10 ms·

> The entire situation was communicated to the FBI, local police, and bank institutions, but I do not think anyone cared. Why would they care? It happens doze

by adekok 9y ago

> The entire situation was communicated to the FBI, local police, and bank institutions, but I do not think anyone cared. Why would they care? It happens dozens of times a day, and the criminals are out of their jurisdiction. If only the police, FBI, politicians, etc. could go after the banks and telcos to improve their security. But no... they see it as their job to destroy security, in order to make you "safe".

wyck 9y ago
The is a direct correlation between security and fraud related interest/insurance in regards to the cost of use and exposure to fraud. They aren't out to "destroy" your security, it's a liability threshold calculation. At the end of the day secure yourself in life, this include choosing banks that are more stringent based on your needs and what you want to pay.
- joshgel 9y ago
  Which banks should you choose? How do you decide?
  - swsieber 9y ago
    I would refine that question: does anybody know of a competent rater that evaluates and rates banks based on security?
  - closeparen 9y ago
    The ACH model is fundamentally insecure: anyone who knows your account number can pull money from it, and the protocol makes no allowance for the bank to check with you first. I don't think choice of bank matters very much. You can manage your risk somewhat by: 1) Using credit and not debit cards for day to day spending. 2) Maintaining your long term wealth in separate accounts at separate institutions and not linking them directly to anything except your checking account. This minimizes what can be stolen if your checking account is compromised, and makes it less likely that your savings can be stolen directly (account number is used in fewer places). 3) Turning on all the alerting and notification settings you can find, so that you'll hear about unauthorized activity immediately.
    - aptwebapps 9y ago
      I read somewhere that companies that do a lot of ACH payments use different accounts for receiving and sending payments. The receiving account is locked so that it can't send and the sending account is supposed to stay secret. I don't know if that actually works in practice, though.
      - creepydata 9y ago
        If you give someone a paper check you are giving them your account number in plain text. I don't see how they can make that "secret."
        aptwebapps 9y ago
        ACH transfers, not paper checks.
        creepydata 9y ago
        Yeah but for 90%+ of transactions, if you are being paid by a company, you can almost always request a paper check instead of an ACH transfer (sometimes with a fee). In that case they either have yet another account for check writing (which won't be "secret") or they give away their "secret" ACH account.
        aptwebapps 9y ago
        I'm not proposing this as the solution to fix the extremely outdated ACH/check system, just relaying what I read about what some companies do.
    - llukas 9y ago
      Why they keep that system? In most of Europe you got "normal" banking system where you can give everyone your account number and worse thing they can do is to put some money there. In US it seems #freemarket is putting externalities (security) on the customer.
  - Spooky23 9y ago
    Security always sucks. The differentiation is response. That usually means a small regional bank or midsize credit union. If you have enough dollars, a private bank type thing works too.
- kakarot 9y ago
  The real answer is to not use SMS as a 2FA. That was never ever a good idea.
  - knowaveragejoe 9y ago
    What is better? Authenticator apps/hardware devices?
    - msh 9y ago
      Authenticators are fine but u2f keys are better because they protect against phishing.
      - potatolicious 9y ago
        Not to mention you lose your Authenticator if you upgrade/lose/break your phone, but U2F keys are (practically) forever.
        davchana 9y ago
        Thats exactly why I copy and save every 2fa QR Code in my KeePass database, along with backup codes. Phone changed? No worries, install Google Auth, rescan those QRs, and voila, your 2fa system is back and running !! :)
        ArlenBales 9y ago
        Most 2FA services that allow authenticators offer recovery codes. I keep the recovery code saved in my password manager, and if I ever lost my phone I use that to log into the site and then get a new QR code.
        davchana 9y ago
        Yes, that's also a way, but why not save the QR code first time you see it, instead of loosing it, resetting with recovery code, and then again getting a new one? Recovery codes are fine, and should be kept safe and such, but also the Original QR code can also be saved and screenshot. That way, phone lost? open database, load QR code, scan in new phone.
deleted 9y ago
[deleted]
MichaelGG 9y ago
They won't go after an attacker if there's not a high amount of damage, like $250K or more. FBI guys are swamped with people calling, and there's just not enough agent time to go around. Same for bank fraud. Ever wonder how people get away with popping someone's bank account, transferring to another local account, and walking off with the cash? For a couple grand, no one's gonna spend the time and effort to track you down. Liability for data breaches limited to companies over X size would be a good idea though.
- panic 9y ago
  Maybe we should increase the number of agents investigating this stuff, then? Fraud affects many more people than terrorism, but nobody gives the "there's just not enough agents" excuse for that. Also, only investigating fraud when there's lots of money involved means we're only helping rich people, who need the least help. Losing less money doesn't mean less impact on someone's life if that's all they have.
  - csomar 9y ago
    Because people are more terrified about a random bomb hitting a random place once in a while more than their accounts getting hacked and then finding themselves in a big trouble?
    - jessaustin 9y ago
      It takes a lot of work by the military-media-industrial complex to keep people that terrified about such a stupid ginned-up threat.
- csomar 9y ago
  Which is interesting because it should be the other way around. If you have $250k stolen, it is bad but you are probably wealthy enough you won't go in deep trouble stress. If your whole account is $2k it might be a different world for you and you might relying on these to pay rent, medical expenses which is more serious than an investor not having access to his $250k. Not meaning it is fine to steal $250k from wealthy people but that poor ones being affected (at $2k) is more urgent from a humanitarian perspective.
gens 9y ago
> Why would they care? Because it is their job.
- ktta 9y ago
  >criminals are out of their jurisdiction We are in dire need of specific cyber security public divisions are people can go to. FBI I believe will have many problems to deal with, and as far as I know, there isn't any cyber-police division capable at the city/state level. Atleast nothing capable of handling incidents like the one mentioned above. The debate of who's job it is can get hairy. Especially with the future where internet is becoming more pervasive, there can be more damage.
  - creepydata 9y ago
    The FBI claims jurisdiction on crimes committed by foreign national against Americans. It's just hard to investigate and arrest individuals who aren't on US soil, but not absolutely impossible. They arrested a Russian ID theft a while back, but they had to lure him out of Russia to do so, as the Russian authorities didn't cooperate.
- dba7dba 9y ago
  I don't mean to sound flippant but they don't care. It is their 'job', but they don't care.
njx 9y ago
Did you file a report with FBI? I once was scammed on ebay for a laptop worth $1200 around year 2002. The local police did not get involved so I went to the FBI website and filed a report. I thought nothing is going to happen. They eventually caught the guy and I got my payments in installments (restitution) over several years.

by adekok 9y ago

wyck 9y ago

The is a direct correlation between security and fraud related interest/insurance in regards to the cost of use and exposure to fraud. They aren't out to "destroy" your security, it's a liability threshold calculation. At the end of the day secure yourself in life, this include choosing banks that are more stringent based on your needs and what you want to pay.

joshgel 9y ago
Which banks should you choose? How do you decide?
- swsieber 9y ago
  I would refine that question: does anybody know of a competent rater that evaluates and rates banks based on security?
- closeparen 9y ago
  The ACH model is fundamentally insecure: anyone who knows your account number can pull money from it, and the protocol makes no allowance for the bank to check with you first. I don't think choice of bank matters very much. You can manage your risk somewhat by: 1) Using credit and not debit cards for day to day spending. 2) Maintaining your long term wealth in separate accounts at separate institutions and not linking them directly to anything except your checking account. This minimizes what can be stolen if your checking account is compromised, and makes it less likely that your savings can be stolen directly (account number is used in fewer places). 3) Turning on all the alerting and notification settings you can find, so that you'll hear about unauthorized activity immediately.
  - aptwebapps 9y ago
    I read somewhere that companies that do a lot of ACH payments use different accounts for receiving and sending payments. The receiving account is locked so that it can't send and the sending account is supposed to stay secret. I don't know if that actually works in practice, though.
    - creepydata 9y ago
      If you give someone a paper check you are giving them your account number in plain text. I don't see how they can make that "secret."
      - aptwebapps 9y ago
        ACH transfers, not paper checks.
        creepydata 9y ago
        Yeah but for 90%+ of transactions, if you are being paid by a company, you can almost always request a paper check instead of an ACH transfer (sometimes with a fee). In that case they either have yet another account for check writing (which won't be "secret") or they give away their "secret" ACH account.
        aptwebapps 9y ago
        I'm not proposing this as the solution to fix the extremely outdated ACH/check system, just relaying what I read about what some companies do.
  - llukas 9y ago
    Why they keep that system? In most of Europe you got "normal" banking system where you can give everyone your account number and worse thing they can do is to put some money there. In US it seems #freemarket is putting externalities (security) on the customer.
- Spooky23 9y ago
  Security always sucks. The differentiation is response. That usually means a small regional bank or midsize credit union. If you have enough dollars, a private bank type thing works too.
kakarot 9y ago
The real answer is to not use SMS as a 2FA. That was never ever a good idea.
- knowaveragejoe 9y ago
  What is better? Authenticator apps/hardware devices?
  - msh 9y ago
    Authenticators are fine but u2f keys are better because they protect against phishing.
    - potatolicious 9y ago
      Not to mention you lose your Authenticator if you upgrade/lose/break your phone, but U2F keys are (practically) forever.
      - davchana 9y ago
        Thats exactly why I copy and save every 2fa QR Code in my KeePass database, along with backup codes. Phone changed? No worries, install Google Auth, rescan those QRs, and voila, your 2fa system is back and running !! :)
        ArlenBales 9y ago
        Most 2FA services that allow authenticators offer recovery codes. I keep the recovery code saved in my password manager, and if I ever lost my phone I use that to log into the site and then get a new QR code.
        davchana 9y ago
        Yes, that's also a way, but why not save the QR code first time you see it, instead of loosing it, resetting with recovery code, and then again getting a new one? Recovery codes are fine, and should be kept safe and such, but also the Original QR code can also be saved and screenshot. That way, phone lost? open database, load QR code, scan in new phone.

deleted 9y ago

[deleted]

MichaelGG 9y ago

They won't go after an attacker if there's not a high amount of damage, like $250K or more. FBI guys are swamped with people calling, and there's just not enough agent time to go around. Same for bank fraud. Ever wonder how people get away with popping someone's bank account, transferring to another local account, and walking off with the cash? For a couple grand, no one's gonna spend the time and effort to track you down. Liability for data breaches limited to companies over X size would be a good idea though.

panic 9y ago
Maybe we should increase the number of agents investigating this stuff, then? Fraud affects many more people than terrorism, but nobody gives the "there's just not enough agents" excuse for that. Also, only investigating fraud when there's lots of money involved means we're only helping rich people, who need the least help. Losing less money doesn't mean less impact on someone's life if that's all they have.
- csomar 9y ago
  Because people are more terrified about a random bomb hitting a random place once in a while more than their accounts getting hacked and then finding themselves in a big trouble?
  - jessaustin 9y ago
    It takes a lot of work by the military-media-industrial complex to keep people that terrified about such a stupid ginned-up threat.
csomar 9y ago
Which is interesting because it should be the other way around. If you have $250k stolen, it is bad but you are probably wealthy enough you won't go in deep trouble stress. If your whole account is $2k it might be a different world for you and you might relying on these to pay rent, medical expenses which is more serious than an investor not having access to his $250k. Not meaning it is fine to steal $250k from wealthy people but that poor ones being affected (at $2k) is more urgent from a humanitarian perspective.

gens 9y ago

> Why would they care? Because it is their job.

ktta 9y ago
>criminals are out of their jurisdiction We are in dire need of specific cyber security public divisions are people can go to. FBI I believe will have many problems to deal with, and as far as I know, there isn't any cyber-police division capable at the city/state level. Atleast nothing capable of handling incidents like the one mentioned above. The debate of who's job it is can get hairy. Especially with the future where internet is becoming more pervasive, there can be more damage.
- creepydata 9y ago
  The FBI claims jurisdiction on crimes committed by foreign national against Americans. It's just hard to investigate and arrest individuals who aren't on US soil, but not absolutely impossible. They arrested a Russian ID theft a while back, but they had to lure him out of Russia to do so, as the Russian authorities didn't cooperate.
dba7dba 9y ago
I don't mean to sound flippant but they don't care. It is their 'job', but they don't care.

njx 9y ago

Did you file a report with FBI? I once was scammed on ebay for a laptop worth $1200 around year 2002. The local police did not get involved so I went to the FBI website and filed a report. I thought nothing is going to happen. They eventually caught the guy and I got my payments in installments (restitution) over several years.