4 ms·

This is pretty bizarre. I imagine it's due to user complaints about not being able to make trades while behind very strict corporate firewalls? Weird.

tialaramex 6y ago
Their site claims it might be faster. Which totally made sense a decade or two ago, and they've been in this game for a very long time (the company itself pre-dates the Web substantially). Is it faster today? Probably not. And if you're trading from a phone app, the chances your execution happening 100ms later ruins your day is very tiny. Whereas if bad guys snoop your WiFi, MitM your login and use your capital to run the other side of a stupid scam (e.g. buying some penny stock with all your investment savings) that's really going to ruin your whole year. I can most easily imagine they had a proprietary setup in the 1990s, and one day they make a web site because of this exciting new technology. Should it have SSL? Security sounds good, but it is slower. Traders demand an option. Now, fast forward a few years you're building an iPhone app, your prototype looks good, but traders ask, where is that SSL option? Chances are the answer is "Um, TLS is always On? Because switching it Off would be stupid?". Oh dear, are you calling a long time customer "stupid" for not clicking the SSL box all these years? No of course you aren't, you add the SSL box to the app and everybody working on it learns not to point out that this is stupid.
- dmurray 6y ago
  They do at least have almost-mandatory 2FA through SMS or Android app. So it's not quite as insecure as someone reading your email or snooping your WiFi getting the keys to the kingdom.
  - tialaramex 6y ago
    If you just have something scooping up all unencrypted data (which is something any bored teenager might set up) then you get a password but the OTP codes will be useless shortly afterwards and, if the implementation is competent immediately useless in another session once used. [ Do I trust that they got that right? Maybe. Others might have a better idea how many off-the-shelf OTP implementations handle this correctly ] However an active MitM just works. You give the user the illusion they're talking directly to the real system, but you actually keep working copies of their logged in state. When they're done trading, you just carry on. If there's an explicit "Log out" step you can dummy that out. Forget passwords and OTP, even something modern like Security Keys (WebAuthn) would fall to this - except WebAuthn's APIs magically don't exist unless you have secure context (basically an HTTPS site) so for the web that can't happen. If you used the built-in Android / iOS FIDO implementation† and stupidly did HTTP backend in your app, you'd be screwed. † In this scenario, you're getting the same features as WebAuthn but backed by your device biometrics, and with a custom per-app identifier instead of a DNS name to stop you stealing the user's Google authentication or whatever.

tialaramex 6y ago

Their site claims it might be faster. Which totally made sense a decade or two ago, and they've been in this game for a very long time (the company itself pre-dates the Web substantially). Is it faster today? Probably not. And if you're trading from a phone app, the chances your execution happening 100ms later ruins your day is very tiny. Whereas if bad guys snoop your WiFi, MitM your login and use your capital to run the other side of a stupid scam (e.g. buying some penny stock with all your investment savings) that's really going to ruin your whole year. I can most easily imagine they had a proprietary setup in the 1990s, and one day they make a web site because of this exciting new technology. Should it have SSL? Security sounds good, but it is slower. Traders demand an option. Now, fast forward a few years you're building an iPhone app, your prototype looks good, but traders ask, where is that SSL option? Chances are the answer is "Um, TLS is always On? Because switching it Off would be stupid?". Oh dear, are you calling a long time customer "stupid" for not clicking the SSL box all these years? No of course you aren't, you add the SSL box to the app and everybody working on it learns not to point out that this is stupid.

dmurray 6y ago
They do at least have almost-mandatory 2FA through SMS or Android app. So it's not quite as insecure as someone reading your email or snooping your WiFi getting the keys to the kingdom.
- tialaramex 6y ago
  If you just have something scooping up all unencrypted data (which is something any bored teenager might set up) then you get a password but the OTP codes will be useless shortly afterwards and, if the implementation is competent immediately useless in another session once used. [ Do I trust that they got that right? Maybe. Others might have a better idea how many off-the-shelf OTP implementations handle this correctly ] However an active MitM just works. You give the user the illusion they're talking directly to the real system, but you actually keep working copies of their logged in state. When they're done trading, you just carry on. If there's an explicit "Log out" step you can dummy that out. Forget passwords and OTP, even something modern like Security Keys (WebAuthn) would fall to this - except WebAuthn's APIs magically don't exist unless you have secure context (basically an HTTPS site) so for the web that can't happen. If you used the built-in Android / iOS FIDO implementation† and stupidly did HTTP backend in your app, you'd be screwed. † In this scenario, you're getting the same features as WebAuthn but backed by your device biometrics, and with a custom per-app identifier instead of a DNS name to stop you stealing the user's Google authentication or whatever.