, which is very slightly above nothing.

[szatox]

[Tony0945]

Citibank never used anything other than the log-in password to transfer money which I can also do by telephone. I prefer to use my credit card (NOT debit) that a liability limit for unauthorized use, while a thief could drain your account with a debit card. Fidelity Investments used a two step procedure when I first established transfer to my bank account but not for subsequent transfers. I believe that I have to use the two steps again if I change the institution or the account number which makes sense. I don't recall how US Social security set up auto payments. I think I filled out a form in person at the local office. I know that's what I always did for paycheck autodeposit, including changes.

Chase apparently uses the IP address because I have no trouble logging on from any computer on my LAN including the laptop, but would not let me log in from the laptop while traveling. "You have not used this computer to log in before." You would think they would use MAC address which can be changed but is pretty hard to guess.

[Hu]

[Tony0945]

Good point, Hu. At least they try to pick up hackers.