Infosec on ngmarley.com

Open Financial eXchange (OFX) is Broken (Online Banking Security is a Joke)

Thu, 05 Feb 2015 00:00:00 +0000

Am I the only person in the world who thinks that it’s utterly ludicrous that we have to give our passwords to sites like Mint.com so they can help us keep track of our spending habits? Surely I can’t be the only one. It’s like giving away the keys to the kingdom.

It kind of irks me a little that if I want to use a site like Mint.com to track my spending habits and help me keep my budget in line, I have to give my username and password over to them.

Bitcoin eliminates PCI compliance

Sun, 09 Mar 2014 00:00:00 +0000

I was just reading up on wrapping APIs and just came to another realization regarding Bitcoin. In a payment system using only Bitcoin, there is absolutely no need for PCI compliance. Zero. That’s right:

Bitcoin eliminates PCI compliance.

There’s no private data to store. No customer data exists that a criminal can then steal and rack up charges. Since Bitcoin payments are a push from the customer, instead of a pull from the merchant, there’s no need for any PCI compliance. Customer security is simply “baked in” to the protocol.

Password Policy

Thu, 04 Jul 2013 00:00:00 +0000

Hackers/crackers use modern GPUs (and possibly ASICs) to brute-force passwords. The old-school password policies from the early 2000’s really shouldn’t apply now, because to a computer, it’s irrelevant which characters are which. Computers can run through the entire UTF-8 charset in fractions of a second, and they’ll eventually guess a short password whether or not it contains a mix of character types (upper, lower, numbers, special, etc).

I’m tired of seeing password policies like this (I saw this when trying to change one of my passwords today):

Analysis of a Chinese Phishing Scam - Global Payments, Inc.

Wed, 11 Jan 2012 00:00:00 +0000

This post will be of particular interest to customers of Global Payments, Inc. I received an email which seemingly came from them, asking for account login details. Since I don’t have an account with them (and before this morning didn’t know who they were), I did some detective work. It turns out to be a phishing scam.

phish·ing/ˈfiSHiNG/
Noun:
The fraudulent practice of sending e-mails purporting to be from legitimate companies in order to induce individuals to reveal personal or confidential information, such as such as credit card numbers or passwords by directing a user to a fake email message or website.