Banking Via Twitter? 193
In the latest example of how just because you can do something doesn't mean you should, one credit union has decided to offer a new feature, dubbed "tweetMyMoney," that allows members to interact with their accounts via Twitter. Can't wait for the next version, "tweetSomeoneElsesMoney." "tweetMyMoney, available exclusively to Vantage members! With tweetMyMoney, you can monitor your account balance, deposits, withdrawals, holds and cleared checks with simple commands. And, you can even transfer funds within your account. It's all available on Twitter, 24/7!"
two words (Score:5, Insightful)
Transactions need 3 elements to be safe... (Score:4, Insightful)
1. Target needs to be authenticated to the user. This should require some positive action, as opposed to relying on certificates which are mostly ignored and whose provenance is not as strongly assured as was initially advertised.
2. Customer needs to authenticate to the target. Passwords are not enough since humans can remember approximately 1 password only, and only if they use it constantly. The authentication should change and replays should be rejected.
3. Customer must affirm details of the transaction before it is committed. This too must use some method that is changeable and disallows playback.
Ideally a transaction will have all these elements in one idempotent package, the way for example a check might if the signature were a better biometric than it is and if the signature were checked always. That is however technically awkward on a net, so the 3 elements listed may need to be separately done. Omitting any of the elements allows different classes of attacks. If all the elements are present and tied together, attacks become very hard. Also, note, step 3 makes it largely irrelevant whether the customer is declared not-present afterwards or not. It serves also to terminate the transaction. Whether another transaction is begun or not is for the most part immaterial. (A method I have advocated to accomplish these would allow several transactions to be tied together if desired, in one session, but there would always be a "signature" or "affirmation" step for each, even if the initial authentication steps were recent enough to continue to use them.)
This needs hardware. However it can be done very cheaply; the hardware needed can in quantity be had for perhaps $3 a copy, possibly less, even as electronics. Paper approximations could be far cheaper still.
Better hope that it's secure. (Score:4, Insightful)
This seems like a GREAT way to lose all your money quickly.
I guess after it happens, you'll at least have something to really tweet about (as opposed to the fact you bought the new Brittney Spears album - no one cares!).
"See anything seriously wrong with this story?" (Score:5, Insightful)
How about the very idea of banking by twitter? What twit thought THAT one up??
I don't need Twitter for that -- I just call the bank and talk to a human.
Now we see why the banking industry is so screwed; it's run by morons.
Re:two words (Score:2, Insightful)
What's so bad? (Score:4, Insightful)
Lots of OMGWTF!!! responses here, but having looked over the information they're providing (balances, holds, cleared checks, etc) and noting that there's no transmission of account numbers, PINs or other identifying information, I'm not seeing a major problem.
Just because you can have a knee-jerk reaction doesn't mean you should.
List of banks? (Score:4, Insightful)
Is there a list of banks that support this? Just so, you know, the intelligent people can move their cash OUT of these banks?
Not seeing the point (Score:4, Insightful)
I don't see the point of the service, but then I don't use Twitter.
I also don't see the point of all the critics. Everyone alludes to how easily someone can steal your money with this. Ok... how?
I see a bunch of functionality where you can monitor your account status. The only thing I see that mentions affecting your account status is transfering money within your account. I guess that's enough that you could mess with someone, but where's the profit motive? You're going to commit wire fraud just to piss someone off?
Re:What's so bad? (Score:3, Insightful)
Let me show you why this is a bad idea. Even if it is just 'check 153 cleared' or 'ATM: amt withdrawn 300 dollars'.
'Hi this is XYZ from ABC credit agency we see that you have 300 dollars cash right now in your hands and you owe us 2389 and 48 cents please swing by and pay us'.
Or how about
'Hey I know where Jim lives and he has 300 in cash on him right now lets go rob him'.
Or how about
'We can glean information about peoples bank accounts from their twitter accounts and then connect it thru advertising' 'Monkey sees you have 1835.38 in your account isnt it time to buy that new plasma TV?!'
See why giving this sort of information away is a bad idea? Perhaps *YOU* can not think of anything bad to do with it that doesnt mean others cant connect the dots and do douchy things with it, and they will.
Judge Orders Twitter Acct. Disabled (Score:5, Insightful)
Re:Not seeing the point (Score:5, Insightful)
Why would you purposely introduce another entity between you and the bank? A decidedly non-secure entity.
Re:"See anything seriously wrong with this story?" (Score:3, Insightful)
"Welcome to [...] telephone banking. Please enter your account number, followed by hash"
beep boop beep biip boop beep beep boop baap
"Please enter the fourth digit of your PIN"
boop
"Please enter the last digit of your post code"
beep
"In the word 'money', 'N' is in position three. In your password, what position is 'F' in?"
boop
"Your balance is £1234.56. Press 1 to..."
I feel more comfortable communicating with a robot.
(Having said that, I've only ever checked my balance. I'm not sure I'd do anything more than that over an unencrypted channel.)
Re:What's so bad? (Score:3, Insightful)