1 minute, 2 seconds

Recently, some one got a hold of my card and was making fraudulent charges on it. My card company was Johnny on the spot and called me to verify the charges (side note: I had no way of verifying they were who they said they were, so they did the right thing and told me to call the number on the back of my card. You can’t be too vigilant!). When I finally got a rep. on the line, they canceled my card and sent me out a new one. Done deal.

But then they tell you, “cut up your card”. Why? If the number was stolen and we’re de-activating it so it can’t be used again, why cut up the card? In fact, why would you ever cut up the card? I guess if you think that cutting it up an active card will stop you from using it, then you should do a good job and cut it real good. But otherwise, I can’t think of a reason. My 5 minutes of googling didn’t find an answer either.

Do any of my faithful readers have an answer?

Update: There’s some good discussion below, but more notable is my comeuppance! After writing this post, I got not, one, not two, but three copies of my new card. Now I have the need to trash three credit cards that are all not canceled. Oh the horror!

1 minute, 34 seconds

As a fan of security and strong passwords, I read with interest Lifehacker’s article about how easy it is to hack passwords. In general the article is right on the money and I agree with it’s message. However, I took issue with the article on two points.

The first point they’re talking about how easy it is to either guess or brute force your passwords. Guessing and forcing passwords can be done over the Internet with out needing to compromise your (the victim’s) computer. However, the last step is “simply” to get at the cookies on your local machine:

But wait… How do I know which bank you use and what your login ID is for the sites you frequent? All those cookies are simply stored, unencrypted and nicely named, in your Web browser’s cache. (Read this post to remedy that problem.)
– Lifehacker Mar 30, 2010

For me this is crossing the line from informative into fear mongering. Yes, once you have logged into some one’s computer as the user they surf the internet as, it is indeed trivial to read cookies. No, this can not be done over the Internet. No this is not a simple step to make.

The second point (now that I’m not drafting this on my phone and am using a real computer) I see that the original article was published in 2007! Just about all the info in the original article still holds true 3 years later, but I find awkward when the article on Lifehacker has items like this in the article:

EDIT: You might also want to listen to my interview on Connecticut Public Radio about password security.

Which made me think it was a Lifehacker edit in 2010, but was in fact an edit from John Pozadzides in 2007. Speaking of Pozadzides, his blog looks pretty right on and I don’t really have any beef with him (in that totally anonymous Internet beef kind of way), but I mainly take issue with fear mongering, especially when in comes to cookies.

Update: This article seems to be making the rounds on a lot of sites.

Update 2: There’s a great comment from Wangston below.