6 ms·

It seems you're not getting serious answers here, so here's my take. Please report this via the US-CERT at https://www.us-cert.gov/report https://www.us-cert.g

It seems you're not getting serious answers here, so here's my take. Please report this via the US-CERT at https://www.us-cert.gov/report https://www.us-cert.gov/report This will allow you to report it, eventually from an anonymous email address, without exposing you directly to the bank which might react bad to you. CERT can handle the coordination with the bank, this is what they do.

speculator 7y ago
Really good suggestion. And in case they still need encouragement, some negative press coverage might get them going. Right person for this -> https://krebsonsecurity.com/ https://krebsonsecurity.com/
- jakub_g 7y ago
  Came here to write that. Either Krebs or https://www.troyhunt.com https://www.troyhunt.com
  - hamiltonc 7y ago
    And this: https://robertheaton.com/2020/02/07/send-me-your-privacy-abuse-tipoffs/ https://robertheaton.com/2020/02/07/send-me-your-privacy-abu...
- sneak 7y ago
  I do not think that recommending Brian Krebs is a good idea for someone who might wish to avoid retaliation. Recently, he doxxed some people on Twitter for reporting bugs. https://www.itwire.com/security/infosec-researchers-slam-ex-wapo-man-krebs-over-doxxing.html https://www.itwire.com/security/infosec-researchers-slam-ex-... As a result, I no longer visit his site or recommend his work. Publishing someone else’s personal data without consent is a terrible thing, and is one of the reasons so many of us work to secure systems. His behavior undermines that.
  - guiambros 7y ago
    "Krebs appears to have form in outing people who do not agree with him. Back in 2014, he posted the CV of an individual who had written what he characterised as a bad review of a book he authored." When British security researcher Marcus Hutchins asked whether doxxing a person for this was going a bit too far, his response was: "Dox people? Hardly. I think it helps to add context. The guy is a convicted cybercrook who's in jail. Of course he hates me." Ouch. This is sad. I used to have a lot of respect for the guy.
dontbenebby 7y ago
This very looks cool, thank you for sharing parent. I apologize for the nitpick, but I hope there will be some guidance on what an "anonymous" email is. (Ex: Guerilla at a public wifi like a library, an email created at a library, but not your usual email from a place other than your home) I worry sometimes that we assume people reporting security vulnerabilities will be security experts. I often meet people who are intelligent and technical, but either do not understand security, or understand it in terms of confidentiality, integrity, and availability (CIA triad) and flounder when thinking about anonymity.
- wry_discontent 7y ago
  Out of curiosity, what's the point of the anonymous email? Why not just use my regular email?
  - overflow897 7y ago
    "Person X reported a vulnerability, they must be a hacker! Get our lawyers" - Some non-technical bank person. Most companies don't like having their mistakes publicly exposed.
- ghostpepper 7y ago
  > I often meet people who are intelligent and technical, but either do not understand security, or understand it in terms of confidentiality, integrity, and availability (CIA triad) and flounder when thinking about anonymity. Can you suggest any resources for a technical user who would like to learn more about this distinction?
  - schoen 7y ago
    You might like some of the papers at https://www.freehaven.net/anonbib/ https://www.freehaven.net/anonbib/
    - dontbenebby 7y ago
      A good one to start with would be this paper: https://www.freehaven.net/anonbib/cache/chaum-mix.pdf https://www.freehaven.net/anonbib/cache/chaum-mix.pdf It's one of the earliest and very well cited.
deleted 7y ago
[deleted]
lawnchair_larry 7y ago
I don’t think this is the type of thing US-CERT handles.

speculator 7y ago

Really good suggestion. And in case they still need encouragement, some negative press coverage might get them going. Right person for this -> https://krebsonsecurity.com/ https://krebsonsecurity.com/

jakub_g 7y ago
Came here to write that. Either Krebs or https://www.troyhunt.com https://www.troyhunt.com
- hamiltonc 7y ago
  And this: https://robertheaton.com/2020/02/07/send-me-your-privacy-abuse-tipoffs/ https://robertheaton.com/2020/02/07/send-me-your-privacy-abu...
sneak 7y ago
I do not think that recommending Brian Krebs is a good idea for someone who might wish to avoid retaliation. Recently, he doxxed some people on Twitter for reporting bugs. https://www.itwire.com/security/infosec-researchers-slam-ex-wapo-man-krebs-over-doxxing.html https://www.itwire.com/security/infosec-researchers-slam-ex-... As a result, I no longer visit his site or recommend his work. Publishing someone else’s personal data without consent is a terrible thing, and is one of the reasons so many of us work to secure systems. His behavior undermines that.
- guiambros 7y ago
  "Krebs appears to have form in outing people who do not agree with him. Back in 2014, he posted the CV of an individual who had written what he characterised as a bad review of a book he authored." When British security researcher Marcus Hutchins asked whether doxxing a person for this was going a bit too far, his response was: "Dox people? Hardly. I think it helps to add context. The guy is a convicted cybercrook who's in jail. Of course he hates me." Ouch. This is sad. I used to have a lot of respect for the guy.

dontbenebby 7y ago

This very looks cool, thank you for sharing parent. I apologize for the nitpick, but I hope there will be some guidance on what an "anonymous" email is. (Ex: Guerilla at a public wifi like a library, an email created at a library, but not your usual email from a place other than your home) I worry sometimes that we assume people reporting security vulnerabilities will be security experts. I often meet people who are intelligent and technical, but either do not understand security, or understand it in terms of confidentiality, integrity, and availability (CIA triad) and flounder when thinking about anonymity.

wry_discontent 7y ago
Out of curiosity, what's the point of the anonymous email? Why not just use my regular email?
- overflow897 7y ago
  "Person X reported a vulnerability, they must be a hacker! Get our lawyers" - Some non-technical bank person. Most companies don't like having their mistakes publicly exposed.
ghostpepper 7y ago
> I often meet people who are intelligent and technical, but either do not understand security, or understand it in terms of confidentiality, integrity, and availability (CIA triad) and flounder when thinking about anonymity. Can you suggest any resources for a technical user who would like to learn more about this distinction?
- schoen 7y ago
  You might like some of the papers at https://www.freehaven.net/anonbib/ https://www.freehaven.net/anonbib/
  - dontbenebby 7y ago
    A good one to start with would be this paper: https://www.freehaven.net/anonbib/cache/chaum-mix.pdf https://www.freehaven.net/anonbib/cache/chaum-mix.pdf It's one of the earliest and very well cited.

deleted 7y ago

[deleted]

lawnchair_larry 7y ago

I don’t think this is the type of thing US-CERT handles.