3 ms·
> Another example is changing my address - it literally took less than a minute with Starling, all from my mobile app. Sounds like a feature ripe for abuse and
by ForHackernews 8y ago
> Another example is changing my address - it literally took less than a minute with Starling, all from my mobile app.
Sounds like a feature ripe for abuse and identity theft.
- ubercow13 8y agoHow?
- ForHackernews 8y agoIf whatever API that mobile app uses were compromised, the attacker could easily update the address and then make changes to a user's account without the user receiving notifications to realize the problem.
- ubercow13 8y agoNot sure I understand - you don't receive notifications by post anyway? Why not just attack the 'transfer money' API instead of the address change one...
- deleted 8y ago[deleted]
- rocgf 8y agoIn theory, yes. I have thought about this as well. At the same time, you need (a) the device where the account has already been set up and (b) the master password. I'm not exactly sure what an attacker might be able to do by changing the address, since by having both (a) and (b), he would already have access to your full account.