5 ms·

>>> My view concerning your request: no. is probably the best response for the request. On a related note though, it's always amazing how on one hand Big Bank

>>> My view concerning your request: no. is probably the best response for the request. On a related note though, it's always amazing how on one hand Big Banking tries to show that it's in touch with the latest tech developments (Bitcoin Consortiums, RFID/NFC payments) etc. but on the other hand display a very shallow understanding of how secure systems should work.

viraptor 10y ago
I think that's a very biased way of looking at this request. They don't necessarily have a shallow understanding. They have a set of very strict rules they have to obey. If that means no privacy for the employees, then they have to implement no privacy for the employees. The reasoning of the author has been explained pretty well in my opinion. But that's completely orthogonal to the understanding how the secure systems work.
- usgroup 10y ago
  Indeed, orthogonal. I think it's a denied attempt to connect cross-purposes. I.e. design for security with practicalities of implementation in a broader context. I notice some posts argue that we should aim for a pareto-optimum and accommodate the banks, but really this should require a broad representation for the rest of the subjects of TLS 1.3 to work out exactly what the pareto would look like. Given that they are 15 drafts in, it seems to me that there has been ample opportunity.
rdtsc 10y ago
I call it paper security or checklist security. Usually it is about implementing enough to check off a list of requirements from some document. Antivirus installed? Check (Nevermind it is a Linux box and AV loads a dubious proprietary driver in the kernel with a huge attack surface and remote exploit posibility because of how it does updates), such and such EAL-4 operating system intalled? Check, and so on ... So they tick all the boxes and in the end up with a worse off posture than if they just stayed with defaults for example.
- drvdevd 10y ago
  Right. And at the end of the day, skilled attackers can either: a) not care if you decrypt their traffic as they're already in your network and it's too late by the time you're reviewing the incident or b) take a copy of your checklist and say, "well here's something they'll probably never figure out" A little out of the checkbox thinking goes a long way for attackers. It could for enterprises too if they could overcome their inertia.
  - digi_owl 10y ago
    Best i can tell, quite a bit of the checklists comes from insurance companies and government regulations. Meaning that if something hits the fan and the company has their checklists in order, then they can be exempt from liability.
- matt4077 10y ago
  As far I remember, major banks have been rather secure in the last decades, especially compared to the hipster hackers at Yahoo/Dropbox/github/.... So maybe their checklist is worth a look.
  - rdtsc 10y ago
    You're right, that's fair. I can't remember a large bank was hacked as to where their customer's money was stolen or anything like that. It is usually retailers and such.
- jpgvm 10y ago
  We call them "CISSPs" where I have worked. It's a mostly derogatory term for whiteboard warriors of the security world. They usually have a CISSP but no other valuable security background, most certainly aren't programmers and have never even played with Metasploit let alone understood how you exploit a system. Unfortunately (most) banks/big enterprise are full of CISSPs which is why they keep getting styled on all the time. If they woke up and hired real hackers, adopted real security practices and knowledge sharing they could drastically reduce risk and probably get better software and systems in the process.
raverbashing 10y ago
> display a very shallow understanding of how secure systems should work. They still ask about mother's maiden name, prevent paste of passwords, took forever to adopt EMV in the US and other idiocies It's security by cargo-culting
- 4ad 10y ago
  > took forever to adopt EMV in the US and other idiocies Totally agree with your comment, but I'll go a little bit on a tangent here. I am an European, all my cards have always had a chip, I have not even seen a card without a chip until I visited the United States. All this reluctance to adopt chips seems so ridiculous to me. But then I spent more time in the United States and with magnetic stripe cards, and boy do I love the better experience. Let's see, in the US I can swipe a card at any moment of the transaction, and this physical act takes less than a second. With chip, in most European countries not only I have to wait for the cashier to scan everything, but I also have to wait for the cashier to press a magic button that says "card payment"; only then does the POS become active. Then I have to plug the card in, different POS terminals require the card to be put in different orientations, wait 3 seconds for the terminal to do whatever, insert PIN, wait another 5-30 seconds until the transaction runs, and then get my card back. Or let's look at NFC. I still have to wait for the cashier to scan everything and push the magic button, I have to press the card 3 seconds on the POS until the NFC chip is read. Since there's no feedback, I have no idea if I keep the card in the right place until it beeps. After that, it still takes the same 5-20 seconds until it's done. The only advantage of NFC is that I don't have to plug my card in the terminal, but since the progress feedback is worse, I am not sure how that is any improvement at all. The user experience is so much worse. Why wouldn't I want a magstripe-only card? Yes, it's (vastly) more insecure, but I am not liable for fraud. I don't have anything to lose.
  - raverbashing 10y ago
    Well, having to wear a safety belt is also an inferior experience but we do it for safety True, swiping is faster (but you have to scribble something on a paper or an e-screen where the end result usually resembles nothing like your signature) :) I can agree with the criticism there but the tradeoff doesn't bother me (too much)
adrianN 10y ago
Usually Big Banking has a sufficient amount of employees that there can be a group that is very interested in the latest developments and a completely different group that only wants to check off boxes on a compliance sheet and change as little as possible "to avoid risk".

viraptor 10y ago

I think that's a very biased way of looking at this request. They don't necessarily have a shallow understanding. They have a set of very strict rules they have to obey. If that means no privacy for the employees, then they have to implement no privacy for the employees. The reasoning of the author has been explained pretty well in my opinion. But that's completely orthogonal to the understanding how the secure systems work.

usgroup 10y ago
Indeed, orthogonal. I think it's a denied attempt to connect cross-purposes. I.e. design for security with practicalities of implementation in a broader context. I notice some posts argue that we should aim for a pareto-optimum and accommodate the banks, but really this should require a broad representation for the rest of the subjects of TLS 1.3 to work out exactly what the pareto would look like. Given that they are 15 drafts in, it seems to me that there has been ample opportunity.

rdtsc 10y ago

I call it paper security or checklist security. Usually it is about implementing enough to check off a list of requirements from some document. Antivirus installed? Check (Nevermind it is a Linux box and AV loads a dubious proprietary driver in the kernel with a huge attack surface and remote exploit posibility because of how it does updates), such and such EAL-4 operating system intalled? Check, and so on ... So they tick all the boxes and in the end up with a worse off posture than if they just stayed with defaults for example.

drvdevd 10y ago
Right. And at the end of the day, skilled attackers can either: a) not care if you decrypt their traffic as they're already in your network and it's too late by the time you're reviewing the incident or b) take a copy of your checklist and say, "well here's something they'll probably never figure out" A little out of the checkbox thinking goes a long way for attackers. It could for enterprises too if they could overcome their inertia.
- digi_owl 10y ago
  Best i can tell, quite a bit of the checklists comes from insurance companies and government regulations. Meaning that if something hits the fan and the company has their checklists in order, then they can be exempt from liability.
matt4077 10y ago
As far I remember, major banks have been rather secure in the last decades, especially compared to the hipster hackers at Yahoo/Dropbox/github/.... So maybe their checklist is worth a look.
- rdtsc 10y ago
  You're right, that's fair. I can't remember a large bank was hacked as to where their customer's money was stolen or anything like that. It is usually retailers and such.
jpgvm 10y ago
We call them "CISSPs" where I have worked. It's a mostly derogatory term for whiteboard warriors of the security world. They usually have a CISSP but no other valuable security background, most certainly aren't programmers and have never even played with Metasploit let alone understood how you exploit a system. Unfortunately (most) banks/big enterprise are full of CISSPs which is why they keep getting styled on all the time. If they woke up and hired real hackers, adopted real security practices and knowledge sharing they could drastically reduce risk and probably get better software and systems in the process.

raverbashing 10y ago

> display a very shallow understanding of how secure systems should work. They still ask about mother's maiden name, prevent paste of passwords, took forever to adopt EMV in the US and other idiocies It's security by cargo-culting

4ad 10y ago
> took forever to adopt EMV in the US and other idiocies Totally agree with your comment, but I'll go a little bit on a tangent here. I am an European, all my cards have always had a chip, I have not even seen a card without a chip until I visited the United States. All this reluctance to adopt chips seems so ridiculous to me. But then I spent more time in the United States and with magnetic stripe cards, and boy do I love the better experience. Let's see, in the US I can swipe a card at any moment of the transaction, and this physical act takes less than a second. With chip, in most European countries not only I have to wait for the cashier to scan everything, but I also have to wait for the cashier to press a magic button that says "card payment"; only then does the POS become active. Then I have to plug the card in, different POS terminals require the card to be put in different orientations, wait 3 seconds for the terminal to do whatever, insert PIN, wait another 5-30 seconds until the transaction runs, and then get my card back. Or let's look at NFC. I still have to wait for the cashier to scan everything and push the magic button, I have to press the card 3 seconds on the POS until the NFC chip is read. Since there's no feedback, I have no idea if I keep the card in the right place until it beeps. After that, it still takes the same 5-20 seconds until it's done. The only advantage of NFC is that I don't have to plug my card in the terminal, but since the progress feedback is worse, I am not sure how that is any improvement at all. The user experience is so much worse. Why wouldn't I want a magstripe-only card? Yes, it's (vastly) more insecure, but I am not liable for fraud. I don't have anything to lose.
- raverbashing 10y ago
  Well, having to wear a safety belt is also an inferior experience but we do it for safety True, swiping is faster (but you have to scribble something on a paper or an e-screen where the end result usually resembles nothing like your signature) :) I can agree with the criticism there but the tradeoff doesn't bother me (too much)

adrianN 10y ago

Usually Big Banking has a sufficient amount of employees that there can be a group that is very interested in the latest developments and a completely different group that only wants to check off boxes on a compliance sheet and change as little as possible "to avoid risk".