I can't believe it's been half a year since GO+ release and we are STILL on this exact topic.

Haha, I am not surprised that people were looking for it, just surprised it would go on this long, and people are still looking for the mythical, probably not set in stone "cash out pattern" lol

Anyway, its not a good or bad thing, its not like we have better things to talk in a TnG thread, just an off handed comment

This post has been edited by Hoshiyuu: Oct 1 2021, 11:23 AM

Pretty good deal, I'm sold!

Good point, thanks for the reminder, I bought it too. At RM1, even if the wording is extremely terrible it's still worth it just for the peace of mind.

This post has been edited by Hoshiyuu: Nov 2 2021, 12:45 PM

TL:DR if the end result of your usage is basically using GO+/ShopeePay to perform 0% interest cash advance from your credit card, you will get fucked eventually, regardless of your intention or trying to play wording game with respective parties

Paid on 4 accounts, got RM5 on all 4 around 2pm. Sweet.

Not that stamps are any good this month at all...

Lasted way longer than I expected, I thought it'd run out before Jan.

Thanks TnG, this was a good campaign

I'm using Versa for mid-long term (~2-2.1%) and OCBC Frank for funds that might need to be withdrawn at a moment's notice (1.8%).

Though, to be honest, my OCBC Frank is empty most of the time. I mostly just put my money in Versa because the process is fast enough for 99% of the cases. My emergency fund is in there.

Troublesome conditionals. I don't like maintenance. So much work and attention to beat Versa by ~0.05/0.15%. I get way better discount and bigger cashback paying bills elsewhere too.

Just FYI the one you are talking to is extra special, better don't lump the rest of the participants together with that...

Since no one provided a good answer on this concern so far...

The industry practice is to "salt" and "hash" passwords before saving them. (You can know more by searching this term)

In laymen terms, hashing is a (basically) one-way transformation of any text to a fixed length encrypted text.


(Credit: Wikipedia User:Jorge Stolfi based on Image:Hash_function.svg by Helix84 - Original work for Wikipedia, Public Domain)

"ABC" will always transform into b5d4045c3f466fa91fe2cc6abe79232a1a57cdf104f7a26e716e0a1e2789df78 via SHA256 (a kind of cryptographic hash function)
"12345" will always transform into 5994471abb01112afcc18159f6cc74b4f511b99806da59b3caf5a9c173cacfc5 via SHA256

But it's nearly computationally impossible to turn b5d4045c3f466fa91fe2cc6abe79232a1a57cdf104f7a26e716e0a1e2789df78 back into "ABC"

So, by saving b5d4045c3f466fa91fe2cc6abe79232a1a57cdf104f7a26e716e0a1e2789df78 instead of "ABC", even if TnG staff has full access to the database, they can't actually know your password/pin, all they see is a useless line of text. (you can't feed this into a 6 digit field, can't you? )

---

But what if the hacker have a list of hashed password? Let's say he generated a list of hash based on common passwords, he already knows
"ABC" will always transform into b5d4045c3f466fa91fe2cc6abe79232a1a57cdf104f7a26e716e0a1e2789df78 via SHA256,
so he just search for b5d4045c3f466fa91fe2cc6abe79232a1a57cdf104f7a26e716e0a1e2789df78 and he will know that account password is "ABC".

This is where salting comes in.

We usually will add some arbitrary characters to all passwords to cause the hash to change. e.g. if your password is ABC, instead of hashing ABC, we "add salt":

TnGDBPassword+ABC = dad7b71dd5d586de059e5d4d2a9a18e2913ac095c8082b78f351fae5b701922e
TnGDBPassword+12345 = 7c18152350445b19e32792348bb0e47896f2a057155cecd19790e264cdb6c3ca

By changing even 1 letter/digit in the original text, the hash will be COMPLETELY different as you can see. It's not possible to guess by original password similarities.

Now the hacker can't just use the password list he have, because he shouldn't know what we salted the password with. (He'll need access to the source code)

---

By practicing these two practices, the person who can find out your TnG password has to have access to source code and database at the same time, this is an extremely privilege position - your typical CS staff most definitely do not have this level of access.

Now whether TnG actually practice this, I am not sure, but given the app is out sourced, it's most likely yes, they do. Plus this is the absolute bare minimum security to storing passwords.
Those hacked TnG account is simply due to user carelessness for using extremely obvious and simple pin - it's literally the first thing people would try on a 6 digit password.

We can employ as much technology as we want to secure things but we can't secure bad user behavior. If a user use 123456 as pin, no amount of encryption can prevent it from getting hacked. This is why 2FA via OTP is a thing, it brute forces security by assuming the pin is compromised, but the physical device receiving TAC isn't yet. But do you really want to insert PIN and wait for a TAC when paying 3.95 for your chips at 99 speedmart?

Hope that answers some concern on basic password security! I am happy to answer anything I can.

This post has been edited by Hoshiyuu: Feb 16 2022, 10:17 AM

Feel like I'm the odd one out here, used TnG eWallet since release, every month basically half my salary go into eWallet on first day of the month, had my emergency fund in Go+ the entire duration of previous promotion, bought rm1 walletsave because why not..., dont have auto reload, doesnt save credit card on TnG...

Going by thread sentiment I'm the dumbest person alive 🙁

1. Ah, I use it to pay my parents, since I advised them to avoid using physical money as much as possible due to covid. Then my day to day food and speedmart groceries are better done with TnG than credit card - if I wanted benefits from credit card, I just reload from CC one big lump sum and pay it off immediately anyway. My area is pretty much 95% TnG support pre-duitnow QR era.

2. I normally use OCBC Frank and latter on, Versa, now planning for Kenanga's 3%. Before this I used due GO+ having promotion rates that are better than my regular. At the moment I put in 3k in TnG again since, well, good rates up to RM3k.

I recall Hong Leong's 2.3% has quite some conditionals right? If it doesn't, I'm interested, I didn't go with OCBC HISA due to having too much conditionals.

Found a buddy Yeah same, I don't use cash anymore basically, I have like 5 piece of RM10 in my wallet that's been sitting there since.... start of 2021? Hahaha. So I just one shot dump into TnG, either direct or from credit card.

Like you say, won't make me rich, but I do appreciate a free meal now and then for spending <2min tapping.

I have quite a few CC that are all online spend focused, so I just lump-sum reload with those and cap the cashback instantly anyway (Like my CIMB e-CC caps at RM2k, so basically a good portion of my salary gone in immediately).

This post has been edited by Hoshiyuu: Feb 16 2022, 01:18 PM

Haha, thanks for the word of encouragement. I have received plenty of comments for being penny wise pound foolish for doing such stuff both IRL and online, and factually speaking I do quite literally am depositing 3k right now for what's basically 10-pack fishball over 2.5 months

So I'm trying to reflect on whether the criticism is valid or not recently, and try to see their perspective. That said, it's not like I make so much that I am above bending down and picking up RM10 off the floor...

This post has been edited by Hoshiyuu: Feb 16 2022, 01:26 PM

There's a pretty low retry limit...

The rates principal is offering is damn crazy. I randomly tried to apply for 5k, 12 month, the quoted interest rate is well over 21% lol, damn trap.

Meanwhile, TnG Duitnow have been giving me system busy for the last 3 hour like the piece of shit that it is. Imagine if I actually wanted to use it in a hurry.