10 ms·
Safe Deposit Boxes Aren't Safe
- Bucephalus355 7y agoWhat have people been using for Yubikeys as an alternative? Installing safes onsite and self monitoring?
- viraptor 7y agoWhy would you want to store yubikeys securely, as opposed to recovery codes which you can print out in multiple copies? Store it in multiple semi-secure places. Unless you're running infra for an international corp, government, bank, or are likely to be physically targeted for some reason, you can likely store it in a folder on a shelf. (And if you actually need to worry about things like that, then you've got (or should have) people who think of things like that for you)
- jdnenej 7y agoYou can check to see the key is still there but you can't check to see if anyone has copied the codes. The key is meant to be not possible to duplicate.
- viraptor 7y agoThere are many ways to make it easy to see things have been tampered with.
- ojilles 7y ago...but not that many that guarantee/clarify if something was read/duplicated. That’s what a safe would buy you.
- ghaff 7y agoLots of ways to set markers against all but seriously professional adversaries. I’d personally worry more about losing access to your key/combination. Frankly your main threat is probably a fire or flood. Not a Russian agent breaking into your house.
- viraptor 7y agoNo, I really mean "many ways". Just search for tamper evident products. There's a huge number of ways you can get that guarantee. For example this: https://harcor.com.au/products/security-seals/tamper-evident-bags/a4-document-bag-411 https://harcor.com.au/products/security-seals/tamper-evident...
- rocqua 7y agoGreatest trick i heard is a simple paper seal, sprinkled with glitter, and then varnished with nail polish. Take pictures of the seal, and compare the seal against the picture.
- Thorrez 7y agoIt depends on your threat model. If you're worried about sophisticated attackers physically breaking in to your place to steal a Yubikey to steal your accounts, you should also worry about them physically tampering with your computer to install malware, and thus need monitoring for that as well. If you can't do the monitoring, and you face very advanced attackers like this, it's probably best to only use a laptop that you physically keep with you at all times, and then you can keep your Yubikey with you at all times too. If you just want to protect against an attacker sophisticated enough to steal a Yubikey but not enough to install malware, then maybe instead of a second Yubikey in the safe deposit box, you could have an encrypted recovery code in the safe deposit box, and either memorize the password, or store the password on your computer. I've never heard of attackers stealing a Yubikey though. More likely is the attacker will social engineer the website's support into giving over your account.
- michaelt 7y agoI’ve heard safe deposit boxes as an answer to the question “what if my house burns down with my yubikey/recovery code sheet in it, and none of my friends or family are as security-conscious as me so I can’t leave the spare with them”
- Thorrez 7y agoYes, fires are one of the main problems that a safe deposit box protects against. But Bucephalus355 seemed to be ignoring them already by considering just having a safe onsite.
- TomK32 7y agoFrom the article is sounds like most of those cases are banks drilling open the boxes and putting the contents into storage. A better and stricter inventory system with strict and punitive regulation is what is needed, not some technical gadget.
- ghaff 7y agoFurthermore, electronics fail. If there’s some records including 2FA codes that you want to store in a safety deposit box, fire box, etc. I absolutely want at least paper backups whether or not I also have a Yubikey, SD card, etc. eg if I have a home inventory I absolutely want prints even if it’s also in the cloud someplace.
- scruple 7y agoI went through this recently. It's such a PITA. I ended up with physical copies in 3 different places because all of a sudden redundancy is a reality.
- ghaff 7y agoYou think you’re reasonably well backed up until the sh*t hits the fan and you realize everything is hanging by a much thinner thread than you thought. Recent events I experienced have added really working through record backups to my todo list.
- jdeibele 7y agoI keep paper copies of the backup 2FA codes for Google and LastPass in my wallet and have been pretty happy with that strategy. A couple of years ago, I had my wallet fall out of my pocket while I was on a boat. My phone was back at the dock safe and dry so I had my primary authenticator. And I probably had printed copies somewhere at home. I've been much more diligent since then about making sure there are copies and that they're accessible.
- Latty 7y ago
- Spooky23 7y agoYes. Paper is best though. It is also sometimes in your interest to get things in the custody of an individual, ideally your attorney. If the owner of a deposit box becomes aware of your death, they will seal it until a court order is obtained.
- jdeibele 7y agoAt least in California, the bank opened it for me (as personal representative) so that a bank employee and I could inventory the contents. My aunt was a hoarder. At that point, I was actually relieved that the box was empty and I wouldn't have to go through the process of claiming the contents. My aunt was also somebody who bought gold and silver, something that was promoted heavily to people in conservative Orange County California when Obama became president and end times were near. Chase made it very clear that I was basically storing things at my own risk. I could deposit US coins from the 1880s at face value of $20 and get FDIC insurance. Instead, since they were about $1200 each at the time, I put them in the safe deposit box. Before that, in Oregon, my dad died but I was on the list of people allowed to use the box so I had access. That might be an option if there's somebody you really trust. The banks do charge about $100 to drill the lock if you lose the keys. It's possible that you could have somebody authorized to use the box but not give them a key.
- Spooky23 7y agoIn New York, the box is sealed once the death is known to the bank, and cannot be opened without the probate court’s permission. It creates problems when folks store their wills in the box!
- 7952 7y agoWhilst the security lapses are infuriating, I think this is really a domain for independent insurance cover.
- Thorrez 7y agoI would want to buy that insurance from the bank. If I buy the insurance from somewhere else, then the bank doesn't really have a financial incentive to keep my stuff safe.
- H8crilA 7y agoMeaning the insurance premium will be higher? I mean if X keeps it, Y insures it, then X loses it, Y still has to pay up, so you're covered. The only difference between X=Y or X!=Y could be in the premium that Y commands.
- Thorrez 7y agoYeah, I would expect the premium to be higher if the insurer knows there's not much incentive for the bank to protect the item. Also I consider a loss and insurance payout to be worse than no loss and no payout. Because it's a hassle to do the paperwork and rebuy items. And there might be sentimental items that a payout doesn't fully replace. So it's best to have a system that reduces the chance of a loss.
- 7952 7y agoAnd in all likelihood the insurance will be provided by another company and sold by a different department.
- dredmorbius 7y agoI don't think you do. You want the risk (bank malfeasance) and risk manager (insurance company) widely separated (agency risk, moral & morale hazard, conflicts of interest, etc.). The insurer should demand and receive rights to collect damages from the bank. The bank itself can insure that risk independently.
- belorn 7y agoHere in Sweden it has been very clear for the last 20 years that banks consider anything non-digital to be legacy and aspects of banking that should be closed down to reduce costs. They know where the profits are and where it scales.
- wesammikhail 7y agoAs far as I know, only a handful of banks in Stockholm still have safe deposit boxes. I even tried to start a safety deposit box business as a private non-bank related thing. I can´t even begin to describe to you what type of regulatory hurdles and red-tape I was faced with when trying to get that up and running. It´s pretty clear at this point that the entire system here is trying its hardest to reject everything of a non-digitalized and traceable nature. For the longest time I used to believe that it is because Sweden is first to embrace new "technology". I have now come to understand now that it is something completely different and it will come back to bite this country in the ass in the not too distant future. I would be surprised if our economy even survives another decade without some serious restructuring.
- kartan 7y ago> I can´t even begin to describe to you what type of regulatory hurdles and red-tape I was faced with when trying to get that up and running. I can imagine how harder it is than in the USA. From the article: "The combination of lax regulations and customers not paying attention to the fine print of their box-leasing agreements allows many banks to deflect responsibility when valuables are damaged or go missing." Consumer protection is usually is a hassle for business. But, it is needed if you expect companies to behave even close to what is the public expectation. I understand that for business the lax regulation in the USA and the complete lack of rights of consumers make easier to get profits, even if it's at the cost of your own customers. > I have now come to understand now that it is something completely different ... I would be surprised if our economy even survives another decade without some serious restructuring. These are very strong statements at the same time that quite vague. Did I miss something? Can you explain what do you mean?
- benj111 7y agoMatt Levine covered this a few days ago. https://www.bloomberg.com/opinion/articles/2019-07-22/don-t-put-your-valuables-in-the-bank https://www.bloomberg.com/opinion/articles/2019-07-22/don-t-...
- jraby3 7y agoHe actually repeatedly sites and quotes The NY Times article.
- benj111 7y agoYes? I find Matt Levine normally has an interesting and insightful way of looking at things, so I put it here.
- jccalhoun 7y agoThe phrase "a few days ago" made me initially think that Levine's article came first. I think the commenter was pointing out that Levine's article came after the posted one.
- stevekemp 7y agoFor the future it is "cites" rather than "sites".
- mnm1 7y agoWhat? Banks stealing from their customers? Why never. But seriously, who is surprised? That's what banks do. They steal. They steal small amounts in wrong fees. They steal huge amounts in bailouts. They steal medium amounts in between. And of course there is no regulation so there's no recourse. How surprising that an unregulated industry steals and fucks over its customers to the largest extent possible. Not. It's the American way. For people that have no morals and don't care about fucking over and hurting others, making money is easy especially in the US. I sometimes wish I fell into that category. I'd make millions as do all these entities and people with no conscience. The corporation is the perfect vehicle for such actions. But unlike the people running these banks, the people regulating them, and the people advocating against regulation, I have a conscience that doesn't allow me to get rich in this way. Expecting banks to behave in such a way is madness, however.
- anticensor 7y agoNorth American banks are regulated too, just in a very different (and more archaic way) from Eurasian system.
- kinleyd 7y ago"Wells Fargo had apparently tried to evict another customer for not keeping up with payments, and bank employees had mistakenly removed his box instead." Wow. The incompetence is truly amazing.
- hannob 7y agoI don't know how people who have jewelry worth millions usually act. But honestly... it strikes me as a bit odd that you'd put objects worth many millions in a box that costs a $246 fee per year and then expect high safety standards.
- cantrevealname 7y agoWhat would you do if you had jewelry worth millions? At first blush, a safe deposit box seems utterly logical. Even after reading the article, I can't think of any alternative other than avoiding Wells Fargo.
- perlgeek 7y agoBuy a safe in your own house, and then get insurance? Or rent a safe box and get separate insurance?
- deleted 7y ago[deleted]
- behringer 7y agoInsurance can't replace family heirlooms or unique works of art. Where do you keep this stuff safe?
- acollins1331 7y agoIf you have millions of dollars you store it in your house and spend the money to fireproof and thiefproof it.
- ghaff 7y agoSafety is a relative measure. Especially if your objective is to enjoy an article rather than stick it in a hopefully secure box somewhere.
- 7y ago
- methou 7y agoThe only things that sit in my safe deposit are password protected GPG paper keys, revocation certificates, and, OTP recovery sheets. There's a local bank near my workplace provides such a service, and I use them as a last resort of crypto id recovery. The downside is that they have a fingerprint system, but they do have a human agent to verify your identity.
- JabavuAdams 7y agoThose are some pretty important "only things". If you're concerned enough to have thought about and acted on this, why would you entrust these things to an inscrutable third-party?
- methou 7y agoThese are the 3rd parties that are held accountable by law and regulations.
- Youden 7y agoI live in Switzerland and even here you're usually not covered, despite the reputation for banking. You can buy separate insurance however and some non-bank safe deposit boxes come with insurance.
- BlackFly 7y agoIsn't this just covered by ordinary tort law? There is a duty of care, there is a lapse of said duty. The issue seems to be that people are putting valuable items into it and then signing a contract that says that the limit of liability is limited to much less than the value. If that isn't negotiable with the bank then the bank is just not willing to accept the risk. Then either you can find an insurer who is willing to accept the risk or you can find a different bank who is willing to accept the risk or you can build a safe yourself since all the risk is on you anyways. There doesn't need to be special laws for everything.
- onetimemanytime 7y agoOK, but even if there was no limit in damages, what did you have in there? How do you go about proving it when it's only you putting and taking things out of there.
- ghaff 7y agoThe same way you do with house contents for an insurance policy? Photos and other documentation are useful.And no insurance policy is going to be unlimited. Specific very high value items will be enumerated.
- derefr 7y agoThat's the job of a notary, usually.
- Digory 7y agoNot in the States. Our notaries glance at your ID before they countersign a document.
- derefr 7y agoThis is one of the other jobs of a notary: not vouching for identity, but rather signing off on a document stating that a collection of associated objects are what is described in the document. Such a document has the same sort of purpose as a certificate of authenticity you'd get from an appraiser; but you use a notary in cases where the thing doesn't need authentication to be valuable, instead being a liquid asset with a clear market value. The notary doesn't write down such a value, or even know it; they just sign off on a description of the item, knowing that the value can later be readily determined from the description by any interested party. Of course, to make this work, you need the notary to sign off on the contents of the collection right before you secure the collection into storage. Otherwise, you could just make arbitrary alterations to the contents yourself. For this reason—and because notaries don't usually like getting dragged all around town to vouch for things—usually a bank will retain the services of notary of their own, and offer it to safe-deposit-box users as an option. If a notary is used to vouch for the contents on first deposit, then a notary must be used on all further deposits/withdrawals to "retain the chain of custody." This turns the safe deposit box into a managed safe-deposit service.
- tacostakohashi 7y agoAs soon as there were multiple boxes with the same number in a single vault, this course of events was pretty much inevitable. If the bank is not competent enough to assign unique numbers to each box in the first place, of course they aren't going to be competent enough to only ever empty the correct one of several boxes numbered #105, or to handle to contents safely. It's difficult to comprehend how the bank thought having non-unique numbers would be workable. If non-unique deposit box numbers seems ok, why not non-unique bank account numbers? Or why even go up to #105, just number them all #1? I'm always fascinated when people find a way to undermine a simple, workable system and end up with something worse than no system, or the state of affairs before the system existed.
- amichal 7y agoI learned the hard way several years ago that a bank I used to have will happily cash two checks with the same check number the same amount and the the same recipient (on the same day even). Apparently check numbers are for my convenience not for any sort of auditing on their part.
- muzika 7y agoI had this happen once too, and was shocked that bank allowed same check to be deposited twice.
- dreamcompiler 7y agoLikewise signatures. https://news.ycombinator.com/item?id=4344941 https://news.ycombinator.com/item?id=4344941
- clintonb 7y agoThis is correct. When you order checks you decide The start number. Check processing is quite interesting. Banks can either be very lax or very restrictive in what checks they will accept.
- fencepost 7y agoIt seems that one of the most important things to start with is a page right at the top of the box with "IF THIS BOX HAD TO BE OPENED" followed by notes about payment for the box, multiple contact methods including through several third parties (friends, family, employers), etc. with mailing addresses, phone numbers, email for each. Heck, include several pre-addressed letters or envelopes with (in the USA) "Forever" stamps already on them. Work from a basis of "mistakes happen, how can I minimize the impact?"
- deleted 7y ago[deleted]
- cascom 7y agoOn the one hand, obviously the bank was incompetent. But shame on the guy in the article for not having his items insured. This is a pretty standard rider in most home owner’s insurance policies (or an easy separate policy). Typically the policy is incredibly cheap if the items are stored in a safe deposit box, and if you take them out you call the insurance company and tell them that, the items remain insured but at a higher daily rate, and you call the insurance company and tell them when the items go back in the box, and the rate goes back to the low rate.
- jdlshore 7y agoThe article doesn't say the items weren't insured. Shame on you for victim-blaming. It did talk about the sentimental value of a lifetime of collecting one-of-a-kind timepieces. That can't be replaced by an insurance payout.
- Simulacra 7y agoI think this goes to show that banks really don’t care about customers, and they don’t care if something goes wrong. They only care when they get caught and they have to pay for it.
- segmondy 7y agos/banks/most businesses/
- julienchastang 7y agoThe banking industry is rife with malfeasance and incompetence, Wells Fargo especially [1]. This is yet another example. [1] https://www.thinkadvisor.com/2018/07/30/a-timeline-of-wells-fargos-scandals https://www.thinkadvisor.com/2018/07/30/a-timeline-of-wells-...
- mitchtbaum 7y agoDon't have access to a decommissioned mine? Nor, a deep underground military base? Well, you're still in luck. You can search how to bury your stuff, ie: http://www.howtoburyyourstuff.com/ http://www.howtoburyyourstuff.com/ Really.
- nullc 7y agoAfter looking at that site I expect that if I could find the author's full name and googled it, the results would be full of posts at metal detecting forums. The whole site appears to be really bad advice-- instructing you to bury large metal containers of your valuable stuff on land that isn't yours. It is the stuff of detectorists fantasies.
- mitchtbaum 7y ago>~ land that is/isn't yours You have that the other way around... > ..if I could find.. ..would be full.. ..fantasies. Would you want to bet on how these guesses will pan out and see how this approach looks after sincere efforts to analyze it (for wealth preservation or other uses)? > that site There'rrr others worth looking at; probably others that contradict a good portion of it, or just have another point of view.