4 ms·

Treat it like financial or banking fraud. You can't stop someone taking it, but you can audit the hell out of it so when stuff gets misappropriated you can fin

by eterm 6y ago

Treat it like financial or banking fraud. You can't stop someone taking it, but you can audit the hell out of it so when stuff gets misappropriated you can find out exactly who was responsible. Then the law becomes the deterrent.

rndgermandude 6y ago
The problem with this is that first somebody has to notice. In banking the reports will flow in quickly if somebody lost money. In Roblox, when somebody created in-game currency out of thin air or accesses private information of other people, then chances are nobody notices and the audit logs are never manually investigated. Doing automated audits then again brings up the question: how do you determine if something was the result of a genuine support action or fraudulent. You can try to find/train algorithms to detect that, but given that you can only train it against common fraudulent patterns, and do not know about unreported cases by the very definition, you cannot be sure such a system is operating well and/or cannot be easily gamed. Banks have it easier in that regard, because the books have to match end of the day. The law being the deterrent didn't really help here either. According to the article the "hacker" either bribed somebody for access, phished somebody for access or used some vulnerability to gain access. All of which isn't exactly legal, so the deterrent already did not work, tho it might make your own employees think twice about accepting bribes. But the hacker probably will not care about your audit system beyond the point of defeating it long enough to gain whatever they were out to gain.
- deleted 6y ago
  [deleted]
mulmen 6y ago
Right because there's no fraud in the financial sector. The last time my debit card got stolen the fraud people at my credit union suggested checking my account daily to catch it as soon as it happens again. They didn't really even expect to be able to prevent it. Or pretend like they would try. It's apparently my responsibility to make sure they didn't just hand out some of my money to whoever walked by and asked for it. They never know exactly who was responsible because they were responsible. Of course the law doesn't see it that way.
- rexarex 6y ago
  get a real bank.
  - mulmen 6y ago
    Banks don’t take more responsibility for participating in fraud than credit unions. The law puts the burden on consumers to both detect fraud and ask politely to have their money returned. At least with a credit union the customer service is a bit better because incentives are more aligned.

by eterm 6y ago

rndgermandude 6y ago

The problem with this is that first somebody has to notice. In banking the reports will flow in quickly if somebody lost money. In Roblox, when somebody created in-game currency out of thin air or accesses private information of other people, then chances are nobody notices and the audit logs are never manually investigated. Doing automated audits then again brings up the question: how do you determine if something was the result of a genuine support action or fraudulent. You can try to find/train algorithms to detect that, but given that you can only train it against common fraudulent patterns, and do not know about unreported cases by the very definition, you cannot be sure such a system is operating well and/or cannot be easily gamed. Banks have it easier in that regard, because the books have to match end of the day. The law being the deterrent didn't really help here either. According to the article the "hacker" either bribed somebody for access, phished somebody for access or used some vulnerability to gain access. All of which isn't exactly legal, so the deterrent already did not work, tho it might make your own employees think twice about accepting bribes. But the hacker probably will not care about your audit system beyond the point of defeating it long enough to gain whatever they were out to gain.

deleted 6y ago
[deleted]

mulmen 6y ago

Right because there's no fraud in the financial sector. The last time my debit card got stolen the fraud people at my credit union suggested checking my account daily to catch it as soon as it happens again. They didn't really even expect to be able to prevent it. Or pretend like they would try. It's apparently my responsibility to make sure they didn't just hand out some of my money to whoever walked by and asked for it. They never know exactly who was responsible because they were responsible. Of course the law doesn't see it that way.

rexarex 6y ago
get a real bank.
- mulmen 6y ago
  Banks don’t take more responsibility for participating in fraud than credit unions. The law puts the burden on consumers to both detect fraud and ask politely to have their money returned. At least with a credit union the customer service is a bit better because incentives are more aligned.