Didn’t Homejoy Shut Down?

Re:Didn’t Homejoy Shut Down? by SomeCallMeTim on Thursday October 29, 2015 @12:42AM (#10469306)

No, it's not secure information.

Any time you use last-4 as something secure, you're doing it wrong.

As mentioned above, last-4 is sent by email frequently, and email passes, unencrypted, through intermediate servers all over the Internet. Any compromised host can observe all of the email that passes through it.

Any process that uses last-4 to unlock a password or otherwise as a secure token is broken by design.

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by CamperBob2 on Thursday October 29, 2015 @06:39AM (#10470097)

Any time you use last-4 as something secure, you're doing it wrong.

It's not a question of what I use those digits for, it's a question of what everyone else uses them for.

[ Parent | on HN ]