4 ms·

Only peripherally related but after the recent Robinhood fiasco I downloaded the Interactive Brokers mobile app, and they send your login user/password in plain

Only peripherally related but after the recent Robinhood fiasco I downloaded the Interactive Brokers mobile app, and they send your login user/password in plaintext: https://twitter.com/arkadiyt/status/1356054340008460293 https://twitter.com/arkadiyt/status/1356054340008460293

nickysielicki 6y ago
This is pretty bizarre. I imagine it's due to user complaints about not being able to make trades while behind very strict corporate firewalls? Weird.
- tialaramex 6y ago
  Their site claims it might be faster. Which totally made sense a decade or two ago, and they've been in this game for a very long time (the company itself pre-dates the Web substantially). Is it faster today? Probably not. And if you're trading from a phone app, the chances your execution happening 100ms later ruins your day is very tiny. Whereas if bad guys snoop your WiFi, MitM your login and use your capital to run the other side of a stupid scam (e.g. buying some penny stock with all your investment savings) that's really going to ruin your whole year. I can most easily imagine they had a proprietary setup in the 1990s, and one day they make a web site because of this exciting new technology. Should it have SSL? Security sounds good, but it is slower. Traders demand an option. Now, fast forward a few years you're building an iPhone app, your prototype looks good, but traders ask, where is that SSL option? Chances are the answer is "Um, TLS is always On? Because switching it Off would be stupid?". Oh dear, are you calling a long time customer "stupid" for not clicking the SSL box all these years? No of course you aren't, you add the SSL box to the app and everybody working on it learns not to point out that this is stupid.
  - dmurray 6y ago
    They do at least have almost-mandatory 2FA through SMS or Android app. So it's not quite as insecure as someone reading your email or snooping your WiFi getting the keys to the kingdom.
    - tialaramex 6y ago
      If you just have something scooping up all unencrypted data (which is something any bored teenager might set up) then you get a password but the OTP codes will be useless shortly afterwards and, if the implementation is competent immediately useless in another session once used. [ Do I trust that they got that right? Maybe. Others might have a better idea how many off-the-shelf OTP implementations handle this correctly ] However an active MitM just works. You give the user the illusion they're talking directly to the real system, but you actually keep working copies of their logged in state. When they're done trading, you just carry on. If there's an explicit "Log out" step you can dummy that out. Forget passwords and OTP, even something modern like Security Keys (WebAuthn) would fall to this - except WebAuthn's APIs magically don't exist unless you have secure context (basically an HTTPS site) so for the web that can't happen. If you used the built-in Android / iOS FIDO implementation† and stupidly did HTTP backend in your app, you'd be screwed. † In this scenario, you're getting the same features as WebAuthn but backed by your device biometrics, and with a custom per-app identifier instead of a DNS name to stop you stealing the user's Google authentication or whatever.
bluesign 6y ago
I don't think this is true (plaintext part), maybe they are doing some custom encryption for snoopy corporate firewalls.
- tialaramex 6y ago
  Very doubtful. Traders tend to prize speed over all other considerations, and so I'm sure at some point somebody with a Pentium running Windows 95 said this would be faster without SSL. And it really would be (on a sufficiently crappy machine, and assuming you're doing HTTP/1.1) but most of us have long since reasoned that "faster but now I don't have any security" is a bad trade and also meanwhile faster encrypted-only alternatives emerged. They've got a custom OTP setup which they've revised at least twice already, but as with this Clubhouse thing if you transmit your OTP as plaintext over unencrypted channels obviously a bad guy can intercept that. So basically that SSL box ought to be removed (in favour of always doing TLS) or at the very least default checked.
mmaunder 6y ago
They’re not exactly security literate. Here is IB defending no pasting of passwords from a password manager. I tweeted this early last year and I guess Troy Hunt just revived the issue with them. https://twitter.com/mmaunder/status/1243592529855078406?s=21 https://twitter.com/mmaunder/status/1243592529855078406?s=21
- alexdumitru 6y ago
  ING Bank forces me to use exactly 5 numbers as my password. That happened after an update 2 years ago, when I had a long and safe password. They forced me to "update to a more secure password". So 12 characters is not secure, 4 numbers is not secure, 6 numbers is not secure either. 5 numbers is the best security!
ozim 6y ago
Well I expect Android since 2018 to force use of https when you create an app. So from my knowledge to make it not tls takes more effort than otherwise. They actively have to 'hack' around this requirement.
- fredgrott 6y ago
  more than that as they have to use old tls libs no longer maintained and no longer receive security patches ouch!

nickysielicki 6y ago

This is pretty bizarre. I imagine it's due to user complaints about not being able to make trades while behind very strict corporate firewalls? Weird.

tialaramex 6y ago
Their site claims it might be faster. Which totally made sense a decade or two ago, and they've been in this game for a very long time (the company itself pre-dates the Web substantially). Is it faster today? Probably not. And if you're trading from a phone app, the chances your execution happening 100ms later ruins your day is very tiny. Whereas if bad guys snoop your WiFi, MitM your login and use your capital to run the other side of a stupid scam (e.g. buying some penny stock with all your investment savings) that's really going to ruin your whole year. I can most easily imagine they had a proprietary setup in the 1990s, and one day they make a web site because of this exciting new technology. Should it have SSL? Security sounds good, but it is slower. Traders demand an option. Now, fast forward a few years you're building an iPhone app, your prototype looks good, but traders ask, where is that SSL option? Chances are the answer is "Um, TLS is always On? Because switching it Off would be stupid?". Oh dear, are you calling a long time customer "stupid" for not clicking the SSL box all these years? No of course you aren't, you add the SSL box to the app and everybody working on it learns not to point out that this is stupid.
- dmurray 6y ago
  They do at least have almost-mandatory 2FA through SMS or Android app. So it's not quite as insecure as someone reading your email or snooping your WiFi getting the keys to the kingdom.
  - tialaramex 6y ago
    If you just have something scooping up all unencrypted data (which is something any bored teenager might set up) then you get a password but the OTP codes will be useless shortly afterwards and, if the implementation is competent immediately useless in another session once used. [ Do I trust that they got that right? Maybe. Others might have a better idea how many off-the-shelf OTP implementations handle this correctly ] However an active MitM just works. You give the user the illusion they're talking directly to the real system, but you actually keep working copies of their logged in state. When they're done trading, you just carry on. If there's an explicit "Log out" step you can dummy that out. Forget passwords and OTP, even something modern like Security Keys (WebAuthn) would fall to this - except WebAuthn's APIs magically don't exist unless you have secure context (basically an HTTPS site) so for the web that can't happen. If you used the built-in Android / iOS FIDO implementation† and stupidly did HTTP backend in your app, you'd be screwed. † In this scenario, you're getting the same features as WebAuthn but backed by your device biometrics, and with a custom per-app identifier instead of a DNS name to stop you stealing the user's Google authentication or whatever.

bluesign 6y ago

I don't think this is true (plaintext part), maybe they are doing some custom encryption for snoopy corporate firewalls.

tialaramex 6y ago
Very doubtful. Traders tend to prize speed over all other considerations, and so I'm sure at some point somebody with a Pentium running Windows 95 said this would be faster without SSL. And it really would be (on a sufficiently crappy machine, and assuming you're doing HTTP/1.1) but most of us have long since reasoned that "faster but now I don't have any security" is a bad trade and also meanwhile faster encrypted-only alternatives emerged. They've got a custom OTP setup which they've revised at least twice already, but as with this Clubhouse thing if you transmit your OTP as plaintext over unencrypted channels obviously a bad guy can intercept that. So basically that SSL box ought to be removed (in favour of always doing TLS) or at the very least default checked.

mmaunder 6y ago

They’re not exactly security literate. Here is IB defending no pasting of passwords from a password manager. I tweeted this early last year and I guess Troy Hunt just revived the issue with them. https://twitter.com/mmaunder/status/1243592529855078406?s=21 https://twitter.com/mmaunder/status/1243592529855078406?s=21

alexdumitru 6y ago
ING Bank forces me to use exactly 5 numbers as my password. That happened after an update 2 years ago, when I had a long and safe password. They forced me to "update to a more secure password". So 12 characters is not secure, 4 numbers is not secure, 6 numbers is not secure either. 5 numbers is the best security!

ozim 6y ago

Well I expect Android since 2018 to force use of https when you create an app. So from my knowledge to make it not tls takes more effort than otherwise. They actively have to 'hack' around this requirement.

fredgrott 6y ago
more than that as they have to use old tls libs no longer maintained and no longer receive security patches ouch!