9 ms·

Tell us what bank so we can avoid them.

nothrabannosir 10y ago
This deserves more than an upvote. This is exactly the right attitude. It puts the incentives in the right place and will let the market do what she does best: work.
- jbpetersen 10y ago
  Better yet: Short their stock, then write a scary blog post about the problem.
  - goda90 10y ago
    I feel like someone would try to sue over such an action, but would they have any ground to stand on?
  - got2surf 10y ago
    Just curious, what would the legal implications of something like that be? It seems like you're still benefitting from criminal activity that you enable, but what would the specific charge (if any) be? And any examples where people have tried this? Although I guess it could help align customer and business goals, since no one wants to lose money
    - dragontamer 10y ago
      The Lumber Liquidators short-seller is quite a famous example of this strategy being executed. Before writing his blog-post, he short-sold a bunch of Lumber Liquidator stock and made tons of money during the fallout.
      - artursapek 10y ago
        Martin Shkreli claims to have made a lot of money by shorting pharma companies ahead of their FDA results - he would read their studies and make reasonably accurate predictions as to the outcome.
        JackFr 10y ago
        Shkrelli has shuttered two hedge funds (Elea Capital Management & MSMB Capital Management) when he was unable to cover shorts and put options when the stock price moved away from him. He is also currently awaiting trial for securities fraud. So I would take his comments with a grain of salt.
        artursapek 10y ago
        This is why I said "claims". He no doubt failed at some of his shorts. On a livestream he said he made all the money he still has on his companies, not trading. The strategy is still relevant to the discussion, though.
    - artursapek 10y ago
      Attempted stock manipulation, probably
    - CocaKoala 10y ago
      I posted this downstream, but it's happened and there weren't charges filed. http://www.pcworld.com/article/3155990/security/stock-tanking-in-st-jude-medical-security-disclosure-might-have-legs.html http://www.pcworld.com/article/3155990/security/stock-tankin...
      - got2surf 10y ago
        Great link, thanks for sharing. The quote that stood out to me was “My issue was that patient safety wasn’t front and center.” I don't have a problem with MedSec making money by shorting St. Jude's stock (that seems to align incentives to take care of security issues as early as possible). But if MedSec publicly disclosed specific, exploitable vulnerabilities (I'm not sure about specifics from the article), they shouldn't be able to hide behind the "doing what is best for the consumer" argument. It's definitely a clever business hack, and that's alright, but the fake sense of moral superiority isn't.
    - andreyf 10y ago
      Not at all. You're making bets based on public information only you have realized is meaningful before informing the rest of the public to make money off that discovery. Quite a few folks make a lot of money this way and (nearly) everyone benefits: https://www.bloomberg.com/news/articles/2015-03-04/how-a-25-year-old-investor-spurred-lumber-liquidators-plunge https://www.bloomberg.com/news/articles/2015-03-04/how-a-25-...
      - emodendroket 10y ago
        Maybe but I, personally, would not want to take the risk that I might need to defend that proposition in court.
        L_Rahman 10y ago
        IANAL but there is no risk that you may have to defend that proposition in court as long as you don't actually exploit the vulnerability and simply point it out. It's public information. Now if someone who works at the bank had told you about it, you'd be in a lot of trouble.
        emodendroket 10y ago
        That's not really true; anybody can sue you if they want, whether or not you're in the right.
        cookiecaper 10y ago
        IANAL either but my understanding is that you can be prosecuted under U.S. law for poking around on servers in any unconventional way. The text of the CFAA forbids "unauthorized access" or "exceeding authorized access". I'll admit that viewing the source code and noticing this link would be a stretch, but I wouldn't necessarily expect it to be a slam dunk for the researcher, especially if he had assented to the site's ToS (and since he had an account, it seems that he had). At this point, I imagine he could be in all sorts of (primarily civil) trouble for the disclosure that he just made. He may be protected under some type of financial whistleblower law, but I wouldn't hold my breath.
    - jimlawruk 10y ago
      https://www.quora.com/Is-it-legal-to-short-a-companys-stock-before-publishing-information-that-damages-the-company https://www.quora.com/Is-it-legal-to-short-a-companys-stock-...
    - downandout 10y ago
      There are law firms working with hedge funds that specialize in doing exactly this when they are about to file a class-action suit. It's possible to be criminally charged if you know that the information you are spreading is false. But other than that limited circumstance, you are free to trade on any information you have about a company that you did not illegally obtain from an insider. Even in the case that the information was obtained from an insider, to convict you, the government must be able to prove that you knew that the insider both a) received a benefit (usually money) in exchange for the information, and b) breached their fiduciary duty by disclosing the information. That said, technical glitches tend to not affect the fortunes of companies nearly as much as we (the HN crowd) think. Tradeking had the glaring vulnerability outlined in this article for years, and they are doing just fine.
      - got2surf 10y ago
        Great point, I think the tech crowd may overestimate the cost of glitches, relative to everything else at play in a business. I think the point I'm getting hung up on is that the bank's stock price could drop for two reasons: bad PR due to the glitch, and/or falling financials due to fraud perpetrated as part of the glitch. I can completely understand a hedge fund trading and making money off the bad PR. But if (hypothetically) the bank lost a ton of money by hackers liquidating user accounts or, worse, making leveraged bets [before everyone checked for that sort of thing ;)], and the hedge fund knew there was a reasonable chance that the malicious activity would occur based on the newly disclosed information, would they have liability there? (from the theft/fraud perpetrated against the bank, not the drop in stock price)
        downandout 10y ago
        I believe that responsible disclosure is a courtesy to the vendor and its customers. Afaik, there is nothing in the law that requires it. Exploiting vulnerabilities like the one you are discussing here yourself certainly would be illegal, and you could possibly be implicated in a conspiracy if you disclosed the vulnerability solely to one person or group that you knew would exploit it (so "I told my Russian hacker friend about this..let's short the stock before he nails them with it!" would probably be a conspiracy case, whereas a press release or HN posting would not be). But general public disclosure of a vulnerability, and/or trading on the anticipated effects of public disclosure, is not illegal. It likely won't win you friends in the IT community, but it falls short of an indictable offense.
  - CocaKoala 10y ago
    This has been done! http://www.pcworld.com/article/3155990/security/stock-tanking-in-st-jude-medical-security-disclosure-might-have-legs.html http://www.pcworld.com/article/3155990/security/stock-tankin... A company discovered vulnerabilities in some medical devices, then shorted the stock of the company before disclosing them.
  - 77pt77 10y ago
    And get sued for libel and market manipulation.
  - nickpsecurity 10y ago
    Alternatively, publish it in an obscure place online, get proof you published it in archived medium (eg Gmail or Archive.org), short the stock based on that now-public information, and then reveal it again in a way that will get stock-smashing attention. That's my hypothetical model I came up with when trying to figure out how to incentivize apathetic, but public companies, to care about security a bit. You can even follow up offering them security consulting but don't expect a yes haha.
- atmosx 10y ago
  > let the market do what she does best: work. Hm, I recall the Comodo hack. I think it Comodo was hacked twice or more times that year. It won many rewards and continued leading the CA space. The market did not work apparently...
  - lloeki 10y ago
    Well, in a way, it did: people voted and said "we don't care la la la what did you just say?".
  - nickpsecurity 10y ago
    The security market is working exactly as it was designed and evolved to. Far as when high-assurance started, the Black Forrest Group of execs of big companies convening on INFOSEC told one of INFOSEC founders they thought companies would refuse to sell them highly-assured software. The reason was they suspected they intended to make extra profit two ways: cutting QA for immediate profit; selling the fixes for later profit. This proved true with lock-in strategy combining for what was essentially checkmate to lots of companies. The other end are buyers. Most of them don't know what to expect for security or how to evaluate it. Most attempts to solve this failed. They've been conditioned to expect constant hacks, crashes, or data loss. So, they see Comodo etc get hacked and shrug. They'll usually stay if their end of whatever they bought works. The sector that will pay for highly reliable or secure software is probably under 1% of the market or projects. It's enough companies keep forming to do real thing but tiny, tiny few struggling to justify the extra costs or less features necessary for higher security.
- lostlogin 10y ago
  The idea of the banking system being subject to market forces is nice.
scrollaway 10y ago
I don't think it's HSBC, but they do similarly horrific stuff. Almost all banks have a truly terrible online service. I'm a happy user of N26. I very, very highly recommend it to all european customers. I'm never dealing with shitty bank service again. https://n26.com/ https://n26.com/ (Email me if you want a referral invite).
- sjtgraham 10y ago
  N26 had some of the worst security until a researcher came along. See https://media.ccc.de/v/33c3-7969-shut_up_and_take_my_money https://media.ccc.de/v/33c3-7969-shut_up_and_take_my_money
  - jdmichal 10y ago
    People often confuse lack of published security issues with the existence of strong security. It was the rally cry all along of techies opposing Apple's security-based advertisements.
- deleted 10y ago
  [deleted]
- noja 10y ago
  Do they have direct debits yet?
- ccvannorman 10y ago
  Wells Fargo and Schwab seem ok in my experience. Wells Fargo even updated their site with slick new UI and menu options are actually findable. Amazing!
  - brightball 10y ago
    I sent feedback about the WF interface and it was actually addressed with 2 weeks. I was floored.
    - 10y ago
ryandrake 10y ago
So far, I count three separate replies to this article along the lines of "I also found my bank doing so-and-so thing insecurely, but LA LA I'm not going to tell you which bank it is!" These kinds of comments don't help anyone--you might as well not post them.
- libertymcateer 10y ago
  Yeah I genuinely don't understand the point here. Who is protecting what?
  - futurix 10y ago
    So the article mentions the threat of retaliation against the security researcher, and you are surprised people are afraid to come out publicly?
    - libertymcateer 10y ago
      I read more in the article so I am updating my comment - the FBI's involvement is surprising and alarming. When in doubt, people, call your attorney.
      - ryanmarsh 10y ago
        Who just has an attorney sitting around who is competent to handle such things? I wouldn't know who the fuck to call if I found something on my bank's website.
        libertymcateer 10y ago
        I am one such attorney.
        ryanmarsh 10y ago
        Can I get your number?

This deserves more than an upvote. This is exactly the right attitude. It puts the incentives in the right place and will let the market do what she does best: work.

jbpetersen 10y ago
Better yet: Short their stock, then write a scary blog post about the problem.
- goda90 10y ago
  I feel like someone would try to sue over such an action, but would they have any ground to stand on?
- got2surf 10y ago
  Just curious, what would the legal implications of something like that be? It seems like you're still benefitting from criminal activity that you enable, but what would the specific charge (if any) be? And any examples where people have tried this? Although I guess it could help align customer and business goals, since no one wants to lose money
  - dragontamer 10y ago
    The Lumber Liquidators short-seller is quite a famous example of this strategy being executed. Before writing his blog-post, he short-sold a bunch of Lumber Liquidator stock and made tons of money during the fallout.
    - artursapek 10y ago
      Martin Shkreli claims to have made a lot of money by shorting pharma companies ahead of their FDA results - he would read their studies and make reasonably accurate predictions as to the outcome.
      - JackFr 10y ago
        Shkrelli has shuttered two hedge funds (Elea Capital Management & MSMB Capital Management) when he was unable to cover shorts and put options when the stock price moved away from him. He is also currently awaiting trial for securities fraud. So I would take his comments with a grain of salt.
        artursapek 10y ago
        This is why I said "claims". He no doubt failed at some of his shorts. On a livestream he said he made all the money he still has on his companies, not trading. The strategy is still relevant to the discussion, though.
  - artursapek 10y ago
    Attempted stock manipulation, probably
  - CocaKoala 10y ago
    I posted this downstream, but it's happened and there weren't charges filed. http://www.pcworld.com/article/3155990/security/stock-tanking-in-st-jude-medical-security-disclosure-might-have-legs.html http://www.pcworld.com/article/3155990/security/stock-tankin...
    - got2surf 10y ago
      Great link, thanks for sharing. The quote that stood out to me was “My issue was that patient safety wasn’t front and center.” I don't have a problem with MedSec making money by shorting St. Jude's stock (that seems to align incentives to take care of security issues as early as possible). But if MedSec publicly disclosed specific, exploitable vulnerabilities (I'm not sure about specifics from the article), they shouldn't be able to hide behind the "doing what is best for the consumer" argument. It's definitely a clever business hack, and that's alright, but the fake sense of moral superiority isn't.
  - andreyf 10y ago
    Not at all. You're making bets based on public information only you have realized is meaningful before informing the rest of the public to make money off that discovery. Quite a few folks make a lot of money this way and (nearly) everyone benefits: https://www.bloomberg.com/news/articles/2015-03-04/how-a-25-year-old-investor-spurred-lumber-liquidators-plunge https://www.bloomberg.com/news/articles/2015-03-04/how-a-25-...
    - emodendroket 10y ago
      Maybe but I, personally, would not want to take the risk that I might need to defend that proposition in court.
      - L_Rahman 10y ago
        IANAL but there is no risk that you may have to defend that proposition in court as long as you don't actually exploit the vulnerability and simply point it out. It's public information. Now if someone who works at the bank had told you about it, you'd be in a lot of trouble.
        emodendroket 10y ago
        That's not really true; anybody can sue you if they want, whether or not you're in the right.
        cookiecaper 10y ago
        IANAL either but my understanding is that you can be prosecuted under U.S. law for poking around on servers in any unconventional way. The text of the CFAA forbids "unauthorized access" or "exceeding authorized access". I'll admit that viewing the source code and noticing this link would be a stretch, but I wouldn't necessarily expect it to be a slam dunk for the researcher, especially if he had assented to the site's ToS (and since he had an account, it seems that he had). At this point, I imagine he could be in all sorts of (primarily civil) trouble for the disclosure that he just made. He may be protected under some type of financial whistleblower law, but I wouldn't hold my breath.
  - jimlawruk 10y ago
    https://www.quora.com/Is-it-legal-to-short-a-companys-stock-before-publishing-information-that-damages-the-company https://www.quora.com/Is-it-legal-to-short-a-companys-stock-...
  - downandout 10y ago
    There are law firms working with hedge funds that specialize in doing exactly this when they are about to file a class-action suit. It's possible to be criminally charged if you know that the information you are spreading is false. But other than that limited circumstance, you are free to trade on any information you have about a company that you did not illegally obtain from an insider. Even in the case that the information was obtained from an insider, to convict you, the government must be able to prove that you knew that the insider both a) received a benefit (usually money) in exchange for the information, and b) breached their fiduciary duty by disclosing the information. That said, technical glitches tend to not affect the fortunes of companies nearly as much as we (the HN crowd) think. Tradeking had the glaring vulnerability outlined in this article for years, and they are doing just fine.
    - got2surf 10y ago
      Great point, I think the tech crowd may overestimate the cost of glitches, relative to everything else at play in a business. I think the point I'm getting hung up on is that the bank's stock price could drop for two reasons: bad PR due to the glitch, and/or falling financials due to fraud perpetrated as part of the glitch. I can completely understand a hedge fund trading and making money off the bad PR. But if (hypothetically) the bank lost a ton of money by hackers liquidating user accounts or, worse, making leveraged bets [before everyone checked for that sort of thing ;)], and the hedge fund knew there was a reasonable chance that the malicious activity would occur based on the newly disclosed information, would they have liability there? (from the theft/fraud perpetrated against the bank, not the drop in stock price)
      - downandout 10y ago
        I believe that responsible disclosure is a courtesy to the vendor and its customers. Afaik, there is nothing in the law that requires it. Exploiting vulnerabilities like the one you are discussing here yourself certainly would be illegal, and you could possibly be implicated in a conspiracy if you disclosed the vulnerability solely to one person or group that you knew would exploit it (so "I told my Russian hacker friend about this..let's short the stock before he nails them with it!" would probably be a conspiracy case, whereas a press release or HN posting would not be). But general public disclosure of a vulnerability, and/or trading on the anticipated effects of public disclosure, is not illegal. It likely won't win you friends in the IT community, but it falls short of an indictable offense.
- CocaKoala 10y ago
  This has been done! http://www.pcworld.com/article/3155990/security/stock-tanking-in-st-jude-medical-security-disclosure-might-have-legs.html http://www.pcworld.com/article/3155990/security/stock-tankin... A company discovered vulnerabilities in some medical devices, then shorted the stock of the company before disclosing them.
- 77pt77 10y ago
  And get sued for libel and market manipulation.
- nickpsecurity 10y ago
  Alternatively, publish it in an obscure place online, get proof you published it in archived medium (eg Gmail or Archive.org), short the stock based on that now-public information, and then reveal it again in a way that will get stock-smashing attention. That's my hypothetical model I came up with when trying to figure out how to incentivize apathetic, but public companies, to care about security a bit. You can even follow up offering them security consulting but don't expect a yes haha.
atmosx 10y ago
> let the market do what she does best: work. Hm, I recall the Comodo hack. I think it Comodo was hacked twice or more times that year. It won many rewards and continued leading the CA space. The market did not work apparently...
- lloeki 10y ago
  Well, in a way, it did: people voted and said "we don't care la la la what did you just say?".
- nickpsecurity 10y ago
  The security market is working exactly as it was designed and evolved to. Far as when high-assurance started, the Black Forrest Group of execs of big companies convening on INFOSEC told one of INFOSEC founders they thought companies would refuse to sell them highly-assured software. The reason was they suspected they intended to make extra profit two ways: cutting QA for immediate profit; selling the fixes for later profit. This proved true with lock-in strategy combining for what was essentially checkmate to lots of companies. The other end are buyers. Most of them don't know what to expect for security or how to evaluate it. Most attempts to solve this failed. They've been conditioned to expect constant hacks, crashes, or data loss. So, they see Comodo etc get hacked and shrug. They'll usually stay if their end of whatever they bought works. The sector that will pay for highly reliable or secure software is probably under 1% of the market or projects. It's enough companies keep forming to do real thing but tiny, tiny few struggling to justify the extra costs or less features necessary for higher security.
lostlogin 10y ago
The idea of the banking system being subject to market forces is nice.

scrollaway 10y ago

I don't think it's HSBC, but they do similarly horrific stuff. Almost all banks have a truly terrible online service. I'm a happy user of N26. I very, very highly recommend it to all european customers. I'm never dealing with shitty bank service again. https://n26.com/ https://n26.com/ (Email me if you want a referral invite).

sjtgraham 10y ago
N26 had some of the worst security until a researcher came along. See https://media.ccc.de/v/33c3-7969-shut_up_and_take_my_money https://media.ccc.de/v/33c3-7969-shut_up_and_take_my_money
- jdmichal 10y ago
  People often confuse lack of published security issues with the existence of strong security. It was the rally cry all along of techies opposing Apple's security-based advertisements.
deleted 10y ago
[deleted]
noja 10y ago
Do they have direct debits yet?
ccvannorman 10y ago
Wells Fargo and Schwab seem ok in my experience. Wells Fargo even updated their site with slick new UI and menu options are actually findable. Amazing!
- brightball 10y ago
  I sent feedback about the WF interface and it was actually addressed with 2 weeks. I was floored.
  - 10y ago

ryandrake 10y ago

So far, I count three separate replies to this article along the lines of "I also found my bank doing so-and-so thing insecurely, but LA LA I'm not going to tell you which bank it is!" These kinds of comments don't help anyone--you might as well not post them.

libertymcateer 10y ago
Yeah I genuinely don't understand the point here. Who is protecting what?
- futurix 10y ago
  So the article mentions the threat of retaliation against the security researcher, and you are surprised people are afraid to come out publicly?
  - libertymcateer 10y ago
    I read more in the article so I am updating my comment - the FBI's involvement is surprising and alarming. When in doubt, people, call your attorney.
    - ryanmarsh 10y ago
      Who just has an attorney sitting around who is competent to handle such things? I wouldn't know who the fuck to call if I found something on my bank's website.
      - libertymcateer 10y ago
        I am one such attorney.
        ryanmarsh 10y ago
        Can I get your number?