Cyber Gangs Raise Profile of Commercial Online Bank Security 140
tsu doh nimh writes "The Washington Post's Security Fix blog has published a rapid-fire succession of investigative stories on the theft of hundreds of thousands of dollars from companies, schools, and public institutions at the hands of organized cyber thieves and 'money mules,' willing or unwitting people recruited via online job scams. Some businesses are starting to challenge the financial industry's position that they are not responsible for online banking losses from things like keystroke logging malware that attacks customer PCs. Last week, a Maine firm sued its bank, saying the institution's lax approach to so-called multi-factor authentication failed after thieves stole $588,000 from the company, sending the money to dozens of money mules. The same group is thought to have taken $447,000 from a California wrecking company, whose bank also is playing hardball. Most recently, the Post's series outlined a sophisticated online system used by criminals to recruit, track and manage money mules."
I like Bank of America's approach (Score:5, Interesting)
I have accounts at a few different financial institutions and have to say that despite all their other problems I think Bank of America has about the best two-factor authentication scheme I've seen so far.
Cell phones are extremely common these days, and BoA has leveraged that ubiquity. You can set up your account so that any time you attempt to log on the bank will send you an SMS text message with a totally random 6 digit number. You have to enter that number as you're logging into their website (along with your regular password). Since they're using an out-of-band method of sending you the random code the chances of it being intercepted are extremely small. And since it can only be used once then even a keylogger can't defeat it. The only type of attack that I think would work in this situation would be a man-in-the-middle attack, which is very unlikely as well.
Re:I like Bank of America's approach (Score:5, Interesting)
I can think of a *lot* of attacks on that. Most of them just as illegal as the intended crime...but...yeah... It's technically trivial to intercept SMS data. As it is, you can already see the fraud shops working around it--the new trojans send an alert to some amazon-turk type person in the middle of nowhere when you login, and just hide a window that gets relayed to them. While you're logged in, they can do very bad things...
Also, as somebody working in an industry that once depended on SMS. Let me tell you the service is ridiculously unreliable. How'd you like not being able to log into your bank b/c you couldn't get an SMS? In the US I can tell you from experience that any given vendor will have SMS "down" for about four days (total) a year.
Finally--even if it can only be used once, a keylogger can defeat it, unless only the last message is valid, and/or there's a rapid timeout. All I need to do is make the keylogger a little aggressive, and popup a box prompting you for *two* passwords. Of course, the first one actually goes to the bank--the second one crossposts to evil.com so I can login later today and drain you.
I realize--it's probably a "small" concern--but when you need your bank info--you often *need* it quickly.
Looks, there's a lot of *good* technologies out there to help filter this. The credit card companies use some of them. But in the case of banks, what's going on is outright criminal negligence that they refuse to fix.
Re: (Score:2)
Depends on what they are targeting, if they are targeting the money directly ... sure. If they are however targeting the bank and it's stock price things can get very ugly.
Lets say that at the moment there is yet another remote hole in windows making a large percentage of computers vulnerable. A hacker exploits that and installs trojans and instead of making a botnet logs bank transactions for a while, then with enough data it starts falsifying them but engineered in such a way to avoid heuristics. Best cas
So close ... and yet so FUCKED (Score:2)
It's a good approach, almost ... but it doesn't stop trojans at all. Why didn't they go the extra mm and make it secure? This is no better than the little calculator I have at home which generates a random number using my card and my pin, which doesn't stop trojans either.
What they should have done is send the transaction details and the confirmation code in the same SMS.
Re:So close ... and yet ... (Score:2)
I don't get it. How's a trojan going to read an sms off my cell phone?
Re: (Score:3, Interesting)
Not at all. Why should it? The trojan will just make YOU do all the work for it.
Scenario: You want to transfer 40 bucks to Aunt Bessy for that wonderful cake she sent you. You have one of those trojans in your box, though. This trojan got information from its maker that it should send whatever your account can possibly send without setting off alarm clocks at the bank to Mr. Hackme and sits quietly inside your box 'til the next time you log into your account.
"Fortunately" most banks conveniently display the
Re: (Score:2)
My bank requires me to enter a number before I can pay a new person. This number is generated by a little machine that accepts my card and requires me to enter both my pin and a transaction ID. It then generates a hash from these three pieces of information. I then enter this hash into the bank's page. If a trojan (or a MITM attack) tried to substitute a transaction paying Aunt Bessey to Mr. Hackme then my bank would require authorisation. If I've already paid Aunt Bessey then I would go on a different
Re: (Score:2)
You might get suspicious. But how many others will? Browsers frequently lose cookies or webpages change so people are used to having to reenter their credentials every now and then, even if they already entered them. How many will simply write this off as "heck, every time the bank changes something I have to go through this hassle"?
Re: (Score:2)
The trojan will intercept the 6-digit code mentioned above when you type it into the computer.
And do what with it? Squirrel it away to be used later, when it's no longer valid?
Re: (Score:2)
Or it'll let you log in and quietly submit a transaction on your behalf every minute or two while you're logged on.
Re: (Score:3, Informative)
Just for instance ... it can connect to a server, retrieve a transaction from it and validate it with the key you just entered. The server at the same time sends off a couple of SMS to money mules.
Automation is the key.
Re: (Score:2)
"What they should have done is send the transaction details and the confirmation code in the same SMS."
Re: (Score:2)
What they should have done is send the transaction details and the confirmation code in the same SMS.
Which is exactly what the Commonwealth Bank of Australia does.
Whenever you try to do anything 'serious', e.g. transfer money to someone new, change your details etc, you have to enter a code they'll send you by SMS. This SMS will briefly say what you're trying to do, e.g. a part of the account number you're sending money to. It's fast and doesn't get in your way unless you're doing something potentially dangerous
Re: (Score:2)
Glad to hear some banks get it right ... a bit too far out of my neck of the woods unfortunately.
Re:I like Bank of America's approach (Score:4, Insightful)
As Bruce Schneier recently pointed out [schneier.com], MITM attacks are now much more common, and likely to become widespread.
Now, if they used that cell phone message to authenticate the exact transaction you are performing, you'll be much more secure.
Of course, if it's too easy to update the cell phone number, all bets are off.
Re:I like Bank of America's approach (Score:4, Informative)
Re: (Score:2)
Re:I like Bank of America's approach (Score:4, Informative)
To successfully transfer funds out of your account, they would need you to authenticate via SMS twice - once to login and once to authenticate the transaction. If you know you haven't authorized any transactions, you simply should refuse any further authentication attempts.
I suppose they could make it appear that the original attempt failed. However, that should raise enough suspicion to cause you to log off. In addition, they would have to correctly guess your SiteKey image to attempt the attack. When you login, Bank of America displays a unique image of your choosing to ensure you're at the authentic site.
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Therefore, even a non-security conscious person should be very suspicious when their banking site asks them to authenticate via SMS due to a session timeout when they have never had to do so in the past and their only use of SMS in the past resulted from significant financial transactions.
Perhaps I expect too much from Joe Sixpack.
I think BoA is doing a reasonable jo
Re: (Score:2)
Re: (Score:3, Interesting)
Since I worked for banks with exactly this problem, I can reassure you that even if they aren't responsible for the losses, they have a very keen interest in making the whole deal secure: Cost.
You have NO idea how much money banks save by shifting the work of transfers to you, their customer. Banks shut down a lot of branches and laid off a lot of people because they don't need so many brick and mortar outlets and tellers anymore. Now imagine people lost faith in the security of online banking, to the point
Re: (Score:3, Interesting)
Re: (Score:2)
Since I worked for banks with exactly this problem, I can reassure you that even if they aren't responsible for the losses, they have a very keen interest in making the whole deal secure: Cost.
You have NO idea how much money banks save by shifting the work of transfers to you, their customer. Banks shut down a lot of branches and laid off a lot of people because they don't need so many brick and mortar outlets and tellers anymore.
And this is primarily due to online banking, rather than ATMs?
Now imagine people lost faith in the security of online banking, to the point where they consider it untrustworthy enough to demand their human monkeys again to do their work.
And the banks say "Sure thing! That'll be just $5 per transaction!"
Furthermore, banks could not even easily return to brick and mortar transactions if everybody suddenly stopped using online banking, some banks are by now very dependent on online banking, to the point where they would quickly lose customers simply because there are no local branches anymore.
As others have pointed out, they'd *also* lose customers if they actually made online banking secure.
Think about it: first, they have to make things less convenient, because frankly, convenience and security are inversely proportional. That will lose them customers right off the bat.
But as several posters have pointed out, that's not enough... because people don't know how to ke
Re: (Score:2)
Quite the opposite. Have a few people pay for their convenience and ignorance and you'll soon see people not only ask for but outright demand tight security.
Re: (Score:2)
I think you do expect too much. Considering that people sent out a barrage of transaction IDs due to an email telling them to do so or their bank account is going to be terminated, I think people would not get suspicious if they suddenly got an SMS from their bank that they never requested. They will just think their bank changed the security setup, maybe even consider it a good sign that the bank is working on improving security, and play along.
Re: (Score:2)
If the SMS message told you exactly what you were authorizing, it would go a long way towards defeating this kind of attack.
Exactly. And moreover, the attacker could always wait for you to submit a legitimate transaction, and submit his own (with different recipient, and different amount) instead. How would you spot that without the transaction details contained in the SMS?
Re: (Score:2)
What if you want to authorize a transaction but they just change the transaction to one they had already lined up earlier?
Re: (Score:3, Interesting)
they would have to correctly guess your SiteKey image to attempt the attack
They won't have to guess. If they've placed a MITM or rooted your windows box, they can just ask the bank in your name to supply the correct image.
Re: (Score:2)
So no one without a cellphone can have a BOA account?
Re: (Score:2)
How many people do you know who have internet access but no cellphone?
Re:I like Bank of America's approach (Score:5, Informative)
https://www.paypal.com/securitykey
As for the alternative of getting in my answering the security questions for the account, I have used very hard to guess made up answers for the stupid security questions (I did not use real information).
An employee at the bank, where I have my checking account, recently suggested that I should do online banking. First I asked him if that would work with my computer which runs Linux, intead of Windows. He said Linux would work just fine. I then mentioned my concerns about security and the fake phishing emails that I get, which claim to be about my online banking account at their bank. I said, you know the ones that want me to click on some long complicated looking URL going to some foreign country, and then probably have me log-in and give them my user name and password. He said, "yes just ignore all of those fake email messages."
I also mentioned my concerns about keystroke loggers, although I added I have probably managed to secure my Linux computer, better than most average computer users do. However, a keystroke logger might still a slight possibility, even for my Linux computer, so I knew I wanted the additional protection of multi-factor authentication. I pulled my security key out of my pocket, and asked him if they offer two-factor authentication, using something like this. He said the did not offer anything like that. I told him that I would not feel comfortable doing online banking with them, because they do not offer multi-factor authentication.
Two-factor authentication may not be totally perfect, because most forms might still be vulnerable to a man-in-the-middle attack, but it would still be a major upgrade to their security. The cell phone plus 6-digit number in an SMS text message technique, that you said Bank One is using, also sounds great.
Re: (Score:2)
I have a PayPal security key on my key chain
You are securing yourself against the wrong people.
Paypal have the habit of demanding payment for some non-existing debt and cleaning out every account and credit card they can access.
Re: (Score:2)
I do not actually use PayPal very much, except for occasionally using that as the method of payment on web sites which offer PayPal as an optional method of paying. I have never actually yet tried using PayPal to purchase something from another individual over the Internet (which is probably what most people use PayPal for). I really have not yet us
Re: (Score:2)
Bruce suggests authenticating the transaction instead of authenticating the user, although at least in the article below, he does not give any details about how exactly to do that.
http://www.schneier.com/blog/archives/2009/0
Re: (Score:2)
The only downside is that Paypal is not a bank. So they charge usury rates and aren't FDIC insured and have a whole host of banking regulations they somehow aren't bound by.
Re: (Score:2)
If done well, this is quite neat: raises the security without adding a cost.
Re: (Score:2)
A security key will defend you against others stealing your passwords and trying to pose as you, but it cannot defend you against a MITM attack inside your box. You will simply just authenticate the bogus transaction. A trojan that manipulates your data on the fly, which does exist in the wild and has been widely used since the advent of security keys, will not be thwarted by this.
Re: (Score:2)
Re: (Score:3, Insightful)
I think as we see an increase in cellphone usage for common internet tasks, the "out of band" benefits of this scheme are going to be lost for many people.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The only type of attack that I think would work in this situation would be a man-in-the-middle attack, which is very unlikely as well.
Actually, those attacks are some of the most relevant in Europe, where they've been doing that sort of stuff for a while.
Although, strictly speaking, it's more 'man at your end', where they simply put trojans on systems that wait for you to, entirely legitimately, log into your account, and then simply send some money their way from your now-authenticated web browser.
Re: (Score:2)
Just for logging in? No security at all.
The attack is inside your computer, manipulating the data that is sent between you and the bank, showing you bogus information. I have first hand proof of malware that does indeed manipulate the transfered amount and target account while displaying to you the correct account and amount.
So unless the transaction itself is two-factored, i.e. you get an SMS with an authorization code for this specific transaction, sending not only the code but also the target account and
Re: (Score:2)
I just did this on BoA's site. The problem is, once you're in the website, you can set up the SMS message thing. So your attacker gets in, changes it to send the SMS to a burner phone, or a Google Voice account, and your security is sidestepped. So what was the point again? The $20 device you can buy is a better option, but I don't want to pay for it, so I'm using the bogus option.
Cahoot in the UK (Score:3, Interesting)
I emailed Cahoot about a flaw in their system, about 5 times as it happens, over a period of months, but only ever received stock replies. What happens is: you attempt a login with username/password. Then you get to a screen where you select 2 letters from a second password via drop down boxes. If you get that second page wrong a few times it tells you that your account is locked and you have to contact them. But you don't - your account is not locked. You can simply attempt another login. So if you know someone's username/password (username is visible when someone logs in so you just have to know their first password), then you get as many guesses as you like of their second password, and it doesn't vary the 2 letters it wants from that one. The drop down list gives a-z and 0-9. 36 * 36 isn't very many guesses to have to attempt.
Wow ... (Score:2)
Why do you bank with them?
Online banking with a single factor security is silly (two passwords are not two factors). I don't feel entirely safe with the code calculator my bank gives, but at least I know how to recognise large transactions (you can see by the way you have to enter the website verification number, not that they tell you that) so trojans could only ever hijack a small transaction.
Re: (Score:2)
I can haz lurid sensationalist hedlien? (Score:2)
Oooh, yooz no eeted it!
kthxbye!
P.S.: See, even the cats notice it!
Sweden rocks (Score:2, Informative)
Depending on your bank in Sweden, you either got:
* A user/pass combination that you input on their website. You then get a code that you input on a personal code generator thingy, and you get another code back that you enter on the website. (Downside: You need your code generator with you)
* A user/pass combination and one-time-use codes that you scratch off a card that you carry with you. (Downside: You gotta order more codes after a while)
* A digital ID encrypted on file, and a password that decrypts it. (
Re:Sweden rocks (Score:4, Interesting)
In Britain you get
Username (the most difficult thing to remember), password, and some top secret information like Mother's maiden name or date of birth.
Or, some banks, mainly in the HBOS group, will send you a code by text message which you have to enter into the website. This is vulnerable to man in the middle attacks
Some banks (Royal Bank of Scotland Group, Nationwide, Barclays) have a calculator sized device where you insert your debit card, type in your debit card pin number and a number displayed on the website, and get another number off the device which you enter into the website. Again, this is vulnerable to man in the middle attacks and apparently other sorts of attacks as well.
Re: (Score:2)
But some trojans work in real time with someone in the middle controlling it over IM and are targeted at specific banks. It could replace the number on the website with another one for the money mule account details.
Re: (Score:2)
That would only work if the customer does not know the number of the person receiving the money. For larger transaction amounts the Dutch Rabobank requires you to fill in the total transaction amount as well. At first they forgot to notify the customer of the meaning of the number, rendering it mostly useless (and also showing how clueless even banks can be). Of course, this does not mean the money will be made out to the correct account at all.
I'm personally thinking of creating a USB stick or hard drive w
Re: (Score:2)
Barclays in Britain does in fact do this too.
No thanks, nanny bank (Score:3, Insightful)
Some businesses are starting to challenge the financial industry's position that they are not responsible for online banking losses from things like keystroke logging malware that attacks customer PCs
How exactly is this the banks' responsibility? And if is a bank's responsibility, are they going to go into my PC to fix it?
Re:No thanks, nanny bank (Score:4, Insightful)
Re:No thanks, nanny bank (Score:4, Informative)
" ... The point is that as long as banks are not responsible for the losses, they have no incentive to implement strong security measures on their websites. ..."
Actually, it goes beyond that. As long as banks are not responsible for the losses, they have an incentive to weaken security in order to maximize the number of clients in the available pool of clients, who actively online bank.
This lowers the cost of running the bank and therefore maximizes profits (which cannot be impacted by pesky requirements to provide compensation for breaches and customer losses via weak security).
Re: (Score:2)
The problem is that you want the bank to secure what they cannot secure: Your PC.
I do not know of a single case of bank fraud where the fraud has been in any way connected to a security breach on the bank's side, and due to my work I know of a fair lot of fraud cases. Invariably the problem was on the customer's side. Either he willingly surrendered credentials to a con artist ("log in to this site NOW or your account gets frozen") or his machine has been compromised and either his credentials were logged a
Re: (Score:2)
It's very similar to credit cards. Banks are on the
Re: (Score:3, Interesting)
The other problem is that the banks shunt *all* responsibility onto you. My parents were kind enough to begin investing in a mutual fund (for retirement..but not actually a retirement account) for me...when I was a child. That's some foresight. Not a lot of cash--I've already saved more in five years of working--it was mostly about teaching me the values of savings.
In order to gain access to my account online and be able to manipulate things without a *ton* of paperwork, they require a form absolving th
Re: (Score:2)
Because the banks are the best placed to fix it.
Re: (Score:2)
And if is a bank's responsibility, are they going to go into my PC to fix it?
Here in Luxembourg, some banks actually force you to have an insecure PC. So yes, in that case they should take responsibility if it gets broken into.
Re: (Score:2)
Pardon? Could you elaborate on this? This sounds like something I want to write an article about.
Go after microsoft (Score:5, Interesting)
Re: (Score:2, Interesting)
I disagree. Software vendors should not be accountable for their bugs, unless they agree to be accountable for them.
from WinXP EULA [microsoft.com]:
Well I was going to put a quote from the EULA here, showing the disclaimer of warranty, but slashdot doesn't like all caps, and wouldn't let me. It says:
Filter error: Don't use so many caps. It's like YELLING.
The GPL [gnu.org] also has a disclaimer of warranty, but slashdot wouldn't let me include that either.
Re: (Score:2)
And also, food vendors should not be accountable for contamination, unless they agree to be accountable for it.
Re: (Score:2)
Re: (Score:2, Troll)
I'm concerned of the potential that malware has to disrupt civilian systems from stuff like waste treatment all the way to energy facilities. The same vulnerabilities that allow your bank creds to be pwned are the same one that could be used to disrupt systems we need for heat or clean water. There neds to be stiffer penalties for neglecting to fix security problems.
Er, no. The fucktards that connect water, power, or sewage systems to the public Internet need to be taken out behind the chemical sheds and shot in the back of the head.
Re: (Score:2)
Hey, they learned from the best. After all, when God created humans, he connected the recreation center right to the waste disposal area.
Re: (Score:2)
Hey, they learned from the best. After all, when God created humans, he connected the recreation center right to the waste disposal area.
That is an example of obsessive reuse of code, and repurposing it for something for which it was never intended.
Re: (Score:2)
Re: (Score:3, Insightful)
How is MS or any vendor of computer hard- or software responsible for user stupidity?
Most of current malware infections are not due to an OS blunder or faulty software. It's social engineering, getting the user to launch a program he better not. From the obvious ones where you get an email from LAWYER telling you to open this attachment immediately and act OR ELSE, to the less obvious ones where you install a "crack" for something that also quietly installs a rootkit.
How could any OS avoid this? By requirin
survival of the fittest (Score:3, Insightful)
My two cents
1) Why should the bank be held responsible for something that is clearly the customer's responsibility? I.e. securing their fucking computer?
2) Maybe this will encourage folks to keep their computers locked down.
Mind you, I think that the bank should bend over backwards to help catch the bad guys. However, they cannot and should not be expected to police their client's computers...and likewise expecting them to pony up for something they can't prevent is also unfair.
The real enemy in this case, as usual, is the crook that did the hacking in the first place.
mod up (Score:2)
Re: (Score:2)
My two cents
1) Why should the bank be held responsible for something that is clearly the customer's responsibility? I.e. securing their fucking computer?
2) Maybe this will encourage folks to keep their computers locked down.
Mind you, I think that the bank should bend over backwards to help catch the bad guys. However, they cannot and should not be expected to police their client's computers...and likewise expecting them to pony up for something they can't prevent is also unfair.
The real enemy in this case, as usual, is the crook that did the hacking in the first place.
They can prevent it - or at least make it orders of magnitude more difficult for would-be thieves.
It's a really simple security principle, something you know , and something you have .
The what you know bit is what we're all used to, the username and password.
The what you have is some physical device that generates an additional security key - or a digital signature for your transaction. What I got from ING was a DigiPass. You need to know a five digit PIN to use the device, at login you push the "I
Re: (Score:2)
Problem is where? A simple browser plugin can manipulate the data your get shown and the data that gets sent, before or after being encrypted, just as you need it.
DigiPass or other forms of keychain-keylocks are useful to ensure nobody can log in but you, but they are not useful to ensure that no data manipulation takes place.
Yeah it's not like security is the banks' job ... (Score:3, Interesting)
Say the bank does not implement basic security measures such as monitoring brute force attempts, and someone brute forces your account ... how are YOU gonna prove you didn't just post your password on myspace? You can't! Only the bank can! It's better to put the burden on them, and have them, in turn, enforce security measures on the clients, because the other way around cannot work, and would screw over even the few of us who have a clue about comp.sec.
Also, I would like to take this opportunity to point o
Re: (Score:2)
Care to explain what "security measures" they should enforce on the client? Take control of his computer? Because anything short of this means that the bank cannot enforce anything.
Would I care to? (Score:2)
They've already been mentioned: multi factor auth, out of band notification and confirmation (SMS, snailmail, phone), intrusion detection among other things.
If the bank does not implement those, there's nothing you can do. So having the customer bear that burden is pointless.
Re: (Score:2)
How about doing something odd: Choosing a bank that offers better security.
Why not let good ol' free market do its job. Banks with crappy security will cause their customers to lose money, that will instill fear in other customers, they will switch banks (or lose money, their choice), thus customers will see security as the key criterion when it comes to choosing the right bank to do online banking with, thus banks will not only implement better online banking but actually draw attention to their superior o
And how can you evaluate a bank's security? (Score:2)
That's the part that makes the libertardians' dream of everything in a market a complete joke. You don't have access to that information. You CAN'T look at the god damn bank's web site design papers, or their source code or something.
So I don't know why you're even bringing this up, because on top of that, 99.9999% of all bank customers (i.e: everyone) is incapable of evaluating a bank's computer security even if they had access to this info.
Contrast this to putting that responsibility into the bank's hands
Re: (Score:2)
You're not able to audit online banking code. True. But are you dumb, deaf and blind? Do you think people will remain silent when their bank refuses to cover their loss? Don't you think some media outlet would greedily gobble up the story? The media live of angst, fear, doubt and horror stories, and if anything is one in this time and age, it's the loss of your life savings. They'll offer people to cover their loss for a tear soaked story of how horrible, horrible the bank was and they'll bring in some expe
Most banks in Europe ... (Score:2)
... have stronger regulations than in the US.
For example there is no subprime bullshit in my country, because the courts have consistently upheld the notion that when a banker lends money to someone who couldn't possibly pay back, it's their own fault because it's their job to find that out in the first place. They can suck their credit up.
So they don't lend to deadbeats. Sure, it's harder to get a loan, but there was no subprime bullshit here.
Re: (Score:2)
Basel II? The regulation that ensures you only get a loan when you don't need one?
What if banks distributed live CDs to customers? (Score:2)
After reading the articles and this thread, I began to wonder whether banks should start distributing a read-only live-CD distribution that only contains the software needed to conduct online banking. In order to bank online, you'd have to reboot with the live CD. This eliminates the possibility of installed trojans and similar malware that might reside on the computer's hard drive.
Obviously this is going to be seen as a pain in the neck by consumers, but maybe it makes sense for commercial accounts? Giv
Re: (Score:3, Insightful)
1) The security of financial transactions isn't "clearly the customer's responsibility" .. it is a problem that exists because there are two parties. The bank is one. The customer is the other. Both can take steps to reduce losses. Customers can secure their fucking computers. Banks can secure the fucking web page. Neither party will capture all of the gains from improving security. So, to answer your question.. banks should be held responsible (for some, perhaps most, but not all) of this type of security
Re: (Score:2)
Yes, let the security hinge on the real experts, the users! If you think this reply is too ironic, wait for my reply to the first one to propose to educate the users.
caveat (Score:2)
I do, of course, advocate that banks (or any other organization handling sensitive information) do all they can to secure their sites.
* SSL certs
* HTTPS encryption
* DNSSEC
* whatever else
That goes without saying. But after the bank has done all it can to keep things secure, it's really not their fault if an end user gets their machine pwned.
And putting the bank into the position of covering for losses they can't prevent is effectively forcing them to provide free insurance.
Re: (Score:2)
My two responses:
Or, in other words, there should be responsibility and accountability on both sides of the exchange.
Re: (Score:2)
I agree.
Case 1 is entirely bank responsibility
Case 2 is where the bank is responsible by default thanks to limitations of liability.
What I disagree with is a customer with a malware infested machine getting freebie insurance from the bank.
My opinion:
The bank is presumably liable for all unauthorized transactions, but can escape liability if they prove the consumer was negligent. And having an insecure machine should be considered negligente.
Re: (Score:2)
Re: (Score:2)
That's either trivial or impossible, depending on how you implement it.
If you let the bank go free if they can prove that your credentials issued an order, it's trivial. They log that already. I've seen those logs and I can tell you, paranoid doesn't even come close to describing WHAT they actually log. Every click you do on a bank webpage is logged. So it's trivial for them to follow the trail of every single transaction.
If they have to prove without doubt that your machine was compromised when the fraud t
Live CDs (Score:2)
Stories like these make me glad I only log in from a Ubuntu LiveCD that I boot up solely for that purpose.
The problem is... (Score:2)
The problem IS THE BANKS! ...create the next foolproof system, it could very well be, find a way to disassociate yourself from the responsibility of
No matter how you look at it, the simple fact that their stance on identity theft and fraud prevention is this, what ever costs them less to maintain a working capital. If this capital goes down too much then they get driven to find a way to bring that back, however this might not be
being in control of your client's transactions.
Did you know that the banks do no
I have to agree but..... (Score:2)
Wouldn't it be funny to see the wrecking company play hardball with the bank [wboy.com] as payback.
Re:Hmm (Score:4, Insightful)
Re: (Score:2)
...your personal financial advisor from the bank will call you directly to verify...
Your bank has personal financial advisors? I don't think I've ever talked to the same person twice at my bank.
What bank is that?
Re: (Score:2)
Could be any European Bank I dealt with in the past.
With my bank I get a call from my personal financial advisor when:
- A transaction takes place that goes beyond a set limit (you get to set it, so if you constantly transfer multiple 1000 of dollars, you don't get called every time. That limit is kept secret)
- A transaction is sent abroad to a country or account (choice is yours) you usually do not deal with.
- A transaction is issued from abroad (i.e. a foreign IP address is using your account). Can be set