[e-gold-list] Re: Pecunix security

2003-11-26 Thread FileMatrix
Sidd, there is no need to increase the length of the passwords. I understand that passwords are good for those people who print their PIKs and may loose them; it's a simple security backup system. For such a case, passwords need to be short to be easily remembered. Also, people who log-in from a

[e-gold-list] Re: Pecunix security

2003-11-26 Thread Patrick Chkoreff
On Wednesday, November 26, 2003, at 04:50 AM, FileMatrix wrote: However, this still leaves an account opened for automated password cracking. Therefore, the system has to lock (for 24 hours) an account for which there are too many consecutive failed log-ins (for example, 10). This means that

[e-gold-list] Re: Pecunix security

2003-11-26 Thread FileMatrix
Right, Patrick. For a moment I forgot that only a few elements from the PIK are used in a log-in. A separate, unique, private log-in ID is required. Besides, as Ian Green points out, locking out an account for repeated invalid login attempts can have some very bad unintended consequences: I

[e-gold-list] Re: Pecunix security

2003-11-26 Thread Patrick Chkoreff
On Wednesday, November 26, 2003, at 11:46 AM, FileMatrix wrote: Right, Patrick. For a moment I forgot that only a few elements from the PIK are used in a log-in. ... Gotcha. ... A separate, unique, private log-in ID is required. Besides, as Ian Green points out, locking out an account for

[e-gold-list] Re: Pecunix security

2003-11-26 Thread Danny Van den Berghe
However, this still leaves an account opened for automated password cracking. Therefore, the system has to lock (for 24 hours) an account for which there are too many consecutive failed log-ins (for example, 10). This means that each PIK must be unique, so that the system can at any time

[e-gold-list] Re: Pecunix security

2003-11-26 Thread FileMatrix
Danny, The accounts can only be indentified by the 'password', since I have to enter only 4 characters from the PIK, and there must be other accounts with the same characters in the same places here and there. We have to assume that their system checks to make it impossible that two

[e-gold-list] Re: Pecunix security

2003-11-26 Thread Viking Coder
I wonder if it is possible for a user to make his account balance public, but not to everybody?! This is currently possible - somewhat; the read-only access level. However, the password would have to be changed soon after to make it temporary. I mean, the user should be able to send a

[e-gold-list] Re: Pecunix security

2003-11-26 Thread Sidd
George, Viking Coder wrote: I wonder if it is possible for a user to make his account balance public, but not to everybody?! This is currently possible - somewhat; the read-only access level. However, the password would have to be changed soon after to make it temporary. A better way to do it

[e-gold-list] Re: Pecunix security

2003-11-26 Thread Sidd
Sidd wrote: Send the e-mail address to the person who must view the account. Once they have viewed the account, change the e-mail address in the account back to your normal one. Er... and remember to turn public viewing off again. Regards, Sidd. --- You are currently subscribed to e-gold-list

[e-gold-list] Re: Pecunix security

2003-11-25 Thread Jim Davidson
Dear Sidd, This will reveal your limited access PIK... use the limited access PIK to log in with limited access, and likewise use your read-only PIK for read-only access. Ah, I see. That's nifty. You can also activate PGP security for your account Yes, I've done so. It is also spiffy.

[e-gold-list] Re: Pecunix security

2003-11-25 Thread FileMatrix
Sidd, For those who only use one computer and who have a fixed IP address, the IP security is also available (George?) I prefer to keep my options open. You never know what can happen. Besides, I'm on dial-up for the moment and I can't be sure if the next time the IP will be even in the same

[e-gold-list] Re: Pecunix security

2003-11-25 Thread FileMatrix
Only in that case, the security of Pecunix will be above the others, not before that. Most people don't use IP lock or PGP log-in, they use passwords - it's easier. I was, of course, referring to the security of the log-in process. The rest is better, considering the PGP integration. George

[e-gold-list] Re: Pecunix security

2003-11-24 Thread Patrick Chkoreff
On Sunday, November 23, 2003, at 07:34 PM, Jim Davidson wrote: I believe Patrick made the point But the way Pecunix displays the PIKs makes it difficult if not impossible to copy and paste them. ... Since we know that keystroke loggers and clipboard loggers are out there, it seems uncommonly

[e-gold-list] Re: Pecunix security

2003-11-24 Thread Sidd
Dear Jim, Jim Davidson wrote: One of the things I'm not clear about is how one goes about logging into a Pecunix account with less than full access. Log in to your Pecunix account with full access and click Account Details Access Levels Look for Limited Access and Click here to view or update