7 ms·

I used to use coinbase but some godawful KYC/AML thing kicked in and asked me to send them a "selfie" of myself, which creeped me the hell out. I'm a US citizen

by zkms 9y ago

I used to use coinbase but some godawful KYC/AML thing kicked in and asked me to send them a "selfie" of myself, which creeped me the hell out. I'm a US citizen, am not on any sort of list of prohibited people, and had already given them a photo of my driver's licence and my SSN -- and have had no issues with opening other bank/bitcoin-exchange accounts online previously. I thus switched to Gemini because I do not want to support this invasive nonsense. It's literally an automated version of "put shoe on head" (the request that /b/tards would make of camgirls that they wanted to troll). Between that, and the thing where you literally have to enter your BANK'S username/password to ANOTHER WEBSITE (coinbase, in this case) to prove you have that account (of course it chokes on 2FA); the USian banking system is such a scary bad mess -- and i'm pretty sure that that's a significant driver of bitcoin adoption (and there's also the ACH clusterfuck).

stephengillie 9y ago
You had to provide your bank user/pass to Coinbase? I only had to provide routing and account numbers, then verify the ACH amounts (edit: and driver's license photo). But I'm only in the shallow end of the kiddie pool here.
- asaph 9y ago
  Coinbase offers both options: bank username & password or routing & account numbers. If you choose to provide bank username & password, verification is instant. If you choose to provide routing & account numbers, verification via deposit/withdrawal of small amounts takes days.
  - stephengillie 9y ago
    I must have missed the user/pass option during the sign-up flow.
- joering2 9y ago
  ACH does not work in read or in write-only mode. Once you provide someone your ACH info, they can deposit you money.. or empty out your bank account! I had few rough service providers who tried to come up with some magical charges (technical fee of $500 per year) after agreement was signed and had to change bank numbers to make sure they wont take the money out since it would be more than $500 to fight them in court. The company is called EMS Merchants btw.. you can read horrible stories of merchants screwed by them in this way via ACH on online forums.
  - droidist2 9y ago
    So if you write someone a personal check they can empty your account?
    - zkms 9y ago
      Of course. There's no inherent technical countermeasures against someone doing so.
    - wmf 9y ago
      Yep, and this happened to Donald Knuth: http://www-cs-faculty.stanford.edu/~knuth/news08.html http://www-cs-faculty.stanford.edu/~knuth/news08.html
      - b1daly 9y ago
        This is just bananas. I always thought the routing/acct would just authorize deposits. I assumed this, because every time I need this info, I look at my checks. (When people wire money to me). When you write a check, the signature is the authorization to withdraw funds, and the amount and recipient is specified. I’m shocked that banks would permit a withdrawal without some kind of “anolog” to this authorization pattern. It makes all these worries about passwords and online credentials seem quaint. These numbers are all over the place, online and off. Why aren’t halfway clever hackers draining accounts right now?
        acdha 9y ago
        It’s a huge risk mitigated by the banks being a mostly-trusted network. If someone abused ACH they’d lose access to the network quickly, and your bank can build checks in on their side so if a transaction arrives from a foreign bank they might call you to confirm (when I bought my house the down payment was large enough to trigger a confirmation visit).
    - balls187 9y ago
      Yes but I believe with ACH you have 60-days to dispute the fraudulent debits.
koolba 9y ago
Wait what? Did they really ask for your bank login credentials? If so, approximately what date was that?
- superquest 9y ago
  They use Plaid[1] to verify bank accounts using bank login credentials instead of micro deposits -- which reduces abandoned applications since you don't have to wait a couple days to complete verification. This is a very common thing for fintech companies to do. [1] https://plaid.com/ https://plaid.com/
  - acjohnson55 9y ago
    It's so bizarre to me that there isn't proper auth delegation in online banking. You should never have to put credentials for one domain into a form on another domain. Let alone banking credentials!
    - Jommi 9y ago
      I think everyone here is super overblowing this.. You're redirected to a new domain (of your bank) for verification. Then directed back.
    - mbrock 9y ago
      And that's a huge indicator of why blockchain finance is attractive. The banking system is AWFUL. Exchanges are bridges between banks and blockchains, and it's quite reasonable to want to keep your money in cryptocurrency just for technical usability reasons. I can send cryptocurrency from a shell script -- that's not going to work with bank money in a million years, or if it does it's going to be because of the competition from blockchains. Blockchains enable permissionless innovation in finance, and that's HUGE.
      - Chriky 9y ago
        You can do that with Monzo already
thisisit 9y ago
It seems that this was in response to the people trying to game the system - fake ids, fake accounts etc.
sowbug 9y ago
You don't have to provide your credentials if you don't want to -- it's just much faster that way. On that page, instead search for your bank, and in the event it or whatever you're searching for doesn't come up, select the "Enter manually" option, and it'll do the old PIN-via-two-sub-dollar-deposits confirmation trick. It'll take a couple days, but it works.

by zkms 9y ago

stephengillie 9y ago

You had to provide your bank user/pass to Coinbase? I only had to provide routing and account numbers, then verify the ACH amounts (edit: and driver's license photo). But I'm only in the shallow end of the kiddie pool here.

asaph 9y ago
Coinbase offers both options: bank username & password or routing & account numbers. If you choose to provide bank username & password, verification is instant. If you choose to provide routing & account numbers, verification via deposit/withdrawal of small amounts takes days.
- stephengillie 9y ago
  I must have missed the user/pass option during the sign-up flow.
joering2 9y ago
ACH does not work in read or in write-only mode. Once you provide someone your ACH info, they can deposit you money.. or empty out your bank account! I had few rough service providers who tried to come up with some magical charges (technical fee of $500 per year) after agreement was signed and had to change bank numbers to make sure they wont take the money out since it would be more than $500 to fight them in court. The company is called EMS Merchants btw.. you can read horrible stories of merchants screwed by them in this way via ACH on online forums.
- droidist2 9y ago
  So if you write someone a personal check they can empty your account?
  - zkms 9y ago
    Of course. There's no inherent technical countermeasures against someone doing so.
  - wmf 9y ago
    Yep, and this happened to Donald Knuth: http://www-cs-faculty.stanford.edu/~knuth/news08.html http://www-cs-faculty.stanford.edu/~knuth/news08.html
    - b1daly 9y ago
      This is just bananas. I always thought the routing/acct would just authorize deposits. I assumed this, because every time I need this info, I look at my checks. (When people wire money to me). When you write a check, the signature is the authorization to withdraw funds, and the amount and recipient is specified. I’m shocked that banks would permit a withdrawal without some kind of “anolog” to this authorization pattern. It makes all these worries about passwords and online credentials seem quaint. These numbers are all over the place, online and off. Why aren’t halfway clever hackers draining accounts right now?
      - acdha 9y ago
        It’s a huge risk mitigated by the banks being a mostly-trusted network. If someone abused ACH they’d lose access to the network quickly, and your bank can build checks in on their side so if a transaction arrives from a foreign bank they might call you to confirm (when I bought my house the down payment was large enough to trigger a confirmation visit).
  - balls187 9y ago
    Yes but I believe with ACH you have 60-days to dispute the fraudulent debits.

koolba 9y ago

Wait what? Did they really ask for your bank login credentials? If so, approximately what date was that?

superquest 9y ago
They use Plaid[1] to verify bank accounts using bank login credentials instead of micro deposits -- which reduces abandoned applications since you don't have to wait a couple days to complete verification. This is a very common thing for fintech companies to do. [1] https://plaid.com/ https://plaid.com/
- acjohnson55 9y ago
  It's so bizarre to me that there isn't proper auth delegation in online banking. You should never have to put credentials for one domain into a form on another domain. Let alone banking credentials!
  - Jommi 9y ago
    I think everyone here is super overblowing this.. You're redirected to a new domain (of your bank) for verification. Then directed back.
  - mbrock 9y ago
    And that's a huge indicator of why blockchain finance is attractive. The banking system is AWFUL. Exchanges are bridges between banks and blockchains, and it's quite reasonable to want to keep your money in cryptocurrency just for technical usability reasons. I can send cryptocurrency from a shell script -- that's not going to work with bank money in a million years, or if it does it's going to be because of the competition from blockchains. Blockchains enable permissionless innovation in finance, and that's HUGE.
    - Chriky 9y ago
      You can do that with Monzo already

thisisit 9y ago

It seems that this was in response to the people trying to game the system - fake ids, fake accounts etc.

sowbug 9y ago

You don't have to provide your credentials if you don't want to -- it's just much faster that way. On that page, instead search for your bank, and in the event it or whatever you're searching for doesn't come up, select the "Enter manually" option, and it'll do the old PIN-via-two-sub-dollar-deposits confirmation trick. It'll take a couple days, but it works.