3 ms·

Optimised to Fail: Card Readers for Online Banking

15 points by zacharyvoase 17y ago

jacquesm 17y ago
Thank you, that was a most interesting read. This is my way of dealing with these issues: - use a unix box rather than a windows machine to conduct online transactions, reducing the chance of having malware on the system - never use an the authorization token from someone else, just my own, which I treat roughly the same as any other valuable - get a new one directly from the bank once every year to avoid wearing down the keypad so the pin numbers stand out - always type in the url of the bank in full and verify that again when authorizing transactions - check the list of outstanding transactions that I'm authorizing to make sure the amount and beneficiaries match The things this still leaves me vulnerable to are man in the middle attacks impersonating the bank website, at a minimum this would require poisoning the DNS of the provider, another trick would be to install a keylogger, but this would only get the attacker a bunch of one-time codes (which could presumably be used to recover the pin in combination with the challenges). And of course nobody can rule out a brutal attack on my person to get possession of the PIN code, and I expect that such attacks will increase in frequency.
- axod 17y ago
  >> "get a new one directly from the bank once every year to avoid wearing down the keypad so the pin numbers stand out" You could just get into the habit of: * Put in card, type in PIN * Take out card, press every digit that isn't in your PIN. If you have a repeated digit in your pin you might need to press them all twice etc.
  - jacquesm 17y ago
    hehe, that's clever :) How about simply erasing all the digits then, after all the standard phone pattern is something that is easy enough to memorize.
barrkel 17y ago
Particularly disturbing is the implication that the portable card readers distributed by the banks (we have four here in my house alone) can be used by muggers etc. to verify PINs being stolen at knifepoint (or gunpoint, as the case may be), and already may have been involved in past murder and torture cases.
- jacquesm 17y ago
  It was a fairly obvious thing too, when they were suggesting finger print authentication one of the first snags to come up was 'how do you detect if the finger is still attached to the human it was born on'. The bank teller had a function other than just being a cost on an itemized list, they were people and people are good at spotting unusual patterns. Once we switched to ATMs and now to online banking the pin taking the place of your digital signature the push is on to make you the responsible party for your bank balance, even though the banks could (and should) take more responsibility and actions to safeguard your balance. Even velocity controls are not adequate, as the torture case clearly shows. But then again, in times before all that came to pass it was possible to take your family members hostage while you visit the bank too. It's just that now we don't need you to go to the bank (and potentially alert the police) but all we need is four digits. After that you are literally disposable.
  - barrkel 17y ago
    The annoying thing is that a very simple mitigation against this attack is possible - don't indicate an error upon entry of a bad PIN. Even better is a duress PIN.
    - jacquesm 17y ago
      Yep. Convenience is another reason for this probably, I guess the banks did not want to deal with people that have managed to 'lock' their pin card but aren't aware of it.
- patio11 17y ago
  already may have been involved in past murder and torture cases. This is the very definition of a movie plot threat: it makes for gripping drama, but is less effective and far more risky than just doing the traditional thing and saying "I'm Bank of America. What is your PIN number?" to as many people as possible. I would be astonished if "tortured for your two-factor identification" was even visible next to old stand-bys like "killed for cash/jewelry/sneakers."
scotty79 17y ago
In my bank one time passwords do a very good job. Of course I rather avoid doing banking from windows.

15 points by zacharyvoase 17y ago

Thank you, that was a most interesting read. This is my way of dealing with these issues: - use a unix box rather than a windows machine to conduct online transactions, reducing the chance of having malware on the system - never use an the authorization token from someone else, just my own, which I treat roughly the same as any other valuable - get a new one directly from the bank once every year to avoid wearing down the keypad so the pin numbers stand out - always type in the url of the bank in full and verify that again when authorizing transactions - check the list of outstanding transactions that I'm authorizing to make sure the amount and beneficiaries match The things this still leaves me vulnerable to are man in the middle attacks impersonating the bank website, at a minimum this would require poisoning the DNS of the provider, another trick would be to install a keylogger, but this would only get the attacker a bunch of one-time codes (which could presumably be used to recover the pin in combination with the challenges). And of course nobody can rule out a brutal attack on my person to get possession of the PIN code, and I expect that such attacks will increase in frequency.

axod 17y ago
>> "get a new one directly from the bank once every year to avoid wearing down the keypad so the pin numbers stand out" You could just get into the habit of: * Put in card, type in PIN * Take out card, press every digit that isn't in your PIN. If you have a repeated digit in your pin you might need to press them all twice etc.
- jacquesm 17y ago
  hehe, that's clever :) How about simply erasing all the digits then, after all the standard phone pattern is something that is easy enough to memorize.

barrkel 17y ago

Particularly disturbing is the implication that the portable card readers distributed by the banks (we have four here in my house alone) can be used by muggers etc. to verify PINs being stolen at knifepoint (or gunpoint, as the case may be), and already may have been involved in past murder and torture cases.

jacquesm 17y ago
It was a fairly obvious thing too, when they were suggesting finger print authentication one of the first snags to come up was 'how do you detect if the finger is still attached to the human it was born on'. The bank teller had a function other than just being a cost on an itemized list, they were people and people are good at spotting unusual patterns. Once we switched to ATMs and now to online banking the pin taking the place of your digital signature the push is on to make you the responsible party for your bank balance, even though the banks could (and should) take more responsibility and actions to safeguard your balance. Even velocity controls are not adequate, as the torture case clearly shows. But then again, in times before all that came to pass it was possible to take your family members hostage while you visit the bank too. It's just that now we don't need you to go to the bank (and potentially alert the police) but all we need is four digits. After that you are literally disposable.
- barrkel 17y ago
  The annoying thing is that a very simple mitigation against this attack is possible - don't indicate an error upon entry of a bad PIN. Even better is a duress PIN.
  - jacquesm 17y ago
    Yep. Convenience is another reason for this probably, I guess the banks did not want to deal with people that have managed to 'lock' their pin card but aren't aware of it.
patio11 17y ago
already may have been involved in past murder and torture cases. This is the very definition of a movie plot threat: it makes for gripping drama, but is less effective and far more risky than just doing the traditional thing and saying "I'm Bank of America. What is your PIN number?" to as many people as possible. I would be astonished if "tortured for your two-factor identification" was even visible next to old stand-bys like "killed for cash/jewelry/sneakers."

scotty79 17y ago

In my bank one time passwords do a very good job. Of course I rather avoid doing banking from windows.