6 ms·

If you actually RTFA, it was the client that was hacked, not the bank. The client's passwords were compromised, and then the bank's services were accessed norma

If you actually RTFA, it was the client that was hacked, not the bank. The client's passwords were compromised, and then the bank's services were accessed normally with the compromised passwords. The client's logic is that the bank should take the loss for this. I know we all hate the banks but seriously? You get hacked and suddenly the service I provide to you being compromised is my fault? Sorry, the judge is right here.

enjo 15y ago
Maybe banks should be responsible for stronger protection than a simple password?
- run4yourlives 15y ago
  Maybe, but if you're okay with that when you do business with them, you can't exactly complain about it when things go wrong.
  - lukeschlather 15y ago
    Expecting people who know nothing about security to make an informed decision is unreasonable. It's much like expecting people to choose a building that won't fall over in an earthquake when they aren't architects - the responsibility lies with the architect for claiming that the security is good enough, not with the customer for trusting the expert.
    - run4yourlives 15y ago
      ? You're suggesting that if I place a lock on your door, and you and I both agree that it is adequate, that it is my fault that you lose your keys and have your TV stolen because I should have known that a lock is not good enough and you should have had an alarm system as well.... Seriously, have some bit of personal responsibility.
      - tptacek 15y ago
        The degree of "personal responsibility" you're alluding to here is unreasonable to apply to a regional commercial construction firm. It is simply not feasible for most businesses to keep a password-only protected online bank login secure using general-purpose operating systems, and particular not with Windows. You're commenting because you know that: * The firm could have dedicated a machine to do nothing but provide access to the bank account, perhaps from a single-use VM * The firm could have structured its bank accounts so that only a minimal amount of its cash flow would be exposed to any single compromise * The firm could have aggressively monitored transfers in and out on a better than daily basis I'm telling you that (a) getting these things set up is a 5-figure consulting project that no bank tells its client base it needs to do, (b) that it is vanishingly unlikely that the bank made sure the client was informed that it needed to take these steps, (c) that failing to do that and leaving accounts exposed only to simple passwords is probably an example of a failure of due care, and (d) that the simplest and most reasonable way to solve all of these issues would be for the bank to simply strengthen its authentication mechanisms for commercial accounts.
        run4yourlives 15y ago
        You are placing a ridiculous expectation on the service provider while excusing the client using any form of security at all! Sorry, but in 2011 it is not beyond reasonable expectation that a password be kept secret. Getting hacked sucks, certainly. Your company being hacked however is not the liability of your service providers, even if they are banks.
        tptacek 15y ago
        Speak to the people deploying multifactor and reputational authentication at major banks, and to a one, they will tell you that it is not considered a reasonable expectation that Windows systems be kept intact in order to secure bank accounts. Banks can't come out and simply say that because of market realities (there are lots of market realities involving software security that terribly impact your day to day life) and concomitant liability.
- rick888 15y ago
  If I shot you, would it be your fault because you weren't wearing a bullet-proof vest?
  - run4yourlives 15y ago
    Um, no. If you shot Mr. Smith over there, who was wearing one of my bullet-proof vests, but didn't do up the zipper/velcro, it's not my fault.
    - ilikepi 15y ago
      At least in the US, if you didn't put a stern warning about doing up the zipper/velcro in the vest's instruction manual, I'd be willing to bet there'd be plenty of lawyers who would gladly sue you on behalf of Mr. Smith's estate. Sadly, there would probably be some juries who would find in the estate's favor, too.
- chriserin 15y ago
  Along those same lines, if a hacker took advantage of a vulnerability in the banks application, but only after gaining access to that vulnerability through credentials stolen from a client/customer, is the client responsible for weak credentials protection in that instance as well? This is a slippery slope.
  - run4yourlives 15y ago
    That would probably be awarded 50/50.
    - tptacek 15y ago
      If the theft was abetted by a product fault in the banks own code, my guess is that the client would get 100 + legal fees.
deleted 15y ago
[deleted]
tptacek 15y ago
A bank is in a better position to protect electronic access to the account than the consumer is. This bank provides simple username/password authentication to an Internet service that allows transfers of hundreds of thousands of dollars at a time to entities that a business has never worked with in the past. Offering that service with that level of protection without assuming any liability for the result is borderline negligent.
- Macha 15y ago
  So? Linode is in a better position to prevent misuse of my VPS than I am. They can cut it off from the network and they have staff which would notice if it suddenly sent 40,000 emails. Does that make them liable if my server gets rooted because of software I install (say Apache 1.3.1 or something) and whoever rooted it installed a mail server on it to send spam from?
  - tptacek 15y ago
    I don't see the analogy here at all. The whole point of Linode is to allow you to take responsibility for your own random software. The point of bank security --- in fact, a good part of the point of banks, period --- is to limit access to your funds. Imagine if instead of passwords, the typical bank required a four-digit PIN. Imagine the bank did everything reasonable to meet best practices standards for validating PINs (for instance, requiring reset of PIN after N incorrect entries). Would anyone think it was reasonable for a bank to stake an entire business cash flow on a four digit PIN? In 2011, the password is only marginally more secure than the PIN. That this is for reasons outside the bank's control is no more relevant than it would be with four-digit PINs. The bank should in all cases be responsible for deploying electronic security measures generally recognized by those skilled in the art as reasonably effective. The bank is in all cases responsible for taking "due care" with the security of its accounts. Leaving them exposed to wild high-value money transfers should, and probably does, contravene the due care standard.
- run4yourlives 15y ago
  There is nothing that the bank was doing that was so far from the normal practice of securing a website that constitutes negligence. They were even following a published standard. It's unreasonable to expect the bank to be so overly concerned with their customer's security and excuse the business for not being so with their own.
atakan_gurkan 15y ago
Bruce Scheiner said this many many times: it is the transactions that needs to be authenticated, not the client. This is what credit card companies do (sometimes overzealously). The transactions mentioned in the article sound very unusual, a trivial authentication mechanism would have caught them. The judge is right, since he rules by looking at current laws, but the current laws themselves seem out of date.

enjo 15y ago

Maybe banks should be responsible for stronger protection than a simple password?

run4yourlives 15y ago
Maybe, but if you're okay with that when you do business with them, you can't exactly complain about it when things go wrong.
- lukeschlather 15y ago
  Expecting people who know nothing about security to make an informed decision is unreasonable. It's much like expecting people to choose a building that won't fall over in an earthquake when they aren't architects - the responsibility lies with the architect for claiming that the security is good enough, not with the customer for trusting the expert.
  - run4yourlives 15y ago
    ? You're suggesting that if I place a lock on your door, and you and I both agree that it is adequate, that it is my fault that you lose your keys and have your TV stolen because I should have known that a lock is not good enough and you should have had an alarm system as well.... Seriously, have some bit of personal responsibility.
    - tptacek 15y ago
      The degree of "personal responsibility" you're alluding to here is unreasonable to apply to a regional commercial construction firm. It is simply not feasible for most businesses to keep a password-only protected online bank login secure using general-purpose operating systems, and particular not with Windows. You're commenting because you know that: * The firm could have dedicated a machine to do nothing but provide access to the bank account, perhaps from a single-use VM * The firm could have structured its bank accounts so that only a minimal amount of its cash flow would be exposed to any single compromise * The firm could have aggressively monitored transfers in and out on a better than daily basis I'm telling you that (a) getting these things set up is a 5-figure consulting project that no bank tells its client base it needs to do, (b) that it is vanishingly unlikely that the bank made sure the client was informed that it needed to take these steps, (c) that failing to do that and leaving accounts exposed only to simple passwords is probably an example of a failure of due care, and (d) that the simplest and most reasonable way to solve all of these issues would be for the bank to simply strengthen its authentication mechanisms for commercial accounts.
      - run4yourlives 15y ago
        You are placing a ridiculous expectation on the service provider while excusing the client using any form of security at all! Sorry, but in 2011 it is not beyond reasonable expectation that a password be kept secret. Getting hacked sucks, certainly. Your company being hacked however is not the liability of your service providers, even if they are banks.
        tptacek 15y ago
        Speak to the people deploying multifactor and reputational authentication at major banks, and to a one, they will tell you that it is not considered a reasonable expectation that Windows systems be kept intact in order to secure bank accounts. Banks can't come out and simply say that because of market realities (there are lots of market realities involving software security that terribly impact your day to day life) and concomitant liability.
rick888 15y ago
If I shot you, would it be your fault because you weren't wearing a bullet-proof vest?
- run4yourlives 15y ago
  Um, no. If you shot Mr. Smith over there, who was wearing one of my bullet-proof vests, but didn't do up the zipper/velcro, it's not my fault.
  - ilikepi 15y ago
    At least in the US, if you didn't put a stern warning about doing up the zipper/velcro in the vest's instruction manual, I'd be willing to bet there'd be plenty of lawyers who would gladly sue you on behalf of Mr. Smith's estate. Sadly, there would probably be some juries who would find in the estate's favor, too.
chriserin 15y ago
Along those same lines, if a hacker took advantage of a vulnerability in the banks application, but only after gaining access to that vulnerability through credentials stolen from a client/customer, is the client responsible for weak credentials protection in that instance as well? This is a slippery slope.
- run4yourlives 15y ago
  That would probably be awarded 50/50.
  - tptacek 15y ago
    If the theft was abetted by a product fault in the banks own code, my guess is that the client would get 100 + legal fees.

deleted 15y ago

[deleted]

tptacek 15y ago

A bank is in a better position to protect electronic access to the account than the consumer is. This bank provides simple username/password authentication to an Internet service that allows transfers of hundreds of thousands of dollars at a time to entities that a business has never worked with in the past. Offering that service with that level of protection without assuming any liability for the result is borderline negligent.

Macha 15y ago
So? Linode is in a better position to prevent misuse of my VPS than I am. They can cut it off from the network and they have staff which would notice if it suddenly sent 40,000 emails. Does that make them liable if my server gets rooted because of software I install (say Apache 1.3.1 or something) and whoever rooted it installed a mail server on it to send spam from?
- tptacek 15y ago
  I don't see the analogy here at all. The whole point of Linode is to allow you to take responsibility for your own random software. The point of bank security --- in fact, a good part of the point of banks, period --- is to limit access to your funds. Imagine if instead of passwords, the typical bank required a four-digit PIN. Imagine the bank did everything reasonable to meet best practices standards for validating PINs (for instance, requiring reset of PIN after N incorrect entries). Would anyone think it was reasonable for a bank to stake an entire business cash flow on a four digit PIN? In 2011, the password is only marginally more secure than the PIN. That this is for reasons outside the bank's control is no more relevant than it would be with four-digit PINs. The bank should in all cases be responsible for deploying electronic security measures generally recognized by those skilled in the art as reasonably effective. The bank is in all cases responsible for taking "due care" with the security of its accounts. Leaving them exposed to wild high-value money transfers should, and probably does, contravene the due care standard.
run4yourlives 15y ago
There is nothing that the bank was doing that was so far from the normal practice of securing a website that constitutes negligence. They were even following a published standard. It's unreasonable to expect the bank to be so overly concerned with their customer's security and excuse the business for not being so with their own.

atakan_gurkan 15y ago

Bruce Scheiner said this many many times: it is the transactions that needs to be authenticated, not the client. This is what credit card companies do (sometimes overzealously). The transactions mentioned in the article sound very unusual, a trivial authentication mechanism would have caught them. The judge is right, since he rules by looking at current laws, but the current laws themselves seem out of date.