On 10 Mar 2022 10:51:41 GMT, Bernard Peek <bap@shrdlu.com> wrote:

>On 2022-03-10, Nick Odell <nick@themusicworkshop.plus.com> wrote:
>> On Tue, 8 Mar 2022 12:44:00 +0000, Tease'n'Seize
>><tease-and-seize@invalid> wrote:
>>
>>>Ahem A Rivet's Shot wrote:
>>>
>>>> Tease'n'Seize wrote:
>>>>
>>>>> But there is another way, it requires you to enable "two step
>>>>> verification" on your google account, once that is on you can create an
>>>>> "app specific password" within your google account, and give that
>>>>> password to Outhouse instead of your normal google passworm.
>>>>
>>>> That is IMHO a vastly preferable and more secure option
>>>
>>>Except that the two-step isn't actually used by the email client at all, it's
>>>merely a pre-condition of creating the second password for the email client.
>>>
>>>> than oAuth2 which was originally about sharing users between applications -
>>>> even across suppliers.
>>>Yes, I don't trust oAuth2 as a way to propagate authentication from one service
>>>provider to another, one of the original authors left the project over it
>>>reducing security in the name of being one commercial ring to bind them all.
>>
>>
>> I don't want to distract from the issues that Brian is trying to
>> resolve but may I fork off into a more general question about internet
>> security?
>>
>> An article in the Grauniad suggests that Virgin Money have now made it
>> impossible to manage their credit card account without a smartphone.
>><https://www.theguardian.com/money/2022/mar/09/i-cant-manage-my-virgin-credit-card-account-without-a-smartphone>
>>
>> I suspect that is the direction of travel and Virgin Money won't be
>> the last to do this. But is a smartphone actually a more secure way to
>> do banking? Or is it just the fashionable way?
>
>It isn't as secure as using a web page but using both together is more
>secure than either one alone.
>
>>
>> A few years ago the answer was relatively straightforward -
>> illustrated by the legend that when Ross Anderson was asked which
>> smartphone banking app he would recommend, the answer was reputedly
>> none of them.
>>
>> But times have changed. I do my banking from a laptop using a fresh
>> Live Linux iteration which I shut down after each session and I think
>> I'm pretty secure. I don't own anything one could meaningfully call a
>> smartphone: am I going to have to buy one and learn how to use it?
>>
>
>Almost certainly.

Trouble is that, if I buy one and set about learning how to use it, by
the time I've mastered the system it will be out-of-date.

Nick

On 2022-03-10, Nick Odell <nick@themusicworkshop.plus.com> wrote:

>>> But times have changed. I do my banking from a laptop using a fresh
>>> Live Linux iteration which I shut down after each session and I think
>>> I'm pretty secure. I don't own anything one could meaningfully call a
>>> smartphone: am I going to have to buy one and learn how to use it?
>>>
>>
>>Almost certainly.
>
> Trouble is that, if I buy one and set about learning how to use it, by
> the time I've mastered the system it will be out-of-date.

You don't have to master the system. It's a tool for use by the man on the
Clapham Omnibus. You could try to master the system but then it will
certainly be out-of-date before you succeed.

--
Bernard Peek
bap@shrdlu.com

On Thu, 10 Mar 2022 11:24:59 +0100
Chris Elvidge <chris@mshome.net> wrote:

> I have one with my Nationwide account - it even has a replaceable
> battery. Better, well more secure, than phone/sms.

Phone based applications are replacing dongles all over the place,
the once ubiquitous RSA keyfob is now a rare sight. Any two factor system
is a vast improvement over just passwords - if the hacker with the screen
scraper also has to hack your phone *and* put the pieces together that's
not likely to happen even if your phone hasn't had a security patch
in ten years. Unless of course they're a TLA and you're targetted in which
case you're fperjrq anyway.

--
Steve O'Hara-Smith
Odds and Ends at http://www.sohara.org/

On Thu, 10 Mar 2022 11:17:12 +0000
Nick Odell <nick@themusicworkshop.plus.com> wrote:

> Trouble is that, if I buy one and set about learning how to use it, by
> the time I've mastered the system it will be out-of-date.

Nah, it's a piece of cake. First fwse everything about locking it
down and shutting up the phone home and helpful backup to our cloud junk
and do all of that before starting to use it - about 90% of it will be for
older versions so don't turn off your brain yet!

From then on when you pick it up turn your brain down to drunken
teenager level and you'll be fine - although you'll probably never develop
the reflexes for high speed thumb typing so don't try just peck at the
awful touch screen keyboard.

--
Steve O'Hara-Smith
Odds and Ends at http://www.sohara.org/

On 2022-03-09, John Williamson <johnwilliamson@btinternet.com> wrote:
> The Google motto used to be "Do no evil", now it seems to be "All your
> data belong to us."
>
> The reason they want you to use their mail client and web mail is so
> they can sell the data on what you look at to their advertisers.
>
>
> On 09/03/2022 11:36, Brian Gaff (Sofa) wrote:
>> I seriously think Google want everyone to use webmail or their own smart phone client, since then you have to see their inane adverts that screw up the accessibility since they come from a third party feed and could drive a screenreader bonkers.
>
>
>

Anyone who thinks that their data is unread, even if it is encrypted in
some way, is living in fantasy land.
--
greymausg@mail.com
That's not a mousehole!

On 2022-03-10, Nick Odell <nick@themusicworkshop.plus.com> wrote:
> On Tue, 8 Mar 2022 12:44:00 +0000, Tease'n'Seize
><tease-and-seize@invalid> wrote:
>
>

> An article in the Grauniad suggests that Virgin Money have now made it
> impossible to manage their credit card account without a smartphone.

My daughter cannot get into her apartment without having her smartphone
with her. I cannot buy from Amazon without an app on my dumbphone,
which I am slow to install.

(Well, I can from another account, for small items, Amazon probably
knows that after I post this)

><https://www.theguardian.com/money/2022/mar/09/i-cant-manage-my-virgin-credit-card-account-without-a-smartphone>
>
> I suspect that is the direction of travel and Virgin Money won't be
> the last to do this. But is a smartphone actually a more secure way to
> do banking? Or is it just the fashionable way?
>
> A few years ago the answer was relatively straightforward -
> illustrated by the legend that when Ross Anderson was asked which
> smartphone banking app he would recommend, the answer was reputedly
> none of them.
>
> But times have changed. I do my banking from a laptop using a fresh
> Live Linux iteration which I shut down after each session and I think
> I'm pretty secure.

Codswallop. Some of the `secure' programs on Linux are securely
backdoored.

I don't own anything one could meaningfully call a
> smartphone: am I going to have to buy one and learn how to use it?
>

There is an Israeli company advertising that it can listen to any phone,
and if there is, there are others. Do not give your real opinions on a
smartphone connection.

--
greymausg@mail.com
That's not a mousehole!

On 10/03/2022 15:14, maus wrote:
> On 2022-03-10, Nick Odell <nick@themusicworkshop.plus.com> wrote:
>> On Tue, 8 Mar 2022 12:44:00 +0000, Tease'n'Seize
>> <tease-and-seize@invalid> wrote:
>>
>>
>
>
>
>> An article in the Grauniad suggests that Virgin Money have now made it
>> impossible to manage their credit card account without a smartphone.
>
> My daughter cannot get into her apartment without having her smartphone
> with her. I cannot buy from Amazon without an app on my dumbphone,
> which I am slow to install.
>
> (Well, I can from another account, for small items, Amazon probably
> knows that after I post this)
>
I have just had a knee male from my bank saying that as of next week,
most of my online purchases will need to be verified either by using
their app or by sending an SMS to my phone. The SMS method will even
work on the original Nokia 3310.

>> <https://www.theguardian.com/money/2022/mar/09/i-cant-manage-my-virgin-credit-card-account-without-a-smartphone>
>>
>> I suspect that is the direction of travel and Virgin Money won't be
>> the last to do this. But is a smartphone actually a more secure way to
>> do banking? Or is it just the fashionable way?
>>
>> A few years ago the answer was relatively straightforward -
>> illustrated by the legend that when Ross Anderson was asked which
>> smartphone banking app he would recommend, the answer was reputedly
>> none of them.
>>
>> But times have changed. I do my banking from a laptop using a fresh
>> Live Linux iteration which I shut down after each session and I think
>> I'm pretty secure.
>
> Codswallop. Some of the `secure' programs on Linux are securely
> backdoored.
>
There are one or two distros that are reasonably secure as delivered.

> I don't own anything one could meaningfully call a
>> smartphone: am I going to have to buy one and learn how to use it?
>>
>
> There is an Israeli company advertising that it can listen to any phone,
> and if there is, there are others. Do not give your real opinions on a
> smartphone connection.
>
I have been watching my words on line since the early days of usenet. I
learned very early on that not only will it be quoted out of context,
whatever I put on line will always be there. Cellphones are just an
easily tapped extension of this.

Even the "trust groups" where you all physically exchange public keys
off line can't stop it.

--
Tciao for Now!

John.

On 10-Mar-22 9:41, Nick Odell wrote:
> Of course banks and other financial service providers are run for
> profit and they are entitled to make good/bad decisions and
> enjoy/suffer the consequences. What really cvffrf zr bss is the
> creeping requirement to be a smartphone user in order to access public
> services - highlighted recently through the retreat into their
> fortresses of some medical, local authority and government services.

If you ignore those who:
a) Don't have, or want, a mobile, and/or those who
b) Cannot get a reliable mobile signal in their home.

Then there is nothing wrong with this approach.

Oh I forgot to mention:
If there is some sort of event which knocks out part of the phobile moan
infrastructure, the whole thing goes mammary verticalis.

--
Sam Plusnet

On 10-Mar-22 10:10, Peter wrote:

> I can still do my (First Direct) banking on my PC but need my smart fone to
> complete authorisation when logging in. If I didnt have a fobile moan I
> could ask the bank to supply a dongle to provide the pass code - I used to
> have one but gave it up when the flattery ran out after about 10 years.
>
> SWMBO won't have a smart phone so she would have to use a dongle except that
> she has a better idea - she leaves all the banking to me.
>
My SWMBO has a NatWest 'dongle'[1] and I've had to replace the batteries
in it at least three times in the last couple of years.
She has the habit of dumping a pile of (sometimes heavy) things on top
of devices wot have batteries.
I've tried & tried to break her of this but it goes in one ear and...

[1] It's no what I think of as a dongle, but never mind.

--
Sam Plusnet

On 10-Mar-22 15:14, maus wrote:
> My daughter cannot get into her apartment without having her smartphone
> with her. I cannot buy from Amazon without an app on my dumbphone,
> which I am slow to install.

I assume she has a 'Plan B' for when her phone's battery dies or she
loses it or...

--
Sam Plusnet

maus <maus@dmaus.org> wrote:
> On 2022-03-10, Nick Odell <nick@themusicworkshop.plus.com> wrote:
>> On Tue, 8 Mar 2022 12:44:00 +0000, Tease'n'Seize
>> <tease-and-seize@invalid> wrote:
>>
>>
>
>
>
>> An article in the Grauniad suggests that Virgin Money have now made it
>> impossible to manage their credit card account without a smartphone.
>
> My daughter cannot get into her apartment without having her smartphone
> with her. I cannot buy from Amazon without an app on my dumbphone,
> which I am slow to install.

Um, if it has apps surely it’s not a dumbphone? You could still order using
a PC.

Tim

--
Please don't feed the trolls

On Thu, 10 Mar 2022 18:49:52 +0000
Sam Plusnet <not@home.com> wrote:

> On 10-Mar-22 9:41, Nick Odell wrote:
> > Of course banks and other financial service providers are run for
> > profit and they are entitled to make good/bad decisions and
> > enjoy/suffer the consequences. What really cvffrf zr bss is the
> > creeping requirement to be a smartphone user in order to access public
> > services - highlighted recently through the retreat into their
> > fortresses of some medical, local authority and government services.
>
> If you ignore those who:
> a) Don't have, or want, a mobile, and/or those who
> b) Cannot get a reliable mobile signal in their home.

The app based ones (but not the SMS based ones) use the internet
connection so they'll jbex off the home notwork if needs be, which also
helps with the infrastructure issue.

--
Steve O'Hara-Smith
Odds and Ends at http://www.sohara.org/

On Wed, 9 Mar 2022 08:42:32 +0000, Tease'n'Seize
<tease-and-seize@invalid> wrote:
>Dave W wrote:
>
>> I can't see alt.comp.softwre.thunderbird using Agent.
>
>It has existed for nearly a year now <glint>, it seems you're using E-S, which
>certainly carries it, so just do a refresh groups under subscribe.
>
>> I was interested because recently Thunderbird has kept losing
>
>I use TB v91.x, I think oAuth2 was supported from around v78.x fro POP and IMAP,
>perhaps earlier for IMAP only, it's clear that gmail would prefer everyone to
>use oAuth, I'd recommend go the whole hog now, rather than switch to app
>specific passworms now, then have to change again when they decide to remove
>those in a multifortnight.
>
>Mozilla have made it quite clear they're unafraid of b0rking stuff in the name
>of progress, some people react by saying "ok I'll stick on trusted version"
>which is fine, except when something big comes along and you ARRQ a version with
>a nw feature, you'll encounter a metricpencton of changes all in one go, rather
>than spreading the pain thinly.
Thanks, I've found the group now. I might go to an even older version
than the 68.5 I'm using now, as someone said that version 59 has an
option not to look for updates.
--
Dave W

On 2022-03-10, Tim+ <tim.downie@gmail.com> wrote:
> maus <maus@dmaus.org> wrote:
>> On 2022-03-10, Nick Odell <nick@themusicworkshop.plus.com> wrote:
>>> On Tue, 8 Mar 2022 12:44:00 +0000, Tease'n'Seize
>>> <tease-and-seize@invalid> wrote:
>>>
>>>
>>
>>
>>
>>> An article in the Grauniad suggests that Virgin Money have now made it
>>> impossible to manage their credit card account without a smartphone.
>>
>> My daughter cannot get into her apartment without having her smartphone
>> with her. I cannot buy from Amazon without an app on my dumbphone,
>> which I am slow to install.
>
> Um, if it has apps surely it’s not a dumbphone? You could still order using
> a PC.

my `offical' Amazon account need me to have a smartphone.

Sorry, the `dumbphone' thing was sarcasm.
>
> Tim
>
>

--
greymausg@mail.com
That's not a mousehole!

On 10/03/2022 22:53, Dave W wrote:

> Thanks, I've found the group now. I might go to an even older version
> than the 68.5 I'm using now, as someone said that version 59 has an
> option not to look for updates.
>
I am still on version 50.0b1, as that is the last one where Leetkey works.

--
Tciao for Now!

John.

On 10/03/2022 19:52, Ahem A Rivet's Shot wrote:
>> If you ignore those who:
>> a) Don't have, or want, a mobile, and/or those who
>> b) Cannot get a reliable mobile signal in their home.
>
> The app based ones (but not the SMS based ones) use the internet
> connection so they'll jbex off the home notwork if needs be, which also
> helps with the infrastructure issue.
>

The internet is only required to install/update the app.

When in use for authentication, authenticator app displays time expiring
tokens just like the RSA hardware keys. I don't think they require a
live internet connection for that.

--
Adrian C

On Fri, 11 Mar 2022 12:15:04 +0000
Adrian Caspersz <email@here.invalid> wrote:

> The internet is only required to install/update the app.
>
> When in use for authentication, authenticator app displays time expiring
> tokens just like the RSA hardware keys. I don't think they require a
> live internet connection for that.

Ah one of those types - yes they require no connection at all once
set up - some of them can even be set up offline using a QR grid containing
the key. The type I was thinking of that does need a connection at verify
time is the push notification variety where the bank (or whatever) sends a
notification to the app and you have to hit the "Yes I do mean it" button
or alternatively the "WTF Hell NO!" button.

--
Steve O'Hara-Smith
Odds and Ends at http://www.sohara.org/

On 10/03/2022 18:54, Sam Plusnet wrote:
> On 10-Mar-22 10:10, Peter wrote:
>
>> I can still do my (First Direct) banking on my PC but need my smart
>> fone to
>> complete authorisation when logging in. If I didnt have a fobile moan I
>> could ask the bank to supply a dongle to provide the pass code - I
>> used to
>> have one but gave it up when the flattery ran out after about 10 years.
>>
>> SWMBO won't have a smart phone so she would have to use a dongle
>> except that
>> she has a better idea - she leaves all the banking to me.
>>
> My SWMBO has a NatWest 'dongle'[1] and I've had to replace the batteries
> in it at least three times in the last couple of years.
> She has the habit of dumping a pile of (sometimes heavy) things on top
> of devices wot have batteries.
> I've tried & tried to break her of this but it goes in one ear and...
>
> [1] It's no what I think of as a dongle, but never mind.

I've got a couple of Nationwide card readers (I assume that's the dongle
being referred to), batteries still good. Most of my banking is done via
smartfern, the card reader is needed to verify some things. I do find
biometric logins rather handy, I just wish the Ebay app on the fern
would notice that I've got the option to use biometric logins switched
on rather than getting me to put in my password, as that means opening
Chrome (which I don't use) on the fern, getting the password out of it,
and pasting it into the app.

On Fri, 11 Mar 2022 15:45:41 +0000
Mike Fleming <mike@tauzero.co.uk> wrote:

> I do find biometric logins rather handy,

They are, until the day the fingerprint sensor dies in the phobile
and you suddenly find yourself trying to unforget a whole bunch of
passworms and pins wot haven't been used in ages and ages - and I *still*
keep dabbing my finger in the useless hole on the back of the thing.

--
Steve O'Hara-Smith
Odds and Ends at http://www.sohara.org/

Ahem A Rivet's Shot <steveo@eircom.net> wrote:
> On Fri, 11 Mar 2022 15:45:41 +0000
> Mike Fleming <mike@tauzero.co.uk> wrote:
>
>> I do find biometric logins rather handy,
>
> They are, until the day the fingerprint sensor dies in the phobile
> and you suddenly find yourself trying to unforget a whole bunch of
> passworms and pins wot haven't been used in ages and ages - and I *still*
> keep dabbing my finger in the useless hole on the back of the thing.
>

Sometimes it’s my fingerprint that fails after sawing and stacking lots of
logs. Recovers after a few days.

Tim

--
Please don't feed the trolls

Ahem A Rivet's Shot wrote:

> Mike Fleming wrote:
>
>> I do find biometric logins rather handy,
>
> They are, until the day the fingerprint sensor dies in the phobile

Or you do quite a lot of e.g. sanding, or picking up rough materials and you
haven't got any fingerprints for a week

> and you suddenly find yourself trying to unforget a whole bunch of
> passworms and pins wot haven't been used in ages and ages

My passworm mangler normally uses fingerprints, but it does force you to enter
the PIN every n'th unlock, and even your master passworm encryption passworm
once in a blue moon.

On 11-Mar-22 17:07, Tim+ wrote:
> Ahem A Rivet's Shot <steveo@eircom.net> wrote:
>> On Fri, 11 Mar 2022 15:45:41 +0000
>> Mike Fleming <mike@tauzero.co.uk> wrote:
>>
>>> I do find biometric logins rather handy,
>>
>> They are, until the day the fingerprint sensor dies in the phobile
>> and you suddenly find yourself trying to unforget a whole bunch of
>> passworms and pins wot haven't been used in ages and ages - and I *still*
>> keep dabbing my finger in the useless hole on the back of the thing.
>>
>
> Sometimes it’s my fingerprint that fails after sawing and stacking lots of
> logs. Recovers after a few days.

That too, but just washing my hands is enough to ubgger the thing up for
the next ten minutes.

--
Sam Plusnet

On 11-Mar-22 12:15, Adrian Caspersz wrote:
> On 10/03/2022 19:52, Ahem A Rivet's Shot wrote:
>>> If you ignore those who:
>>> a) Don't have, or want, a mobile, and/or those who
>>> b) Cannot get a reliable mobile signal in their home.
>>
>>     The app based ones (but not the SMS based ones) use the internet
>> connection so they'll jbex off the home notwork if needs be, which also
>> helps with the infrastructure issue.
>>
>
> The internet is only required to install/update the app.
>
> When in use for authentication, authenticator app displays time expiring
> tokens just like the RSA hardware keys. I don't think they require a
> live internet connection for that.
>
If you don't have an internet connection, what could you be doing which
would require a token?

--
Sam Plusnet

Bernard Peek said:
> On 2022-03-10, Nick Odell <nick@themusicworkshop.plus.com> wrote:
>
>>>> But times have changed. I do my banking from a laptop using a fresh
>>>> Live Linux iteration which I shut down after each session and I think
>>>> I'm pretty secure. I don't own anything one could meaningfully call a
>>>> smartphone: am I going to have to buy one and learn how to use it?
>>>>
>>>
>>>Almost certainly.
>>
>> Trouble is that, if I buy one and set about learning how to use it, by
>> the time I've mastered the system it will be out-of-date.
>
> You don't have to master the system. It's a tool for use by the man on the
> Clapham Omnibus. You could try to master the system but then it will
> certainly be out-of-date before you succeed.

Some days you master the system, other days the system masters you ?

--
Richard Robinson
"The whole plan hinged upon the natural curiosity of potatoes" - S. Lem

My email address is at http://qualmograph.org.uk/contact.html

On Fri, 11 Mar 2022 19:15:52 +0000
Sam Plusnet <not@home.com> wrote:

> If you don't have an internet connection, what could you be doing which
> would require a token?

I *could* set up toof actor log in on my BSD boxes if really
wanted to and then I'd need a token to log in.

--
Steve O'Hara-Smith
Odds and Ends at http://www.sohara.org/