The One Spa

CRA Lockout

In this day and age, you have to use multi-factor authentication (MFA) for everything. It is a bit of a hassle if you have only used a username and password, but the security benefit is worth it. I'm amazed that some banks like Tangerine and the CRA don't make it mandatory.
 
  • Like
Reactions: Mr.Know-It-All
Darts said:
Many do have a challenge question (name of your grade 5 teacher?) and/or they send a text to your cellphone.
Click to expand...

Most of the banks do have some sort of challenge question like first pet's name, etc. Not all of them will send you a text to your cell phone though. Tangerine definitely does not, which is a vulnerability. A skilled person can find ways around those challenge questions. Either through brute force attacks or social engineering i.e. pretending to be the bank and contacting people.

The CRA web-site does let you login with your bank username, password and one-time code aka Sign-In Partner, but that is optional. It should be mandatory to for all banks to use MFA. The CRA should then funnel people through the bank.

No one should not be able to access the CRA, government, banking or any sensitive website with just a username and password. Usernames and passwords have been proven to be totally useless.
 
One bank insists on voice print when I call them to authenticate it is actually Bob Darts.

BTW: I don't do business over a cellphone or wi-fi. It is always landline which is almost impossible to hack.
 
Darts said:
One bank insists on voice print when I call them to authenticate it is actually Bob Darts.

BTW: I don't do business over a cellphone or wi-fi. It is always landline which is almost impossible to hack.
Click to expand...

You should keep an eye on all your devices too even if they are hard wired to the internet. Computers obviously need to be patched and anti-virus updated, but don't forget your router or modem. You'll have to dig into the settings a bit to turn off services (like FTP, or remote management) that you don't need or use. Also, make sure there are no security vulnerabilities with your specific model.
 
explorerzip said:
In this day and age, you have to use multi-factor authentication (MFA) for everything. It is a bit of a hassle if you have only used a username and password, but the security benefit is worth it. I'm amazed that some banks like Tangerine and the CRA don't make it mandatory.
Click to expand...
lol

In this day & age you simply do not REUSE same password on multiple sites

How do you think a text message is in any way secure?
 
Darts said:
One bank insists on voice print when I call them to authenticate it is actually Bob Darts.

BTW: I don't do business over a cellphone or wi-fi. It is always landline which is almost impossible to hack.
Click to expand...
Landline is an actual old fashioned Bell Canada phone
You actually still use one?

(and btw even if true there were people hacking those as far back as the 70s... it is alot easier to do than I think most realize)
 
TeeJay said:
Landline is an actual old fashioned Bell Canada phone
You actually still use one?

(and btw even if true there were people hacking those as far back as the 70s... it is alot easier to do than I think most realize)
Click to expand...
Actually, I have both a landline and a cell.
 
TeeJay said:
lol

In this day & age you simply do not REUSE same password on multiple sites

How do you think a text message is in any way secure?
Click to expand...

Even if you have different passwords for each site they all have to be strong. It does no good to use different passwords if they are all easy to guess or crack with brute force.

It sounds like you've never used multi-factor authentication before. Most if not all companies use it for VPN connections so that employees can work from home and access company servers. MFA is an extra layer of security and does not replace usernames and passwords. The point of MFA is that you need: the username, password and the one-time passcode, which is why it's called multi-factor. The one-time code is only valid for a set time and is sent to you through e-mail, apps like Microsoft Authenticator, SMS or phone call. If your username and password is compromised you still need the one-time code. If you enter your one-time code incorrectly a few times, then the system could lock you out of your account if it's setup that way.

The system is obviously not fool proof. Someone could kidnap and force you into enter your username, password and one-time code. If you're at risk of kidnapping, then MFA is the least of your worries. You need an armed security detail. Hopefully, kidnapping is not a risk for most people. Secondly, I'm sure you've heard of SIM swapping. That's when a criminal calls your carrier pretending to be you and claims that they want to activate a new phone. So the carrier unknowingly switches your phone number to the new phone where they would get your one-time code.
 
  • Like
Reactions: TeeJay
TeeJay said:
Landline is an actual old fashioned Bell Canada phone
You actually still use one?

(and btw even if true there were people hacking those as far back as the 70s... it is alot easier to do than I think most realize)
Click to expand...

I think he's referring to using an Ethernet cable to connect his computer to the Internet. Ethernet is more secure than WIFI, but that depends on how everything else in your network is setup. It does you no good to plug in an Ethernet cable into a WIFI router that has a easy to guess admin password or no password at all.
 
explorerzip said:
I think he's referring to using an Ethernet cable to connect his computer to the Internet. Ethernet is more secure than WIFI,
Click to expand...
Don't tell anybody but yes. I am really concerned that someone might hack my computer and steal some or all of my nude female pics. LOL!
misoula.jpg
 
explorerzip said:
I think he's referring to using an Ethernet cable to connect his computer to the Internet. Ethernet is more secure than WIFI, but that depends on how everything else in your network is setup. It does you no good to plug in an Ethernet cable into a WIFI router that has a easy to guess admin password or no password at all.
Click to expand...
Oh even that is only true so long as you do not live in one of those newer Smart Homes
Otherwise a guy standing outside your house simply needs to plug into your network

Same as WiFi a smart admin should notice a foreign device instantly but I am willing to bet anything vast majority of users do not even look at their logs much less monitor their network


It also becomes a moot point as soon as you get a malware / spyware on your pc
But this is same for WiFi users
 
explorerzip said:
Even if you have different passwords for each site they all have to be strong. It does no good to use different passwords if they are all easy to guess or crack with brute force.

It sounds like you've never used multi-factor authentication before. Most if not all companies use it for VPN connections so that employees can work from home and access company servers. MFA is an extra layer of security and does not replace usernames and passwords. The point of MFA is that you need: the username, password and the one-time passcode, which is why it's called multi-factor. The one-time code is only valid for a set time and is sent to you through e-mail, apps like Microsoft Authenticator, SMS or phone call. If your username and password is compromised you still need the one-time code. If you enter your one-time code incorrectly a few times, then the system could lock you out of your account if it's setup that way.
Click to expand...
I act misread your original comment

A token device is infinitely more secure than getting a random txt number sent to your cell phone (which most people think is fool proof)

And yes I was assuming all passwords are much more difficult to guess than bare minimum (usually 8 characters with a single capital and a single symbol; many of these users instead of password simply change it to Password! and think noone will ever guess it lol)
 
TeeJay said:
Oh even that is only true so long as you do not live in one of those newer Smart Homes
Otherwise a guy standing outside your house simply needs to plug into your network

Same as WiFi a smart admin should notice a foreign device instantly but I am willing to bet anything vast majority of users do not even look at their logs much less monitor their network


It also becomes a moot point as soon as you get a malware / spyware on your pc
But this is same for WiFi users
Click to expand...

Not quite sure what you mean by a Smart Home. I don't think they would have a place where you can plug in directly to the house from the outside.
 
explorerzip said:
Not quite sure what you mean by a Smart Home. I don't think they would have a place where you can plug in directly to the house from the outside.
Click to expand...
Lots of new homes are being sold like that these days in GTA
The box is outside and easily accessible via a tool or a lockpick
 
Well also the annoying part is that some banks only allow you to use up to eight characters long for the password. In this day and age that is a very weak password to use even though they insist that there must be at least one upper case and number. However, some do not allow you to use special characters like & or *, and that is ridiculous.
 
TeeJay said:
Lots of new homes are being sold like that these days in GTA
The box is outside and easily accessible via a tool or a lockpick
Click to expand...

Oh really? I've honestly never heard of this. I am curious about this now. Do you happen to have a picture or link about how these external boxes do or look like? I can't see any reason for a home builder putting networking gear outside the home. There has to be a logical explanation for putting networking gear outside the home. That gear may have a different purpose that what you might think.
 
You must log in or register to reply here.
Toronto Escorts
Top Bottom
Back