Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


View this topic in a long page with up to 500 replies per page Create new topic
1 | 2 | 3 
597 posts

Ultimate Geek
+1 received by user: 132


  # 983238 10-Feb-2014 11:41
Send private message

Yes that is true, but we are also discussing the transit of PPP traffic in which the passwords are not encrypted so they route in which they travel is important as it is much more secure if Snap have a authentication server at the handover point, or securely VPN to the authentication server, before that unencrypted traffic hits the internet accessible network.




Regards
Stefan Andres Charsley

3344 posts

Uber Geek
+1 received by user: 1089

Trusted
Vocus

  # 983240 10-Feb-2014 11:49
Send private message

Given in most cases, port authentication is used anyway, what would someone have to gain from stealing your PPP password?  Seems like a lot of effort for very little.

edit: and of course the PPP traffic doesn't traverse the public internet, it's terminated to Snap or whichever ISP, and their auth server handles it.

 
 
 
 


597 posts

Ultimate Geek
+1 received by user: 132


  # 983242 10-Feb-2014 11:56
Send private message

ubergeeknz: Given in most cases, port authentication is used anyway, what would someone have to gain from stealing your PPP password?  Seems like a lot of effort for very little.

edit: and of course the PPP traffic doesn't traverse the public internet, it's terminated to Snap or whichever ISP, and their auth server handles it.


And herein lies the answer to why Snap haven't bothered giving you separate passwords for your account and PPP login.




Regards
Stefan Andres Charsley



14878 posts

Uber Geek
+1 received by user: 2790

Trusted
Subscriber

  # 983293 10-Feb-2014 13:22
Send private message

ubergeeknz: Given in most cases, port authentication is used anyway, what would someone have to gain from stealing your PPP password?  Seems like a lot of effort for very little.

edit: and of course the PPP traffic doesn't traverse the public internet, it's terminated to Snap or whichever ISP, and their auth server handles it.


As far as I can tell Snap customers have one password. Interception is far less likely IMHO than it being hacked or used by staff - no matter how well you vet people you can get a bad egg. If people reuse passwords (which is stupid but common) that could lead to bigger issues. It could let someone else use my bandwidth, and if Snap has a good customer portal it could give access to my payment details, home address etc.

So while what you say is true to some extent, think a little wider.

3344 posts

Uber Geek
+1 received by user: 1089

Trusted
Vocus

  # 983296 10-Feb-2014 13:29
Send private message

As I see it the problem here is twofold:

1. Users choosing their own PPP password - should be a secure password picked for them and provided to them, IMO
2. Using same password for account access - probably not a good idea, as has been established in this thread, PPP password is only *so* secure, by necessity.

1387 posts

Uber Geek
+1 received by user: 134


  # 983313 10-Feb-2014 13:48
Send private message

timmmay:
ubergeeknz: Given in most cases, port authentication is used anyway, what would someone have to gain from stealing your PPP password?  Seems like a lot of effort for very little.

edit: and of course the PPP traffic doesn't traverse the public internet, it's terminated to Snap or whichever ISP, and their auth server handles it.


As far as I can tell Snap customers have one password. Interception is far less likely IMHO than it being hacked or used by staff - no matter how well you vet people you can get a bad egg. If people reuse passwords (which is stupid but common) that could lead to bigger issues. It could let someone else use my bandwidth, and if Snap has a good customer portal it could give access to my payment details, home address etc.

So while what you say is true to some extent, think a little wider.


i think you'll notice pretty quickly if someone is using your password, as there'll be a simultaneous session limit.

a good customer portal doesn't expose payment details, but may address.  address is public knowledge though.




14878 posts

Uber Geek
+1 received by user: 2790

Trusted
Subscriber

  # 983325 10-Feb-2014 14:15
Send private message

A good portal isn't vulnerable to SQL injection either, but that little trick hacks websites every day. Even if the credit card data isn't exposed in a portal it could still be sitting in the database, and could be discovered using simple SQL injection type techniques.

 
 
 
 


4025 posts

Uber Geek
+1 received by user: 1076

Trusted

  # 983433 10-Feb-2014 16:30
Send private message

mercutio:
timmmay:
ubergeeknz: Given in most cases, port authentication is used anyway, what would someone have to gain from stealing your PPP password?  Seems like a lot of effort for very little.

edit: and of course the PPP traffic doesn't traverse the public internet, it's terminated to Snap or whichever ISP, and their auth server handles it.


As far as I can tell Snap customers have one password. Interception is far less likely IMHO than it being hacked or used by staff - no matter how well you vet people you can get a bad egg. If people reuse passwords (which is stupid but common) that could lead to bigger issues. It could let someone else use my bandwidth, and if Snap has a good customer portal it could give access to my payment details, home address etc.

So while what you say is true to some extent, think a little wider.


i think you'll notice pretty quickly if someone is using your password, as there'll be a simultaneous session limit.

a good customer portal doesn't expose payment details, but may address.  address is public knowledge though.


Careful with dismissing data like address and other details as 'public'. While these can be very easy to get ahold of, if you gained several accounts worth of data with names, addresses, phone numbers, dates of birth, it allows a very easy starting base for fraud and social engineering attacks.
Just look at any of the high profile chained social engineering attacks where one company deems something 'public' and others consider it information to verify identity.

Snap's account portal shows account name, phone number, account number, billing email, direct debit info and account. You can obviously also access the primary email address attached to the account, and all the internet/voip self management tools too.

Not that I'm jumping into this debate, just adding a comment in regarding the value of such information.



14878 posts

Uber Geek
+1 received by user: 2790

Trusted
Subscriber

  # 983504 10-Feb-2014 17:40
Send private message

A one or two character twitter handle was recently lost due to social engineering, paypal gave out the last four digits of a credit card and that was used to do all sorts of things.

1 | 2 | 3 
View this topic in a long page with up to 500 replies per page Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Dunedin selects Telensa to deliver smart street lighting for 15,000 LEDs
Posted 18-Jul-2019 10:21


Sprint announces a connected wallet card with built-in IoT support
Posted 18-Jul-2019 08:36


Educational tool developed at Otago makes international launch
Posted 17-Jul-2019 21:57


Symantec introduces cloud access security solution
Posted 17-Jul-2019 21:48


New Zealand government unveils new digital service to make business easier
Posted 16-Jul-2019 17:35


Scientists unveil image of quantum entanglement
Posted 13-Jul-2019 06:00


Hackers to be challenged at University of Waikato
Posted 12-Jul-2019 21:34


OPPO Reno Z now available in New Zealand
Posted 12-Jul-2019 21:28


Sony introduces WF-1000XM3 wireless headphones with noise cancellation
Posted 8-Jul-2019 16:56


Xero announces new smarter tools, push into the North American market
Posted 19-Jun-2019 17:20


New report by Unisys shows New Zealanders want action by social platform companies and police to monitor social media sites
Posted 19-Jun-2019 17:09


ASB adds Google Pay option to contactless payments
Posted 19-Jun-2019 17:05


New Zealand PC Market declines on the back of high channel inventory, IDC reports
Posted 18-Jun-2019 17:35


Air New Zealand uses drones to inspect aircraft
Posted 17-Jun-2019 15:39


TCL Electronics launches its first-ever 8K TV
Posted 17-Jun-2019 15:18



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.