4 ms·

People are extraordinarily stupid. And selfish. And greedy. And all sorts of other bad things. Giving control to other people isn't any better.

ryanlol 9y ago
Would you rather have your grandmother do her banking on a windows laptop or a device running iOS?
- kuschku 9y ago
  On a laptop, ofc. All the secure stuff happens on external hardware, and the laptop at least allows using it. Most banks in Germany allow HBCI, so you get an external chip reader, any HBCI-compliant software – be it StarMoney, or GnuCash/KMyMoney with the HBCI plugin – configure your account, and authorize API accesses via the card and PIN on an external keypad (which shows what you’re authorizing on its own display). This is the average way a consumer does online banking, and it’s much more secure than on iOS.
  - ryanlol 9y ago
    >This is the average way a consumer does online banking, and it’s much more secure than on iOS. lol. At least on iOS they can trust what they see. On desktop they can't, https://securityintelligence.com/tatanga-attack-exposes-chiptan-weaknesses/ https://securityintelligence.com/tatanga-attack-exposes-chip... All of your security theater falls apart when the device is infected with malware that can make the bank site say anything. On iOS your banks app/site will never ever lie to you, if it does it'll almost certainly be the banks fault and not the users.
    - deleted 9y ago
      [deleted]
    - germanier 9y ago
      The idea is to get a dedicated device[0] which uses your bank card to sign the transaction and shows transaction details on its own display. That's probably even harder to infect than iOS. While German banks support that almost universally, hardly anybody uses it. [0]: https://shop.reiner-sct.com/chipkartenleser-fuer-die-sicherheitsklasse-3/cyberjack-secoder-usb https://shop.reiner-sct.com/chipkartenleser-fuer-die-sicherh...
      - ryanlol 9y ago
        Yeah, and then the banks site will just tell the user to approve the "test transaction" on their devices screen. Or that they need to approve it or all of their funds will be frozen, or whatever.
      - deleted 9y ago
        [deleted]
  - germanier 9y ago
    While it is possible, I don't think the average consumer has a dedicated card reader and HBCI software. I just checked a few random banks and none of them even advertise that on their homepage. Most people use browser-based banking plus a way to generate transaction tokens (e.g. via SMS, smartphone apps, or a small token generator that takes input).
    - kuschku 9y ago
      The Commerzbank advertises it on the homepage of their online banking, and when you try to activate online banking, they suggest it, too. And the chip reader is required for the new Personalausweis anyway.
      - germanier 9y ago
        Unless I am missing anything, Commerzbank has a small text on some of the sites "Using HBCI? This is how to activate". That's hardly advertising, nobody how doesn't already knows what this is about will click on that. All their interactions on the site seem to steer people to mobile or photo TAN. To me it looks like nobody actually uses the Personalausweis online. Just recently, companies have switched off their support (e.g. HUK or DKB). And the majority of the readers around are just RFID readers without any dedicated keys or display (which obviously is not a secure way) which can't be used for HBCI.
- CaptSpify 9y ago
  Neither. I'd rather her do her banking on a machine that she has full control of: linux or any other foss os

ryanlol 9y ago

Would you rather have your grandmother do her banking on a windows laptop or a device running iOS?

kuschku 9y ago
On a laptop, ofc. All the secure stuff happens on external hardware, and the laptop at least allows using it. Most banks in Germany allow HBCI, so you get an external chip reader, any HBCI-compliant software – be it StarMoney, or GnuCash/KMyMoney with the HBCI plugin – configure your account, and authorize API accesses via the card and PIN on an external keypad (which shows what you’re authorizing on its own display). This is the average way a consumer does online banking, and it’s much more secure than on iOS.
- ryanlol 9y ago
  >This is the average way a consumer does online banking, and it’s much more secure than on iOS. lol. At least on iOS they can trust what they see. On desktop they can't, https://securityintelligence.com/tatanga-attack-exposes-chiptan-weaknesses/ https://securityintelligence.com/tatanga-attack-exposes-chip... All of your security theater falls apart when the device is infected with malware that can make the bank site say anything. On iOS your banks app/site will never ever lie to you, if it does it'll almost certainly be the banks fault and not the users.
  - deleted 9y ago
    [deleted]
  - germanier 9y ago
    The idea is to get a dedicated device[0] which uses your bank card to sign the transaction and shows transaction details on its own display. That's probably even harder to infect than iOS. While German banks support that almost universally, hardly anybody uses it. [0]: https://shop.reiner-sct.com/chipkartenleser-fuer-die-sicherheitsklasse-3/cyberjack-secoder-usb https://shop.reiner-sct.com/chipkartenleser-fuer-die-sicherh...
    - ryanlol 9y ago
      Yeah, and then the banks site will just tell the user to approve the "test transaction" on their devices screen. Or that they need to approve it or all of their funds will be frozen, or whatever.
    - deleted 9y ago
      [deleted]
- germanier 9y ago
  While it is possible, I don't think the average consumer has a dedicated card reader and HBCI software. I just checked a few random banks and none of them even advertise that on their homepage. Most people use browser-based banking plus a way to generate transaction tokens (e.g. via SMS, smartphone apps, or a small token generator that takes input).
  - kuschku 9y ago
    The Commerzbank advertises it on the homepage of their online banking, and when you try to activate online banking, they suggest it, too. And the chip reader is required for the new Personalausweis anyway.
    - germanier 9y ago
      Unless I am missing anything, Commerzbank has a small text on some of the sites "Using HBCI? This is how to activate". That's hardly advertising, nobody how doesn't already knows what this is about will click on that. All their interactions on the site seem to steer people to mobile or photo TAN. To me it looks like nobody actually uses the Personalausweis online. Just recently, companies have switched off their support (e.g. HUK or DKB). And the majority of the readers around are just RFID readers without any dedicated keys or display (which obviously is not a secure way) which can't be used for HBCI.
CaptSpify 9y ago
Neither. I'd rather her do her banking on a machine that she has full control of: linux or any other foss os