QIWI and Skrill have been added to the register of banned websites. - page 11

 
Alexey Busygin:

I don't know about their aggressive policy, they still don't have an encrypted address bar, you take a username from the stock, supply their index and get someone else's work box, for spam.

By the way there is no encryption here either, you take the last word from the slash and your login "svalex".

It is a security deficit by the way.

Let me tell you a big secret - you don't even have to look in the browser bar to do this, you can just put your cursor over the name/surname:

What confuses you - the password is not visible, right?)))

 
Alexandr Saprykin:

Let me tell you a big secret - you don't even have to look in the browser bar to do this, you can just hover over the name/surname:

What's confusing you - you can't see the password, right?)))

From a security point of view, the login and password must be hidden from view. As it is a part of the access to personal data. If you know your login and password you have to guess it, your account will be compromised and your personal data will be accessed by third parties. What about personal data? If there is money in the account, you can always withdraw it by changing contacts. Do you often check the account number where you send the money? I don't, or rather never, once I did and I forgot I was there. And the spam database will not be superfluous, it can always be sold or used. Some members are added as friends, just to aggressively promote their goods or services. And there's a whole set of active users you can send messages to via private messenger. Well, get banned once, you can always change your username, if necessary, change ip. And this is how I took a discount, and there are people richer than my fantasies, they will come up with something else, as you can use a login because the first step has already been taken.

Login as I think, left displayed, after the name and surname began to be displayed instead of a login. That forum attendees are not confused with the interlocutor, because previously was displayed only a login and name and surname were hidden. At the first stage, it was decided to temporarily leave the username displayed.

Even for example, take Ucoz sites where encryption of address bar is used for a long time. Back in 2007 I was messing around and noticed the difference. The site odnoklassniki, bought by Mail.ru there is also encryption of the address bar. And MQL seems to be a solid organization, there is a security certificate in the address bar, but it does not carry any special useful load, it may encrypt information in transmission, but does not encrypt the display.

 
Alexey Busygin:

From a security point of view the login and password should be hidden from prying eyes. As it is a piece of personal data. Once you know your login, you have to guess a password and your account will be compromised and your personal data will be accessed by third parties. What about personal data? If there is money in the account, you can always withdraw it by exchanging contacts. Do you often check the account number where you send the money? I don't, or rather never, once I did and I forgot I was there. And the spam database will not be superfluous, it can always be sold or used. Some members are added as friends, just to aggressively promote their goods or services. And there's a whole set of active users you can send messages to via private messenger. Well, get banned once, you can always change your username, if necessary, change ip. And this is how I took a discount, and there are people richer than my fantasies, they will come up with something else, as you can use a login because the first step has already been taken.

I think the username was left on, after the first and last names were displayed instead of the username. So that the forum users would not be confused with the interlocutor, because previously only the username was displayed, and the first and last names were hidden. That's the first phase and it was decided to temporarily leave the display login.

Even for example, take Ucoz sites where encryption of address bar is used for a long time. Back in 2007 I was messing around and noticed the difference. The site odnoklassniki, bought by Mail.ru there is also encryption of the address bar. And MQL seems to be a solid organization, there is a security certificate in the address bar, but it does not carry any special useful load, it may encrypt information in transmission, but does not encrypt the display.

Nonsense. Firstly, knowing your login does not help with hacking. The example is Linux, where the super-user is always called root. Everybody knows about it, but only a few can hack into the machine.

Secondly, if the cracker got access to the merchant's account, he would not be able to redirect the withdrawal to another purse, because the new purse would have to be validated by entering a code sent via SMS. That is, you will also need access to the phone owner of the account.

Thirdly, you can set up filtering by IP, and allow authorization only from certain IP addresses.

 
Vasiliy Sokolov:

Bullshit. Firstly, knowing your login does not help in any way with hacking. One example is Linux, where the super-user is always root. Everyone knows this, but only a few can hack into the machine.

Secondly, if the cracker got access to the merchant's account, he would not be able to redirect the withdrawal to another purse, because the new purse would have to be validated by entering a code sent via SMS. That is, you will also need access to the phone owner of the account.

Thirdly, you can set up filtering by IP, and allow authorization only from specific IP addresses.

Are you talking like a hacker or like an amateur? Firstly Admin and Root are permissions, not user accounts. Hackers are trying to get this right to access the accounts, thats number one.

Second, by entering you, he will know your location, of course, if you are beyond his reach, he will not be interested in you, but if you are in one country and even in one city, why would not become your friend for a while, at least until he copies your SIM card, for example, meet you at a coffee for a beer, and then the copying will not do. Then the confirmation will pass, without much effort, that's the second thing.

And third, filtering by IP is of course a good thing, but unrewarding, you`re more likely to get yourself banned than the outsiders. You can take my word for it. I tested this IP-filtering on myself. Then I got rid of it because after each reconnection, you have to enter IP again into filter otherwise you won't get in. Or enter the whole network, then the intruder will also not be blocked.

 
Alexey Busygin:

Are you speaking as a hacker or as an amateur? First of all Admin and Root are rights, not user accounts. Hackers are trying to get this right to get access to accounts, that's the first thing.

Second, by entering you, he will know your location, of course, if you are beyond his reach, he will not show interest in you, but if you are in one country and even in one city, why would not become your friend for a while, at least until he copies your sim. Then the confirmation will go through without much effort, that's the second thing.

And third, filtering by IP is certainly a good thing, but unrewarding, you are more likely to ban yourself than outsiders. You can take my word for it. I tested this IP-filtering on myself. Then I got rid of it because after each reconnection, you have to enter IP again into filter otherwise you won't get in. Or enter the whole network, then the intruder will not be blocked either.

For your information, IP filtering can only be used if you have a white address, which is what the settings page says.

Administrator and Root are exactly user accounts, with their own directories and data. Root is not in the login window of the linux shell, especially for security reasons, but you can freely sit in the console as root and do whatever you want.

What you're saying about copying SIM is nonsense. You can really copy your SIM card by applying in person to the operator's office with your passport and requesting that it be restored. A new card will be issued, and the old one will be blocked automatically.

 
Vasiliy Sokolov:

For your information, IP filtering can only be used if you have white addresses, which is what the settings page says.

Administrator and Root are exactly user accounts, with their own directories and data. Root is not in the login window of the linux shell, especially for security reasons, but you can freely sit in the console as root and do whatever you want.

What you're saying about copying SIM is nonsense. You can really copy your SIM card by applying in person to the operator's office with your passport and requesting that it be restored. A new card will be issued, with the automatic blocking of the old one.

You've been to alibaba lately? It's full of devices for copying SIMs and full of universal SIMs, with up to 10 numbers recorded. I was thinking of getting one myself so I don't have to lug around two phones. You're still in the last century.

You're living in the past century. Administrator and root are rights, not accounts. The simple thing is when the system creates the rules for permissions, it automatically creates user and root accounts. I have multiple accounts on my PC, one administrator, programs to edit in one area, games in another, admin in a third, internet in the fourth. This was done by me to ensure that all the programs and their services are not run in clumps, do not burden memory and do not build a continuous series of processes. And for this I myself assigned, what account which right should use, and what additional right should be granted, and the rule of rights dopislavl when the needful. So keep the fairy tale to yourself. Any account can get right of administrator or root but it can get this right only, from local admin.

What is a white address and a gray address?

All IPv4 IP addresses are divided into private/local/internal (called "grey") and public/global/external (called "white").

That's why I say it's bullshit, all this ip filtering.

 
Alexey Busygin:


Second, when he comes to you he will know your location, of course if you are out of his reach, he will not show interest in you, but if you are in the same country and even in the same city, why not become your friend for a while, at least until he copies your SIM card, for example to meet you at coffee, have a beer, and then the copying will not be a thing. Then the confirmation will pass, without much effort, that's second.


So don't have such "friends" who need you to steal your money.

 
Alexandr Saprykin:

So don't have "friends" who need you to steal your money.

Do you know everyone that you communicate with online? For example, if I send you a request to be added as a friend, would you say no? No! Also, you don't mean friends you're close to if you went to school with them or if you live in the same yard with them.
 
Alexey Busygin:
Do you know everyone with whom you communicate online? Here's an example, if I send you an overgrowth, to be added to your friends, will you refuse? No! Also, you don't mean friends with whom you studied or with whom you live in the same yard.

What makes you think I won't?)

Do you drink beer/coffee with everyone you chat with online? That's exactly what you said, that you would meet in a cafe and then copy the SIM card.

 
Alexandr Saprykin:

What makes you think I won't?)

Do you drink beer/coffee with everyone you chat with online? That's exactly what you wrote about, to meet in a cafe and then copy the sim there.

No! I try to avoid face-to-face meetings.

You're already my friend, I don't think you'll delete me after this message

Let's just say I've had meetings, with users of this forum. And I don't mean to say that the people I've met have bad intentions. But we're talking about a scammer and that vigilance is the best ally.