9 ms·
On a similar, but separate note, my bank launched a new version of its online banking platform. From launch I noticed it opened my accounts in a new tab while l
by alistproducer2 10y ago
On a similar, but separate note, my bank launched a new version of its online banking platform. From launch I noticed it opened my accounts in a new tab while leaving my credentials (password and all) in the sign-in form. Not so bad when signing in from home - horrific if you're signing in from a public computer. I tweeted to the bank and spoke to someone on the phone about it. It's been 3 months and the bug is still there.
[EDIT]
I decided to log in today just to see if it's still there (was a couple days ago), and it's finally been patched. If I had used a throwaway I would gladly let you guys know the bank, but I won't since it's trivial to find out who I am from my handle.
- diogenescynic 10y agoTell us what bank so we can avoid them.
- nothrabannosir 10y agoThis deserves more than an upvote. This is exactly the right attitude. It puts the incentives in the right place and will let the market do what she does best: work.
- jbpetersen 10y agoBetter yet: Short their stock, then write a scary blog post about the problem.
- goda90 10y agoI feel like someone would try to sue over such an action, but would they have any ground to stand on?
- got2surf 10y agoJust curious, what would the legal implications of something like that be? It seems like you're still benefitting from criminal activity that you enable, but what would the specific charge (if any) be? And any examples where people have tried this? Although I guess it could help align customer and business goals, since no one wants to lose money
- dragontamer 10y agoThe Lumber Liquidators short-seller is quite a famous example of this strategy being executed. Before writing his blog-post, he short-sold a bunch of Lumber Liquidator stock and made tons of money during the fallout.
- artursapek 10y agoMartin Shkreli claims to have made a lot of money by shorting pharma companies ahead of their FDA results - he would read their studies and make reasonably accurate predictions as to the outcome.
- JackFr 10y agoShkrelli has shuttered two hedge funds (Elea Capital Management & MSMB Capital Management) when he was unable to cover shorts and put options when the stock price moved away from him. He is also currently awaiting trial for securities fraud. So I would take his comments with a grain of salt.
- artursapek 10y agoThis is why I said "claims". He no doubt failed at some of his shorts. On a livestream he said he made all the money he still has on his companies, not trading. The strategy is still relevant to the discussion, though.
- artursapek 10y agoAttempted stock manipulation, probably
- CocaKoala 10y agoI posted this downstream, but it's happened and there weren't charges filed. http://www.pcworld.com/article/3155990/security/stock-tanking-in-st-jude-medical-security-disclosure-might-have-legs.html http://www.pcworld.com/article/3155990/security/stock-tankin...
- CocaKoala 10y agoThis has been done! http://www.pcworld.com/article/3155990/security/stock-tanking-in-st-jude-medical-security-disclosure-might-have-legs.html http://www.pcworld.com/article/3155990/security/stock-tankin... A company discovered vulnerabilities in some medical devices, then shorted the stock of the company before disclosing them.
- 77pt77 10y agoAnd get sued for libel and market manipulation.
- nickpsecurity 10y agoAlternatively, publish it in an obscure place online, get proof you published it in archived medium (eg Gmail or Archive.org), short the stock based on that now-public information, and then reveal it again in a way that will get stock-smashing attention. That's my hypothetical model I came up with when trying to figure out how to incentivize apathetic, but public companies, to care about security a bit. You can even follow up offering them security consulting but don't expect a yes haha.
- atmosx 10y ago> let the market do what she does best: work. Hm, I recall the Comodo hack. I think it Comodo was hacked twice or more times that year. It won many rewards and continued leading the CA space. The market did not work apparently...
- lloeki 10y agoWell, in a way, it did: people voted and said "we don't care la la la what did you just say?".
- nickpsecurity 10y agoThe security market is working exactly as it was designed and evolved to. Far as when high-assurance started, the Black Forrest Group of execs of big companies convening on INFOSEC told one of INFOSEC founders they thought companies would refuse to sell them highly-assured software. The reason was they suspected they intended to make extra profit two ways: cutting QA for immediate profit; selling the fixes for later profit. This proved true with lock-in strategy combining for what was essentially checkmate to lots of companies. The other end are buyers. Most of them don't know what to expect for security or how to evaluate it. Most attempts to solve this failed. They've been conditioned to expect constant hacks, crashes, or data loss. So, they see Comodo etc get hacked and shrug. They'll usually stay if their end of whatever they bought works. The sector that will pay for highly reliable or secure software is probably under 1% of the market or projects. It's enough companies keep forming to do real thing but tiny, tiny few struggling to justify the extra costs or less features necessary for higher security.
- lostlogin 10y agoThe idea of the banking system being subject to market forces is nice.
- scrollaway 10y agoI don't think it's HSBC, but they do similarly horrific stuff. Almost all banks have a truly terrible online service. I'm a happy user of N26. I very, very highly recommend it to all european customers. I'm never dealing with shitty bank service again. https://n26.com/ https://n26.com/ (Email me if you want a referral invite).
- sjtgraham 10y agoN26 had some of the worst security until a researcher came along. See https://media.ccc.de/v/33c3-7969-shut_up_and_take_my_money https://media.ccc.de/v/33c3-7969-shut_up_and_take_my_money
- jdmichal 10y agoPeople often confuse lack of published security issues with the existence of strong security. It was the rally cry all along of techies opposing Apple's security-based advertisements.
- deleted 10y ago[deleted]
- noja 10y agoDo they have direct debits yet?
- ccvannorman 10y agoWells Fargo and Schwab seem ok in my experience. Wells Fargo even updated their site with slick new UI and menu options are actually findable. Amazing!
- brightball 10y agoI sent feedback about the WF interface and it was actually addressed with 2 weeks. I was floored.
- 10y ago
- ryandrake 10y agoSo far, I count three separate replies to this article along the lines of "I also found my bank doing so-and-so thing insecurely, but LA LA I'm not going to tell you which bank it is!" These kinds of comments don't help anyone--you might as well not post them.
- libertymcateer 10y agoYeah I genuinely don't understand the point here. Who is protecting what?
- futurix 10y agoSo the article mentions the threat of retaliation against the security researcher, and you are surprised people are afraid to come out publicly?
- libertymcateer 10y agoI read more in the article so I am updating my comment - the FBI's involvement is surprising and alarming. When in doubt, people, call your attorney.
- ryanmarsh 10y agoWho just has an attorney sitting around who is competent to handle such things? I wouldn't know who the fuck to call if I found something on my bank's website.
- libertymcateer 10y agoI am one such attorney.
- ryanmarsh 10y agoCan I get your number?
- beamatronic 10y agoWho logs into their bank from a public computer? Genuinely curious.
- deleted 10y ago[deleted]
- Klipi 10y agoThere's plenty of laggards who don't have home internet and only browse through e.g. a library computer. Some of them are probably doing banking too, given the recent trend of preferring online transactions
- bjacobel 10y ago> laggards Or, you know, poor people.
- ballenf 10y agoAnd the kind of people that don't have access to anything else. My bank (arguably) condones use from public computers by asking me if they should "trust" the computer I'm on.
- akovaski 10y agoRight, most public computers I've seen would be trivial to bug with a key logger. Though with 2fa, I suppose it wouldn't be quite as bad (but then again, those using public computers might not be using 2fa).
- gejjaxxita 10y agoWhen on holiday this is quite common. With 2-factor auth this is fine.