17 ms·

The 74,000 numbers of Barclays Bank

103 points by kristianp 5y ago

zimpenfish 5y ago
I tested the 44k optimised Perl regexp but it seemed to let through some other stuff - i.e. replacing the leading 0 with 8 allowed through a bunch of numbers that aren't on the original list. e.g. changing 02071160299 to 82071160299 still appears to pass the regexp.
- zamadatix 5y ago
  Probably the cardinal sin of regex: forgetting the anchors. Also something really weird: when I view zimpenfish's comment in the post it shows as 54 minutes old which makes sense, when I click it to view direct or reply it shows as 2 days old which is really wonky. Any idea what is going on there? https://i.imgur.com/DvBDcIL.png https://i.imgur.com/DvBDcIL.png
  - skinkestek 5y ago
    That's funny... Might be something that got resubmitted from the second chance pool and then automatical rewrite only did half the work it should or something is cached or something similar?
    - zamadatix 5y ago
      Oooh, I bet you're right!
    - detaro 5y ago
      AFAIK dang said that's intentional. The view on the thread gets faked to look consistent, but they don't want to modify the actual metadata of the comment you see in the direct view, and something is always going to be "wrong" however you do it.
- Recursing 5y ago
  https://shkspr.mobi/blog/2021/05/the-74000-numbers-of-barclays-bank/#comment-215502 https://shkspr.mobi/blog/2021/05/the-74000-numbers-of-barcla... it's mentioned in another comment that indeed they forgot the anchors The "correct" regex is 11KB and can be found here https://gist.github.com/jes/e678e4300d1cfcbcc12b46aaa7e58e30 https://gist.github.com/jes/e678e4300d1cfcbcc12b46aaa7e58e30 I agree with another comment here that the 1.3MB JSON is a better solution though
  - ahmedfromtunis 5y ago
    I'm sure that this regex wasn't manually created. Is there a service or tool to create such regex?
    - Recursing 5y ago
      Indeed, here is the source from the linked comment https://gist.github.com/jes/c7b848220bc36d8ae3771cd77f232d0c https://gist.github.com/jes/c7b848220bc36d8ae3771cd77f232d0c
    - philjohn 5y ago
      You can go a long way by building a Trie and walking it to autogenerate a regex, although optimising it is a more complex challenge.
idiotsatbarclay 5y ago
These are the people protecting people's money, wow.
- carnitine 5y ago
  Was it really worth making an account for this?
- toyg 5y ago
  You misunderstand the role of modern banks: they're not there to protect your money, they exist to create money through credit. Everything else (payment routing and account management) is just an accessory, a necessary evil. They want your money in "safe" accounts only because the law forces them to keep around a certain amount of cash in case all that credit turns bad.
  - kqr 5y ago
    This is correct. One of the early and still accessible references is Bagehot's Lombard Street.
    - dredmorbius 5y ago
      Lombard Street by Walter Bagehot https://archive.org/details/in.ernet.dli.2015.276712 https://archive.org/details/in.ernet.dli.2015.276712 https://en.wikipedia.org/wiki/Lombard_Street:_A_Description_of_the_Money_Market https://en.wikipedia.org/wiki/Lombard_Street:_A_Description_...
  - baobabKoodaa 5y ago
    It seems that you have misunderstood how banks create money through credit. Even if there was absolutely no requirement to keep a certain amount of cash, banks still couldn't create infinite money out of thin air, because that's not how it works. I wrote more about this here: https://www.attejuvonen.fi/money-out-of-thin-air/ https://www.attejuvonen.fi/money-out-of-thin-air/
    - 5y ago
ThePadawan 5y ago
A few years back, I wanted to refactor something in the quite large codebase I was working on at the time. I stumbled on a class that was very short and simple. If you know enterprise code, that should immediately make alarm bells ring. And yes, indeed, all this code did was provide a (world-visible) API endpoint which returned the result of "SELECT id FROM <table with millions of rows>" as a JSON array of numbers. IIRC it was used for something theoretically reasonable like "figure out if this search index contains all rows from that table". But I'm sure there were less hacky ways to achieve the same result. Maybe even put permissions or firewalls on it.
- politelemon 5y ago
  Along similar lines, I once found a very simple class. It was an endpoint which executed a stored procedure. The name of the stored procedure was passed in as a query string parameter. There was no validation being done. It also ran system stored procedures; if you're not familiar with that, think admin and housekeeping type functions on the database. We couldn't immediately disable or firewall it as it had embedded its roots deep, and a lot of things calling it didn't know they were calling it.
notatoad 5y ago
it seems to me that a 1.3MB file is a perfectly reasonable size to include in a webpage, and much better than a regex for this purpose - a file containing numbers is maintainable without having to also maintain a test suite to ensure that your regex is still valid every time the company is assigned a new phone number. maybe a server-side lookup would have been a little bit nicer than shipping the whole list to the client side, but a static client-side app can be stored in the CDN layer, doesn't require provisioning any server resources, and sidesteps any security concerns about servers processing user input. it would have been nice if they'd cleaned up the user input before querying the dataset, but overall this looks like a clever solution to release a feature with the smallest risk and maintenance profile possible.
- andy_ppp 5y ago
  I think with gzip how much is the total < 100kb?
  - Recursing 5y ago
    https://www.barclays.co.uk/content/dam/json-files/TelephoneNumberChecker_26_03_2021.json https://www.barclays.co.uk/content/dam/json-files/TelephoneN... I see 190kb transferred in chrome dev tools. I fully agree that the criticism in the article is not warranted
    - bellyfullofbac 5y ago
      How about the cricitism of the tool not caring about +44 or non-numeric characters? It's still lazy programming...
      - andy_ppp 5y ago
        We’ve no idea how difficult the work environment at Barclays is, I don’t personally feel you should judge other people’s work unless you know exactly what went on there. Clearly there would be changes I would make (in a code review hopefully) but I’m not sure digging people out on hacker news is going to help.
actually_a_dog 5y ago
So far, everyone is focusing on the JSON vs regex thing, but that's not the worst of the criticisms leveled here. Not being able to use the +44 prefix, or format the number with dashes are stunningly obvious usability problems that honestly should not have made it out of QA. You'll see the same thing on different sites with credit card numbers. See, every credit card issuer uses a scheme called an "issuer identification number" to tell you what type of card it is. And, there's a list of them [0]. So, for instance, I can tell that any valid credit card number that starts with 4 must be a Visa. So, why ask me what type of card it is, when you can figure it out yourself? Those rare sites where you actually want to put your Social Security number in have these sorts of issues, too. Some of them require dashes, some of them don't. Some of them will only allow you to enter 9 characters, but won't tell you not to use dashes. It's infuriating, really. And, any site where you enter an account number can potentially have these types of issues. It's not like being just a little more flexible with input formatting is a major feature with huge implementation costs and security risks, either. We're talking about failing to take a few minutes' thought in order to be a little more kind to the user, and that's just inexcusable, IMO. --- [0]: https://stevemorse.org/ssn/List_of_Bank_Identification_Numbers.html https://stevemorse.org/ssn/List_of_Bank_Identification_Numbe...
- Dunedan 5y ago
  > It's not like being just a little more flexible with input formatting is a major feature with huge implementation costs and security risks, either. Just in case somebody considers implementing phone number parsing and normalizing: Just don't and use Googles libphonenumber, which offers solid, ready to use implementations in various languages (there also exist ports for other languages too): https://github.com/google/libphonenumber/ https://github.com/google/libphonenumber/
  - hallway_monitor 5y ago
    In case anyone asks you to implement any input formatting, see if you can get them to change their minds. IMO the most bug-prone and useless feature of websites. Let the user put in whatever they want and just input.replace(/[^0-9]+/, ''). You, your users and your product owners will be happier.
CraigJPerry 5y ago
From a UX point of view, what would be the downsides of just rendering a plain text file of 1 number per line in alphanumeric order? Does this really need any more UI than the browser’s chrome? Not every web user knows “ctrl+f” or “find in page” on their phone, but those that don’t, do still know how to scroll 74,000 lines of ordered numbers (which is surprisingly easy and fast - i just tried scrolling 74k lines in excel on mobile). The one use case i’m thinking might be confounded is a screen reader for the visually impaired or blind but even then, i’m thinking this use case is probably covered?
- ghusbands 5y ago
  The typical user, faced with a huge sorted list of phone numbers and asked to just look through it, will not know how to find a number of interest and will quite possibly be quite flustered or irritated. It's not technologically hard to implement a search, so I don't see a reason to only show a big list. Having all the numbers visible in the page would certainly help it show up in web-search results for those phone numbers, though.
  - dredmorbius 5y ago
    True. Overassessment of general literacy (the reading kind, not computer or maths literacy) is exceedingly common in technical fields. Averag computer skills are abysmal. About 5% of computer users have "advanced" literacy, defined as "Some navigation across pages and applications is required to solve the problem. The use of tools (e.g. a sort function) is required to make progress towards the solution. The task may involve multiple steps and operators. The goal of the problem may have to be defined by the respondent, and the criteria to be met may or may not be explicit" Scheduling a meeting room, or determining "what percentage of the emails sent by John Smith last month were about sustainability" are examples of level-3 tasks. A quarter of the adult population cannot use computers at all, 14% are at "below level-1" skills, and 30% can only perform very basic level-1 tasks, for a total of 70% of the population which has only very basic skills ... or less. It's easy to over-estimate the general literacy and numeracy of the population, especially if you yourself are college-educated and work in and/or with information technology. The United States performs one of the most comprehensive assessments of adult literacy. *The key lesson for me is just how limited it is.* https://nces.ed.gov/pubs2019/2019179/index.asp https://nces.ed.gov/pubs2019/2019179/index.asp The findings correspond highly to a study of adult computer literacy amongst 20 countries by the OECD: "Skills Matter: Further Results from the Survey of Adult Skills" http://dx.doi.org/10.1787/9789264258051-en http://dx.doi.org/10.1787/9789264258051-en Computer usability expert Jacob Nielsen has a discussion of this as well: https://www.nngroup.com/articles/computer-skill-levels/ https://www.nngroup.com/articles/computer-skill-levels/ I've discussed this as "The Tyranny of the Minimum Viable User", which both notes that much of the population has very basic skills, and that this also hampers the very small minority who do. https://old.reddit.com/r/dredmorbius/comments/69wk8y/the_tyranny_of_the_minimum_viable_user/ https://old.reddit.com/r/dredmorbius/comments/69wk8y/the_tyr...
reedf1 5y ago
And for the scammer - a great list of phone numbers to spoof!
- ihaveajob 5y ago
  This is the relevant complaint. Not that scammers need much help collecting a list of legit numbers to spoof, but now they can tell their victim to go and check the origin number on this service and falsely reassuring them.
throw0101a 5y ago
> But how can you be sure the number displayed on your screen in genuine? You can't. The telecom system is hopelessly insecure and shouldn't be trusted for anything more complicated than dialling the speaking clock. There is a (set of) protocol for signing telco connections that was developed: * https://en.wikipedia.org/wiki/STIR/SHAKEN https://en.wikipedia.org/wiki/STIR/SHAKEN * https://www.fcc.gov/call-authentication https://www.fcc.gov/call-authentication Anyone in the telco space that can comment on how much this is implemented in their geographic area (US, EU, APAC, etc)?
ajuc 5y ago
Just make it accept a number and return true if it's valid. Nobody's going to ask for 1000 numbers, and if they want to DDOS they can do it anyway. And if for some reason you can't - please don't return your data in a proprietary format based on a clever hack. Just use gzip.
barbazoo 5y ago
This website and the one they're referencing shouldn't even exist. Barklays' website should just tell the customer to always call them back. Spoofing the phone number isn't just a possibility, it's normalcy.
- carnitine 5y ago
  The website allows them to check a number and then manually call it. How does spoofing interfere in that case?
  - r1ch 5y ago
    It gives a false sense of security. The vast majority of users do not understand phone numbers can be spoofed, and will use this website to check if a call they received is from a "legitimate" number, instructions be damned. It wouldn't surprise me if scammers even incorporate it into their routines.
    - vlovich123 5y ago
      The bank could easily record whether or not they are in contact with the customer over the phone when they initiate outreach. Then standard practice would be “visit Barclays and enter your phone number to check the call is legitimate and get the name of the agent “ or more realistically even a push notification in app. Asking people to call back is a canonical example of bad UX in the name of security that weakens overall security (like stupid password requirements, rotation requirements, etc). It can take ages to get through back to an agent and it may not even be the same one or even in the same department.
- FabHK 5y ago
  The tool specifies clearly that the number is safe to call (not to be called from). In your scenario (“ just tell the customer to always call them back”), which number should the customer call back?
  - barbazoo 5y ago
tyingq 5y ago
If you sort the numbers, then represent them as the amount you need to add to the prior number[1], it produces a very small file once compressed...about 4k[2]. So, even with the code to turn it back into a list, handle the leading zeros on many numbers, etc, it would be under 10k total, much smaller than the crazy regex. Not general purpose, and a bit silly, but you can get the list pretty damn small. [1] Like: "1234, 1235, 1435: becomes "1234, 1, 200" [2] The < 4k gz file that you can reproduce most of the list from: https://github.com/tyingq/barclays/blob/main/out.c.gz?raw=true https://github.com/tyingq/barclays/blob/main/out.c.gz?raw=tr... Gunzip, then read each line, then add the prior read line to it, prepend a leading zero and print. "Prior read line" is 0 for the first line. There's a small amount of the list you would have to hardcode or handle another way...the numbers without leading zeros, total of 63 numbers.
- nerdponx 5y ago
  The point is that they didn't think to do this or anything else to try to keep the bandwidth down, while still managing to deliver a lazy sloppy product that doesn't work very well for its sole purpose.
  - tyingq 5y ago
    Sure. It just made me curious what you could do. Also, there are a fair number of duplicates in Barclay's original list, so it's even more lazy an effort than that :)
    - snet0 5y ago
      I don't even know if this qualifies as a lazy effort, as that implies some effort was put in. This was an effort-free implementation. The user, as usual, pays the price.
  - AnotherGoodName 5y ago
    The 1.3MB JSON file being discussed is literally sent gzipped. https://www.barclays.co.uk/content/dam/json-files/TelephoneNumberChecker_26_03_2021.json https://www.barclays.co.uk/content/dam/json-files/TelephoneN... content-encoding: gzip content-length: 186136 Don't be misled by the fact that your browser transparently hides the compression from you.
puppet-master 5y ago
187k of very compressible strings, producing a small array in memory, in exchange for avoiding all the costs of a web service seems like an excellent trade off. 187k seemed quite expensive, the file actually drops to 49k with Brotli and removing whitespace. Sorry if this put a backend team out of a job, but I definitely approve of this design. The other number normalization defects could just as easily be fixed client-side
Dunedan 5y ago
> Because no one knows how to build a sensible web service any more, the page loads a 1.3MB JSON file containing every number that Barclays has. While other comments have already mentioned that it's actually "only" ~190kB which get transferred thanks to gzip compression, there is still a lot of potential for a smaller transfer size by simply using brotli instead of gzip for compression. With brotli the size of this file is <60KB, so only less than a third of the file size of the gzipped data. Using brotli would be an easy win and improve performance of loading all other assets as well, without the need to change anything in the actual implementation of the website, however Barclays Bank is probably still running a webserver stack which doesn't support brotli yet.
gojomo 5y ago
"Forget it, Jake. It's Bankertown."
- dredmorbius 5y ago
  For those missing the reference: https://yewtu.be/watch?v=TjSshSvQWQA https://yewtu.be/watch?v=TjSshSvQWQA
surfingdino 5y ago
Having worked on projects related to integration of other systems with the banking systems I can confirm a massive lack of skills, experience, and imagination amongst developers and managers working for banks. They pay hundreds of millions of dollars and get very poor return on their investment in IT because they themselves have no people working for them who have any idea how to build a secure system and the consultancies providing bodies have no idea how to build what the client wants. The turf what between various consultancies and managers make things even worse. The results are mediocre and laughable.
- aoms 5y ago
  This
  - deleted 5y ago
    [deleted]
- luckylion 5y ago
  I've heard this many times, also directly from a guy I knew years ago, so I guess there has to be some truth to it. What I don't understand is how that comes to be. Are just people who are not skilled enough applying to work at a bank? Do they have some weird selection criteria that tends to discard all the good people? You'd think that they'd hire some good people by accident and those people would be more than capable of running the whole operation, but apparently they don't.
  - ipaddr 5y ago
    Decisions are all top down. Projects are run top down. The developer delivers the spec the consultant has approval on. Each idea gies through rounds of approvals. Have a great idea as a developer? Save it for your next role.
    - zkmon 5y ago
      Spot on! Also many projects end after achieving the main goal - a powerpoint slide deck, claiming something was done. No one has ability to ask what was done and why it was done. Also the same project is reworked multiple times, during dev stage, over multiple years as the tech becomes old or other dependencies change.
mathattack 5y ago
Bank IT departments are filled with stats, Econ and financial math majors who couldn’t get front office jobs after school. They’re great for creating software that prices derivatives, but awful for reliability, security and all things engineering. Meanwhile, the decision makers just use Excel for all the important things. Things blow up all the time, it’s just that it rarely gets public. For whatever reason $200mm in wasted IT doesn’t generate the headlines like a $200mm trading mistake.
- elzbardico 5y ago
  Elitist prejudice without any empirical basis. On the contrary, at least on my corner of the world, banks are the ones who completely abhor hiring someone who doesn’t have a 5 year degree in computer science. You could have a thousand stars project in GitHub, come from FAANG and most bank HRs would trow your resume at the trash bin if they don’t see CS.
vmception 5y ago
> Because no one knows how to build a sensible web service any more, the page loads a 1.3MB JSON file containing every number that Barclays has. Banks never did. This is par for course. Just be lucky they didn’t send it in FIX, because you know a bald guy clinging to their 2010 Blackberry “because of the keyboard and emails” really wanted to send they payload over the FIX protocol
philjohn 5y ago
Barclays have a decent mobile app, and you can call them directly there (even a video call). As far as UK banks go, they're one of the more secure ones - giving you out a pinsentry 2FA device for accessing your account, setting up new payee's etc.
incone123 5y ago
I worked in a place that did this on an internal page, but with all the budget codes, financial limits and which manager they belonged to. I don't know if it posed a fraud risk but if there was none then they could have just stuck an Excel file on SharePoint.
trebligdivad 5y ago
While the 74k number looks insane, what I think they have is some centrally allocated PBX block or two, and then a handful of numbers for each branch, of which they have a few thousand; so it looks a little less crazy.
asperous 5y ago
The file is transferred compressed with http gzip so only 190kb is transferred. I can see the point of being efficient but this doesn't seem that bad all things considered. At least the list is also human readable unlike a regex or custom compression.
traceroute66 5y ago
Use of this data, or perhaps to be fairer on the author of the blog, the use of the data in the manner implied by Barclays is not to be encouraged. People should NOT be trusting calls simply on the basis of the number presented and should ALWAYS validate the caller by another means. Spoofing of numbers is a reality on communications networks worldwide. This applies even in places in the US where they have STIR/SHAKEN tokens. STIR/SHAKEN tokens are mostly about the reactive tracing the origin of the call, not necessarily about proactive blocking spoofing. The UK, like 99.999% of other telecoms networks in the world doesn't even have the equivalent to STIR/SHAKEN and is reliant on carriers implementing (or, more often not) various limited and mostly informal possibilities. You would have thought a company such as Barclays would be more knowledgeable than to go around saying that you can trust a CLI if it matches one on a list we publish.
PaulHoule 5y ago
Reminds me of that time I got suspended from Twitter because I insinuated that shorting a certain exchange traded note from Barclays had numerous ways to pay out, including Barclays going bust.
st_goliath 5y ago
Reading the article, and given the fact that the list isn't even sorted, I wouldn't be too surprised if it turns out that the list itself was hand curated. More precisely, the hands of maybe 5 or so interns. That sort of thing would even be surprisingly close to a summer job I once had in an accounting department.
webinvest 5y ago
Barclays Bank has the worst user interfaces of any financial application I’ve ever used. Everything they make, websites/apps, are laughably bad.
killingtime74 5y ago
Hey man why are you so hard on their interns XD
dopylitty 5y ago
At one point I was exposed to an identity management web UI originally developed at Barclays (and still littered with references to their internal systems). It was based on some completely Byzantine web framework and was incredibly slow. I checked the web requests it was making once while trying to add a user to a group and found that the UI was loading every group from our directory server (~22000 groups) into some JS object that then loaded them all into an html list element. Then it had a separate request to the web server for field validation for some reason. It also didn’t have an API, much to the chagrin of every attempt to automate any infrastructure system.

103 points by kristianp 5y ago

I tested the 44k optimised Perl regexp but it seemed to let through some other stuff - i.e. replacing the leading 0 with 8 allowed through a bunch of numbers that aren't on the original list. e.g. changing 02071160299 to 82071160299 still appears to pass the regexp.

zamadatix 5y ago
Probably the cardinal sin of regex: forgetting the anchors. Also something really weird: when I view zimpenfish's comment in the post it shows as 54 minutes old which makes sense, when I click it to view direct or reply it shows as 2 days old which is really wonky. Any idea what is going on there? https://i.imgur.com/DvBDcIL.png https://i.imgur.com/DvBDcIL.png
- skinkestek 5y ago
  That's funny... Might be something that got resubmitted from the second chance pool and then automatical rewrite only did half the work it should or something is cached or something similar?
  - zamadatix 5y ago
    Oooh, I bet you're right!
  - detaro 5y ago
    AFAIK dang said that's intentional. The view on the thread gets faked to look consistent, but they don't want to modify the actual metadata of the comment you see in the direct view, and something is always going to be "wrong" however you do it.
Recursing 5y ago
https://shkspr.mobi/blog/2021/05/the-74000-numbers-of-barclays-bank/#comment-215502 https://shkspr.mobi/blog/2021/05/the-74000-numbers-of-barcla... it's mentioned in another comment that indeed they forgot the anchors The "correct" regex is 11KB and can be found here https://gist.github.com/jes/e678e4300d1cfcbcc12b46aaa7e58e30 https://gist.github.com/jes/e678e4300d1cfcbcc12b46aaa7e58e30 I agree with another comment here that the 1.3MB JSON is a better solution though
- ahmedfromtunis 5y ago
  I'm sure that this regex wasn't manually created. Is there a service or tool to create such regex?
  - Recursing 5y ago
    Indeed, here is the source from the linked comment https://gist.github.com/jes/c7b848220bc36d8ae3771cd77f232d0c https://gist.github.com/jes/c7b848220bc36d8ae3771cd77f232d0c
  - philjohn 5y ago
    You can go a long way by building a Trie and walking it to autogenerate a regex, although optimising it is a more complex challenge.

idiotsatbarclay 5y ago

These are the people protecting people's money, wow.

carnitine 5y ago
Was it really worth making an account for this?
toyg 5y ago
You misunderstand the role of modern banks: they're not there to protect your money, they exist to create money through credit. Everything else (payment routing and account management) is just an accessory, a necessary evil. They want your money in "safe" accounts only because the law forces them to keep around a certain amount of cash in case all that credit turns bad.
- kqr 5y ago
  This is correct. One of the early and still accessible references is Bagehot's Lombard Street.
  - dredmorbius 5y ago
    Lombard Street by Walter Bagehot https://archive.org/details/in.ernet.dli.2015.276712 https://archive.org/details/in.ernet.dli.2015.276712 https://en.wikipedia.org/wiki/Lombard_Street:_A_Description_of_the_Money_Market https://en.wikipedia.org/wiki/Lombard_Street:_A_Description_...
- baobabKoodaa 5y ago
  It seems that you have misunderstood how banks create money through credit. Even if there was absolutely no requirement to keep a certain amount of cash, banks still couldn't create infinite money out of thin air, because that's not how it works. I wrote more about this here: https://www.attejuvonen.fi/money-out-of-thin-air/ https://www.attejuvonen.fi/money-out-of-thin-air/
  - 5y ago

ThePadawan 5y ago

A few years back, I wanted to refactor something in the quite large codebase I was working on at the time. I stumbled on a class that was very short and simple. If you know enterprise code, that should immediately make alarm bells ring. And yes, indeed, all this code did was provide a (world-visible) API endpoint which returned the result of "SELECT id FROM <table with millions of rows>" as a JSON array of numbers. IIRC it was used for something theoretically reasonable like "figure out if this search index contains all rows from that table". But I'm sure there were less hacky ways to achieve the same result. Maybe even put permissions or firewalls on it.

politelemon 5y ago
Along similar lines, I once found a very simple class. It was an endpoint which executed a stored procedure. The name of the stored procedure was passed in as a query string parameter. There was no validation being done. It also ran system stored procedures; if you're not familiar with that, think admin and housekeeping type functions on the database. We couldn't immediately disable or firewall it as it had embedded its roots deep, and a lot of things calling it didn't know they were calling it.

notatoad 5y ago

it seems to me that a 1.3MB file is a perfectly reasonable size to include in a webpage, and much better than a regex for this purpose - a file containing numbers is maintainable without having to also maintain a test suite to ensure that your regex is still valid every time the company is assigned a new phone number. maybe a server-side lookup would have been a little bit nicer than shipping the whole list to the client side, but a static client-side app can be stored in the CDN layer, doesn't require provisioning any server resources, and sidesteps any security concerns about servers processing user input. it would have been nice if they'd cleaned up the user input before querying the dataset, but overall this looks like a clever solution to release a feature with the smallest risk and maintenance profile possible.

andy_ppp 5y ago
I think with gzip how much is the total < 100kb?
- Recursing 5y ago
  https://www.barclays.co.uk/content/dam/json-files/TelephoneNumberChecker_26_03_2021.json https://www.barclays.co.uk/content/dam/json-files/TelephoneN... I see 190kb transferred in chrome dev tools. I fully agree that the criticism in the article is not warranted
  - bellyfullofbac 5y ago
    How about the cricitism of the tool not caring about +44 or non-numeric characters? It's still lazy programming...
    - andy_ppp 5y ago
      We’ve no idea how difficult the work environment at Barclays is, I don’t personally feel you should judge other people’s work unless you know exactly what went on there. Clearly there would be changes I would make (in a code review hopefully) but I’m not sure digging people out on hacker news is going to help.

actually_a_dog 5y ago

So far, everyone is focusing on the JSON vs regex thing, but that's not the worst of the criticisms leveled here. Not being able to use the +44 prefix, or format the number with dashes are stunningly obvious usability problems that honestly should not have made it out of QA. You'll see the same thing on different sites with credit card numbers. See, every credit card issuer uses a scheme called an "issuer identification number" to tell you what type of card it is. And, there's a list of them [0]. So, for instance, I can tell that any valid credit card number that starts with 4 must be a Visa. So, why ask me what type of card it is, when you can figure it out yourself? Those rare sites where you actually want to put your Social Security number in have these sorts of issues, too. Some of them require dashes, some of them don't. Some of them will only allow you to enter 9 characters, but won't tell you not to use dashes. It's infuriating, really. And, any site where you enter an account number can potentially have these types of issues. It's not like being just a little more flexible with input formatting is a major feature with huge implementation costs and security risks, either. We're talking about failing to take a few minutes' thought in order to be a little more kind to the user, and that's just inexcusable, IMO. --- [0]: https://stevemorse.org/ssn/List_of_Bank_Identification_Numbers.html https://stevemorse.org/ssn/List_of_Bank_Identification_Numbe...

Dunedan 5y ago
> It's not like being just a little more flexible with input formatting is a major feature with huge implementation costs and security risks, either. Just in case somebody considers implementing phone number parsing and normalizing: Just don't and use Googles libphonenumber, which offers solid, ready to use implementations in various languages (there also exist ports for other languages too): https://github.com/google/libphonenumber/ https://github.com/google/libphonenumber/
- hallway_monitor 5y ago
  In case anyone asks you to implement any input formatting, see if you can get them to change their minds. IMO the most bug-prone and useless feature of websites. Let the user put in whatever they want and just input.replace(/[^0-9]+/, ''). You, your users and your product owners will be happier.

CraigJPerry 5y ago

From a UX point of view, what would be the downsides of just rendering a plain text file of 1 number per line in alphanumeric order? Does this really need any more UI than the browser’s chrome? Not every web user knows “ctrl+f” or “find in page” on their phone, but those that don’t, do still know how to scroll 74,000 lines of ordered numbers (which is surprisingly easy and fast - i just tried scrolling 74k lines in excel on mobile). The one use case i’m thinking might be confounded is a screen reader for the visually impaired or blind but even then, i’m thinking this use case is probably covered?

ghusbands 5y ago
The typical user, faced with a huge sorted list of phone numbers and asked to just look through it, will not know how to find a number of interest and will quite possibly be quite flustered or irritated. It's not technologically hard to implement a search, so I don't see a reason to only show a big list. Having all the numbers visible in the page would certainly help it show up in web-search results for those phone numbers, though.
- dredmorbius 5y ago
  True. Overassessment of general literacy (the reading kind, not computer or maths literacy) is exceedingly common in technical fields. Averag computer skills are abysmal. About 5% of computer users have "advanced" literacy, defined as "Some navigation across pages and applications is required to solve the problem. The use of tools (e.g. a sort function) is required to make progress towards the solution. The task may involve multiple steps and operators. The goal of the problem may have to be defined by the respondent, and the criteria to be met may or may not be explicit" Scheduling a meeting room, or determining "what percentage of the emails sent by John Smith last month were about sustainability" are examples of level-3 tasks. A quarter of the adult population cannot use computers at all, 14% are at "below level-1" skills, and 30% can only perform very basic level-1 tasks, for a total of 70% of the population which has only very basic skills ... or less. It's easy to over-estimate the general literacy and numeracy of the population, especially if you yourself are college-educated and work in and/or with information technology. The United States performs one of the most comprehensive assessments of adult literacy. *The key lesson for me is just how limited it is.* https://nces.ed.gov/pubs2019/2019179/index.asp https://nces.ed.gov/pubs2019/2019179/index.asp The findings correspond highly to a study of adult computer literacy amongst 20 countries by the OECD: "Skills Matter: Further Results from the Survey of Adult Skills" http://dx.doi.org/10.1787/9789264258051-en http://dx.doi.org/10.1787/9789264258051-en Computer usability expert Jacob Nielsen has a discussion of this as well: https://www.nngroup.com/articles/computer-skill-levels/ https://www.nngroup.com/articles/computer-skill-levels/ I've discussed this as "The Tyranny of the Minimum Viable User", which both notes that much of the population has very basic skills, and that this also hampers the very small minority who do. https://old.reddit.com/r/dredmorbius/comments/69wk8y/the_tyranny_of_the_minimum_viable_user/ https://old.reddit.com/r/dredmorbius/comments/69wk8y/the_tyr...

reedf1 5y ago

And for the scammer - a great list of phone numbers to spoof!

ihaveajob 5y ago
This is the relevant complaint. Not that scammers need much help collecting a list of legit numbers to spoof, but now they can tell their victim to go and check the origin number on this service and falsely reassuring them.

throw0101a 5y ago

> But how can you be sure the number displayed on your screen in genuine? You can't. The telecom system is hopelessly insecure and shouldn't be trusted for anything more complicated than dialling the speaking clock. There is a (set of) protocol for signing telco connections that was developed: * https://en.wikipedia.org/wiki/STIR/SHAKEN https://en.wikipedia.org/wiki/STIR/SHAKEN * https://www.fcc.gov/call-authentication https://www.fcc.gov/call-authentication Anyone in the telco space that can comment on how much this is implemented in their geographic area (US, EU, APAC, etc)?

ajuc 5y ago

Just make it accept a number and return true if it's valid. Nobody's going to ask for 1000 numbers, and if they want to DDOS they can do it anyway. And if for some reason you can't - please don't return your data in a proprietary format based on a clever hack. Just use gzip.

barbazoo 5y ago

This website and the one they're referencing shouldn't even exist. Barklays' website should just tell the customer to always call them back. Spoofing the phone number isn't just a possibility, it's normalcy.

carnitine 5y ago
The website allows them to check a number and then manually call it. How does spoofing interfere in that case?
- r1ch 5y ago
  It gives a false sense of security. The vast majority of users do not understand phone numbers can be spoofed, and will use this website to check if a call they received is from a "legitimate" number, instructions be damned. It wouldn't surprise me if scammers even incorporate it into their routines.
  - vlovich123 5y ago
    The bank could easily record whether or not they are in contact with the customer over the phone when they initiate outreach. Then standard practice would be “visit Barclays and enter your phone number to check the call is legitimate and get the name of the agent “ or more realistically even a push notification in app. Asking people to call back is a canonical example of bad UX in the name of security that weakens overall security (like stupid password requirements, rotation requirements, etc). It can take ages to get through back to an agent and it may not even be the same one or even in the same department.
FabHK 5y ago
The tool specifies clearly that the number is safe to call (not to be called from). In your scenario (“ just tell the customer to always call them back”), which number should the customer call back?
- barbazoo 5y ago

tyingq 5y ago

If you sort the numbers, then represent them as the amount you need to add to the prior number[1], it produces a very small file once compressed...about 4k[2]. So, even with the code to turn it back into a list, handle the leading zeros on many numbers, etc, it would be under 10k total, much smaller than the crazy regex. Not general purpose, and a bit silly, but you can get the list pretty damn small. [1] Like: "1234, 1235, 1435: becomes "1234, 1, 200" [2] The < 4k gz file that you can reproduce most of the list from: https://github.com/tyingq/barclays/blob/main/out.c.gz?raw=true https://github.com/tyingq/barclays/blob/main/out.c.gz?raw=tr... Gunzip, then read each line, then add the prior read line to it, prepend a leading zero and print. "Prior read line" is 0 for the first line. There's a small amount of the list you would have to hardcode or handle another way...the numbers without leading zeros, total of 63 numbers.

nerdponx 5y ago
The point is that they didn't think to do this or anything else to try to keep the bandwidth down, while still managing to deliver a lazy sloppy product that doesn't work very well for its sole purpose.
- tyingq 5y ago
  Sure. It just made me curious what you could do. Also, there are a fair number of duplicates in Barclay's original list, so it's even more lazy an effort than that :)
  - snet0 5y ago
    I don't even know if this qualifies as a lazy effort, as that implies some effort was put in. This was an effort-free implementation. The user, as usual, pays the price.
- AnotherGoodName 5y ago
  The 1.3MB JSON file being discussed is literally sent gzipped. https://www.barclays.co.uk/content/dam/json-files/TelephoneNumberChecker_26_03_2021.json https://www.barclays.co.uk/content/dam/json-files/TelephoneN... content-encoding: gzip content-length: 186136 Don't be misled by the fact that your browser transparently hides the compression from you.

puppet-master 5y ago

187k of very compressible strings, producing a small array in memory, in exchange for avoiding all the costs of a web service seems like an excellent trade off. 187k seemed quite expensive, the file actually drops to 49k with Brotli and removing whitespace. Sorry if this put a backend team out of a job, but I definitely approve of this design. The other number normalization defects could just as easily be fixed client-side

Dunedan 5y ago

> Because no one knows how to build a sensible web service any more, the page loads a 1.3MB JSON file containing every number that Barclays has. While other comments have already mentioned that it's actually "only" ~190kB which get transferred thanks to gzip compression, there is still a lot of potential for a smaller transfer size by simply using brotli instead of gzip for compression. With brotli the size of this file is <60KB, so only less than a third of the file size of the gzipped data. Using brotli would be an easy win and improve performance of loading all other assets as well, without the need to change anything in the actual implementation of the website, however Barclays Bank is probably still running a webserver stack which doesn't support brotli yet.

gojomo 5y ago

"Forget it, Jake. It's Bankertown."

dredmorbius 5y ago
For those missing the reference: https://yewtu.be/watch?v=TjSshSvQWQA https://yewtu.be/watch?v=TjSshSvQWQA

surfingdino 5y ago

Having worked on projects related to integration of other systems with the banking systems I can confirm a massive lack of skills, experience, and imagination amongst developers and managers working for banks. They pay hundreds of millions of dollars and get very poor return on their investment in IT because they themselves have no people working for them who have any idea how to build a secure system and the consultancies providing bodies have no idea how to build what the client wants. The turf what between various consultancies and managers make things even worse. The results are mediocre and laughable.

aoms 5y ago
This
- deleted 5y ago
  [deleted]
luckylion 5y ago
I've heard this many times, also directly from a guy I knew years ago, so I guess there has to be some truth to it. What I don't understand is how that comes to be. Are just people who are not skilled enough applying to work at a bank? Do they have some weird selection criteria that tends to discard all the good people? You'd think that they'd hire some good people by accident and those people would be more than capable of running the whole operation, but apparently they don't.
- ipaddr 5y ago
  Decisions are all top down. Projects are run top down. The developer delivers the spec the consultant has approval on. Each idea gies through rounds of approvals. Have a great idea as a developer? Save it for your next role.
  - zkmon 5y ago
    Spot on! Also many projects end after achieving the main goal - a powerpoint slide deck, claiming something was done. No one has ability to ask what was done and why it was done. Also the same project is reworked multiple times, during dev stage, over multiple years as the tech becomes old or other dependencies change.

mathattack 5y ago

Bank IT departments are filled with stats, Econ and financial math majors who couldn’t get front office jobs after school. They’re great for creating software that prices derivatives, but awful for reliability, security and all things engineering. Meanwhile, the decision makers just use Excel for all the important things. Things blow up all the time, it’s just that it rarely gets public. For whatever reason $200mm in wasted IT doesn’t generate the headlines like a $200mm trading mistake.

elzbardico 5y ago
Elitist prejudice without any empirical basis. On the contrary, at least on my corner of the world, banks are the ones who completely abhor hiring someone who doesn’t have a 5 year degree in computer science. You could have a thousand stars project in GitHub, come from FAANG and most bank HRs would trow your resume at the trash bin if they don’t see CS.

vmception 5y ago

> Because no one knows how to build a sensible web service any more, the page loads a 1.3MB JSON file containing every number that Barclays has. Banks never did. This is par for course. Just be lucky they didn’t send it in FIX, because you know a bald guy clinging to their 2010 Blackberry “because of the keyboard and emails” really wanted to send they payload over the FIX protocol

philjohn 5y ago

Barclays have a decent mobile app, and you can call them directly there (even a video call). As far as UK banks go, they're one of the more secure ones - giving you out a pinsentry 2FA device for accessing your account, setting up new payee's etc.

incone123 5y ago

I worked in a place that did this on an internal page, but with all the budget codes, financial limits and which manager they belonged to. I don't know if it posed a fraud risk but if there was none then they could have just stuck an Excel file on SharePoint.

trebligdivad 5y ago

While the 74k number looks insane, what I think they have is some centrally allocated PBX block or two, and then a handful of numbers for each branch, of which they have a few thousand; so it looks a little less crazy.

asperous 5y ago

The file is transferred compressed with http gzip so only 190kb is transferred. I can see the point of being efficient but this doesn't seem that bad all things considered. At least the list is also human readable unlike a regex or custom compression.

traceroute66 5y ago

Use of this data, or perhaps to be fairer on the author of the blog, the use of the data in the manner implied by Barclays is not to be encouraged. People should NOT be trusting calls simply on the basis of the number presented and should ALWAYS validate the caller by another means. Spoofing of numbers is a reality on communications networks worldwide. This applies even in places in the US where they have STIR/SHAKEN tokens. STIR/SHAKEN tokens are mostly about the reactive tracing the origin of the call, not necessarily about proactive blocking spoofing. The UK, like 99.999% of other telecoms networks in the world doesn't even have the equivalent to STIR/SHAKEN and is reliant on carriers implementing (or, more often not) various limited and mostly informal possibilities. You would have thought a company such as Barclays would be more knowledgeable than to go around saying that you can trust a CLI if it matches one on a list we publish.

PaulHoule 5y ago

Reminds me of that time I got suspended from Twitter because I insinuated that shorting a certain exchange traded note from Barclays had numerous ways to pay out, including Barclays going bust.

st_goliath 5y ago

Reading the article, and given the fact that the list isn't even sorted, I wouldn't be too surprised if it turns out that the list itself was hand curated. More precisely, the hands of maybe 5 or so interns. That sort of thing would even be surprisingly close to a summer job I once had in an accounting department.

webinvest 5y ago

Barclays Bank has the worst user interfaces of any financial application I’ve ever used. Everything they make, websites/apps, are laughably bad.

killingtime74 5y ago

Hey man why are you so hard on their interns XD

dopylitty 5y ago

At one point I was exposed to an identity management web UI originally developed at Barclays (and still littered with references to their internal systems). It was based on some completely Byzantine web framework and was incredibly slow. I checked the web requests it was making once while trying to add a user to a group and found that the UI was loading every group from our directory server (~22000 groups) into some JS object that then loaded them all into an html list element. Then it had a separate request to the web server for field validation for some reason. It also didn’t have an API, much to the chagrin of every attempt to automate any infrastructure system.