5 ms·

Worked in 3 major banks in my country. All of these seems so overthinked and overenginered and not really answering any real fraud risk. To me, personally, it l

by adontz 5y ago

Worked in 3 major banks in my country. All of these seems so overthinked and overenginered and not really answering any real fraud risk. To me, personally, it looks more like marketing move for geeks, rather than real necessity.

lisper 5y ago
You should consider the possibility that your perceptions are the result of your not understanding the problem that these procedures are designed to solve rather than the people who instituted them being idiots.
- xchaotic 5y ago
  What OP is trying to say is that a disproportionate amount of effort is spent on a rather narrow attack vector and it’s still not 100% secure anyway. The people creating these procedures had goals but good UX was not one of them and definitely not the highest priority.
  - lisper 5y ago
    Yes, I get that. But a compromised root key is essentially synonymous with the end of your entire business (to say nothing of destroying the finances of many if not all of your customers) so the effort being expended doesn't seem disproportionate to me. If you feel differently, by all means go do business with a bank that doesn't waste all this effort.
    - adontz 5y ago
      >> But a compromised root key is essentially synonymous with the end of your entire business No, it is not. That is the point. There are many levels of protection, many checks and validations, and even if you pass all of them still a lot of things can be reversed pretty easily. Banks are not cryptocurrency clowns with private key obsession.
    - gnufx 5y ago
      > destroying the finances of many if not all of your customers Only above the non-trivial limit guaranteed for UK regulated banks.
    - psychlops 5y ago
      It wouldn't destroy all their customers finances, they would just back out the transactions, restore their database and get a new root key.
      - lisper 5y ago
        I don't think you fully appreciate the damage that someone with the root key could do. It isn't limited to initiating fraudulent transactions (which, BTW, would be indistinguishable from legitimate one, so you'd have to sort out the mess manually).
        psychlops 5y ago
        Oh, I get it. I've represented hacked companies and sat down with FBI agents in tedious, but educational sessions trying to find hackers. It's a real headache and ultimately fruitless. The problem with hacking a bank is all they can really do is try to screw up the data or lock it down. Even people who work at the bank can't figure out how to move money around, much less where to wire it to to profit anonymously.
        adontz 5y ago
        Have you ever worked at bank? I mean, I believe you know something about something, but from what you say, it seems like you have never had a word with a bank's InfoSec. Root access to servers, to secret keys or password is not beneficial. There are many systems validating each other. Even if you got access to one system, even if you control it for some time, you cannot really permanently transfer any significant amount of money anywhere. Fraud detection and AML systems will trigger an alert. Behavioral analysis systems, which are must have in industry, will trigger an alert, to say nothing about many other systems I really do not want to discuss in public.
        lisper 5y ago
        No, I have never worked at a bank. But I once had half a million dollars go missing because of a transcription error on a wire transfer. It took two weeks to locate the money and get it back to me. And that with without a malicious actor involved, just a stupid clerical error. So I'm pretty confident that if I had a bank's root key I could wreak havoc. That havoc may not take the form of draining everyone's account, but it would be havoc nonetheless.
    - Spooky23 5y ago
      Most banks use HSMs to store secrets. This isn’t novel… if you buy an HSM, the manuals describe a less dramatic version of this process. Cloud providers offer them as a service as well. The inclusion of NSA stuff got my eyes rolling. If you’re worried about NSA implants, you probably should be thinking about the provenance of the HSM, smart cards, etc.
- adontz 5y ago
  I never called anyone idiot, ok? :-) One can be very smart, still not effective.
hogFeast 5y ago
Overthinked and overengineered describes Monzo very well. Their business model isn't really banking but coming up with ways to extract money from investors, so this kind of overengineering is a strong business move for them.
- Nextgrid 5y ago
  I have my gripes with Monzo’s business model and over-engineering (though that applies to most VC-backed startups nowadays) but security is quite important and this seems like a sane strategy of managing root certificates.
blibble 5y ago
ditto it's someone who found the video of the DNSSEC key signing ceremony and decided to implement it at their company

by adontz 5y ago

lisper 5y ago

You should consider the possibility that your perceptions are the result of your not understanding the problem that these procedures are designed to solve rather than the people who instituted them being idiots.

xchaotic 5y ago
What OP is trying to say is that a disproportionate amount of effort is spent on a rather narrow attack vector and it’s still not 100% secure anyway. The people creating these procedures had goals but good UX was not one of them and definitely not the highest priority.
- lisper 5y ago
  Yes, I get that. But a compromised root key is essentially synonymous with the end of your entire business (to say nothing of destroying the finances of many if not all of your customers) so the effort being expended doesn't seem disproportionate to me. If you feel differently, by all means go do business with a bank that doesn't waste all this effort.
  - adontz 5y ago
    >> But a compromised root key is essentially synonymous with the end of your entire business No, it is not. That is the point. There are many levels of protection, many checks and validations, and even if you pass all of them still a lot of things can be reversed pretty easily. Banks are not cryptocurrency clowns with private key obsession.
  - gnufx 5y ago
    > destroying the finances of many if not all of your customers Only above the non-trivial limit guaranteed for UK regulated banks.
  - psychlops 5y ago
    It wouldn't destroy all their customers finances, they would just back out the transactions, restore their database and get a new root key.
    - lisper 5y ago
      I don't think you fully appreciate the damage that someone with the root key could do. It isn't limited to initiating fraudulent transactions (which, BTW, would be indistinguishable from legitimate one, so you'd have to sort out the mess manually).
      - psychlops 5y ago
        Oh, I get it. I've represented hacked companies and sat down with FBI agents in tedious, but educational sessions trying to find hackers. It's a real headache and ultimately fruitless. The problem with hacking a bank is all they can really do is try to screw up the data or lock it down. Even people who work at the bank can't figure out how to move money around, much less where to wire it to to profit anonymously.
      - adontz 5y ago
        Have you ever worked at bank? I mean, I believe you know something about something, but from what you say, it seems like you have never had a word with a bank's InfoSec. Root access to servers, to secret keys or password is not beneficial. There are many systems validating each other. Even if you got access to one system, even if you control it for some time, you cannot really permanently transfer any significant amount of money anywhere. Fraud detection and AML systems will trigger an alert. Behavioral analysis systems, which are must have in industry, will trigger an alert, to say nothing about many other systems I really do not want to discuss in public.
        lisper 5y ago
        No, I have never worked at a bank. But I once had half a million dollars go missing because of a transcription error on a wire transfer. It took two weeks to locate the money and get it back to me. And that with without a malicious actor involved, just a stupid clerical error. So I'm pretty confident that if I had a bank's root key I could wreak havoc. That havoc may not take the form of draining everyone's account, but it would be havoc nonetheless.
  - Spooky23 5y ago
    Most banks use HSMs to store secrets. This isn’t novel… if you buy an HSM, the manuals describe a less dramatic version of this process. Cloud providers offer them as a service as well. The inclusion of NSA stuff got my eyes rolling. If you’re worried about NSA implants, you probably should be thinking about the provenance of the HSM, smart cards, etc.
adontz 5y ago
I never called anyone idiot, ok? :-) One can be very smart, still not effective.

hogFeast 5y ago

Overthinked and overengineered describes Monzo very well. Their business model isn't really banking but coming up with ways to extract money from investors, so this kind of overengineering is a strong business move for them.

Nextgrid 5y ago
I have my gripes with Monzo’s business model and over-engineering (though that applies to most VC-backed startups nowadays) but security is quite important and this seems like a sane strategy of managing root certificates.

blibble 5y ago

ditto it's someone who found the video of the DNSSEC key signing ceremony and decided to implement it at their company