Forced use of list-boxes as a security measure?
"Jonathan Hardwick" <[email protected]> Tue, 30 Sep 2003 08:14:56 -0700
| Newsgroups | gmane.comp.programming.keyholes |
|---|---|
| Message-ID | <[email protected]> |
--===============42782066064852087== Content-Type: text/html <html><div style='background-color:'><DIV> <P align=left><FONT face="Verdana, Geneva, Arial, Sans-serif"><FONT size=2><SPAN lang=en-us><FONT color=#000000>I've experienced an interesting security-related </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>justification for a specific keyhole problem: that of </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>forcing the user to use list-boxes to specify the month, </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>day, and year of a date (Section 6.2). I have a </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>savings account with egg.com, one of the first </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>internet-based banks in the UK. Part of their </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>user authentication procedure involves entering your date </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>of birth. </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>When they first started, this could be </FONT></SPAN><SPAN lang=en-us><FONT color=# 000000>entered by typing into three separate fields. However, it</FONT></SPAN><SPAN lang=en-us><FONT color=#000000> was later changed to use list-boxes for the </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>fields, with the accompanying justification that this </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>change was made to increase security for uses who </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>unwittingly had a key-stroke monitoring Trojan on </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>their computers! </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>This is an interesting security tradeoff: it undoubtedly </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>makes life harder for anyone trying to key-snoop </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>their way into an egg.com account, but it also makes </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>the interface infuriating for all their users. </FONT></SPAN></ FONT></FONT></P> <P align=left><SPAN lang=en-us></SPAN><FONT face="Verdana, Geneva, Arial, Sans-serif"><FONT size=2><SPAN lang=en-us><FONT color=#000000>To add insult to injury the list-boxes are, of </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>course, of fixed size, meaning I have to scroll all the way down in the day list-box </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>to reach my birthday (29th). And the range of years </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>given in the year list-box must change each </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>year, since only those aged 18 or above can open an </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>account. I've now held this account for five years, and </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>watched my birth year march slowly down </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>the third "set" of years you get on pressing page-</FONT></SPAN><SPAN lang=en-us><FONT color=#000000>down.&nb sp; When it reaches the fourth set I shall </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>truly consider myself middle-aged. </FONT></SPAN><SPAN lang=en-us><FONT color=#000000>I doubt that reminding users of their mortality was one of the design goals of this site...</FONT></SPAN></FONT></FONT></P> <P align=left><FONT face="Verdana, Geneva, Arial, Sans-serif"><FONT size=2><SPAN lang=en-us>Jonathan Hardwick</SPAN></FONT></FONT></P></DIV></div><br clear=all><hr> <a href="http://g.msn.com/8HMAENUS/2743??PS=">Get MSN 8 Dial-up Internet Service FREE for one month. Limited time offer- sign up now! </a> </html> --===============42782066064852087== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ software-keyholes mailing list software-keyholes-xIg/pKzrS18HpDbxM/[email protected] http://artima1.inetu.net/mailman/listinfo/software-keyholes --===============42782066064852087==--