3 ms·

It wouldn't destroy all their customers finances, they would just back out the transactions, restore their database and get a new root key.

lisper 5y ago
I don't think you fully appreciate the damage that someone with the root key could do. It isn't limited to initiating fraudulent transactions (which, BTW, would be indistinguishable from legitimate one, so you'd have to sort out the mess manually).
- psychlops 5y ago
  Oh, I get it. I've represented hacked companies and sat down with FBI agents in tedious, but educational sessions trying to find hackers. It's a real headache and ultimately fruitless. The problem with hacking a bank is all they can really do is try to screw up the data or lock it down. Even people who work at the bank can't figure out how to move money around, much less where to wire it to to profit anonymously.
- adontz 5y ago
  Have you ever worked at bank? I mean, I believe you know something about something, but from what you say, it seems like you have never had a word with a bank's InfoSec. Root access to servers, to secret keys or password is not beneficial. There are many systems validating each other. Even if you got access to one system, even if you control it for some time, you cannot really permanently transfer any significant amount of money anywhere. Fraud detection and AML systems will trigger an alert. Behavioral analysis systems, which are must have in industry, will trigger an alert, to say nothing about many other systems I really do not want to discuss in public.
  - lisper 5y ago
    No, I have never worked at a bank. But I once had half a million dollars go missing because of a transcription error on a wire transfer. It took two weeks to locate the money and get it back to me. And that with without a malicious actor involved, just a stupid clerical error. So I'm pretty confident that if I had a bank's root key I could wreak havoc. That havoc may not take the form of draining everyone's account, but it would be havoc nonetheless.

lisper 5y ago

I don't think you fully appreciate the damage that someone with the root key could do. It isn't limited to initiating fraudulent transactions (which, BTW, would be indistinguishable from legitimate one, so you'd have to sort out the mess manually).

psychlops 5y ago
Oh, I get it. I've represented hacked companies and sat down with FBI agents in tedious, but educational sessions trying to find hackers. It's a real headache and ultimately fruitless. The problem with hacking a bank is all they can really do is try to screw up the data or lock it down. Even people who work at the bank can't figure out how to move money around, much less where to wire it to to profit anonymously.
adontz 5y ago
Have you ever worked at bank? I mean, I believe you know something about something, but from what you say, it seems like you have never had a word with a bank's InfoSec. Root access to servers, to secret keys or password is not beneficial. There are many systems validating each other. Even if you got access to one system, even if you control it for some time, you cannot really permanently transfer any significant amount of money anywhere. Fraud detection and AML systems will trigger an alert. Behavioral analysis systems, which are must have in industry, will trigger an alert, to say nothing about many other systems I really do not want to discuss in public.
- lisper 5y ago
  No, I have never worked at a bank. But I once had half a million dollars go missing because of a transcription error on a wire transfer. It took two weeks to locate the money and get it back to me. And that with without a malicious actor involved, just a stupid clerical error. So I'm pretty confident that if I had a bank's root key I could wreak havoc. That havoc may not take the form of draining everyone's account, but it would be havoc nonetheless.