6 ms·

What kind of regulation would help, exactly?

by kkjjkgjjgg 5y ago

Ansil849 5y ago
Penalties for insufficient security controls, for starters.
- logicalmonster 5y ago
  What exactly is “sufficient security controls”? This is the type of thing that sounds good on the surface, but becomes nightmarish when you start to think about how it might work in practice. Experts disagree on how to do security. For instance, there’s still some people who insist that complex password rules are a genius idea that makes the world far safer, yet they’re unambiguously bad for security because they knowingly decrease the number of possible password combinations. Whose idea of best practices wins? I’d hate that the decision now becomes a dictate by some bureaucracy that likely barely knows what the hell is going on.
  - Ansil849 5y ago
    You're acting like there are no established security controls for financial institutions. There are.
    - logicalmonster 5y ago
      Maybe so. But my bank still does 2 Factor Authentication only through SMS and doesn’t even offer some kind of Authentication App as an option. Additionally they have strict password rules in place, a basically broken password reset form, and a comically short maximum password limit. Color me not impressed with whatever rules do exist.
      - Ansil849 5y ago
        It's not "maybe so", it's a matter of fact. And we're not talking about outdated user-facing login authentication procedures, we're talking about securing the back-end. When is the last time your bank had $150 million stolen?
        logicalmonster 5y ago
        I don’t know how my bank implements their backend. Based on the parts I can see that I mentioned, I’m not very impressed with their interpretation of best practices. That’s a good question. I don’t know how often banks get robbed of cash due to digital intrusions. I have gotten credit card info stolen before and that happens with many people, so maybe errors in the banking system more commonly take the form of lots of small fraud rather than a few big events.
        Daishiman 5y ago
        So if you don't know, how can you be unimpressed?
        logicalmonster 5y ago
        As I said, I don't have proof about parts I can't see and never claimed so. But the parts I can see are IMO bad, so it's reasonable to be skeptical about the parts I can't see. Also, I haven't worked with my actual bank, but I've done multiple bits of consulting in the past on some other national bank's technology, and my time there was such a disorganized mess that I have to doubt the quality of all of their systems and practices.
        logicalmonster 5y ago
        Also as an additional followup comment, the legal structure surrounding banks probably impacts how digital robberies are targeted as well. A cyber-criminal organization who wants to rob some big player like Goldman Sachs, BlackRock, or Citibank of 9+ figures probably knows that they're going to have a devil of a time getting away with any big-time theft. The US government is actually going to go after anybody who tries to pull money out of big banks accounts to the point that they might even be willing to go to war in the right circumstance. If you're a cyber criminal, even if you could hack into some big bank systems and force a transfer, how would you get away with the cash in most cases? If they really target you with their full weight, you're probably completely screwed. In comparison, random Crypto Financial Agents are on many power-players "Naughty List". Depending on the exact circumstances of some crypto-robbery, the full weight of the US Government probably isn't going to be deployed against some cyber criminal organization who manages to take out a crypto firm's assets in the same way that they would if you targeted the existing banks. So maybe relatively more cyber attacks happen against crypto than other types of assets because it's known as a safer target. (I have no clue, this is just a reasonable hypothesis to me)
      - lanstin 5y ago
        Yet they seem to prevent banks from having all their stored value exfiltrated. of all my worries about my credit union, them having all their money shipped of to an anonymous crypto wallet obfuscator is not one. I can manage the risks of systems i interact with directly, but some non zero chance of the assets disappearing i cannot manage
      - Daishiman 5y ago
        User-facing security is just the tip of the iceberg for bank security, and IMO one of the less important factors. You have regulations like CPI on how to store credit card credentials, transaction history, and audit logging. You have regulations on physical access and who's allowes to touch production. There's enormous amounts of regulation on auditing and software that's permitted to generate bank transactions. Having worked in the space I am definitely impressed; it's taken very seriously, there are real, concrete consequences for not taking is seriously, and you generally don't see retail banks failing because someone messed around with ACH transactions, for example.
raesene9 5y ago
So one example, in the UK if my bank goes bust then up to £75k I get my money back. This is funded by a levy on all the banks.
- kkjjkgjjgg 5y ago
  OK but so far most countries don't have that many crypto exchanges.
  - raesene9 5y ago
    Ok another one. In the UK we have a Financial services ombudsman https://www.financial-ombudsman.org.uk/ https://www.financial-ombudsman.org.uk/ which can mediate in any dispute a customer has with a bank. So if a bank takes funds or won't release funds, there's a route you can use to get that back. One look at the sub-reddits for most crypto exchanges will show quite a few posts from people who can't get withdrawals and the exchanges are just stonewalling them.
    - kkjjkgjjgg 5y ago
      Hm, I don't think that amounts to a guarantee that you get your money back? Surely you can also sue a crypto exchange already? But if they don't have your money, it won't help - likewise with the banks. Were customers even affected in this Bitcoin heist? Just because some crypto was stolen from the exchange, doesn't mean they won't pay their customers? 150M loss might not be that much in the greater scheme of things. A bank could also make losses of 150M by investing their customers money? You can also lose your money on the stock exchange, with regular banks as brokers.
      - raesene9 5y ago
        If a bank defrauds you in the UK you generally get the money back, there have been multiple cases. As to them having your money, that's what capital adequacy controls (another form of regulation) are for. banks are required to keep a percentage of their assets in low/no risk securities to mitigate the risk of insolvency due to bets going wrong. Many many many customers have been affected by hacks on crypto coin exchanges. To take one recent example I think the customers of Cream finance basically lost it all after cream were hacked for the 3rd time in a year. You can ofc lose money on the stock exchange, and in the UK there are regulations about what products can be offered to retail customers. things like leveraged investing are restricted. None of this is to say that financial regulations are perfect, they're very much not, but that there are reasons why they have evolved in the way they have, generally in response to the kind of things happening to the crypto market right now.

What kind of regulation would help, exactly?

Ansil849 5y ago

Penalties for insufficient security controls, for starters.

logicalmonster 5y ago
What exactly is “sufficient security controls”? This is the type of thing that sounds good on the surface, but becomes nightmarish when you start to think about how it might work in practice. Experts disagree on how to do security. For instance, there’s still some people who insist that complex password rules are a genius idea that makes the world far safer, yet they’re unambiguously bad for security because they knowingly decrease the number of possible password combinations. Whose idea of best practices wins? I’d hate that the decision now becomes a dictate by some bureaucracy that likely barely knows what the hell is going on.
- Ansil849 5y ago
  You're acting like there are no established security controls for financial institutions. There are.
  - logicalmonster 5y ago
    Maybe so. But my bank still does 2 Factor Authentication only through SMS and doesn’t even offer some kind of Authentication App as an option. Additionally they have strict password rules in place, a basically broken password reset form, and a comically short maximum password limit. Color me not impressed with whatever rules do exist.
    - Ansil849 5y ago
      It's not "maybe so", it's a matter of fact. And we're not talking about outdated user-facing login authentication procedures, we're talking about securing the back-end. When is the last time your bank had $150 million stolen?
      - logicalmonster 5y ago
        I don’t know how my bank implements their backend. Based on the parts I can see that I mentioned, I’m not very impressed with their interpretation of best practices. That’s a good question. I don’t know how often banks get robbed of cash due to digital intrusions. I have gotten credit card info stolen before and that happens with many people, so maybe errors in the banking system more commonly take the form of lots of small fraud rather than a few big events.
        Daishiman 5y ago
        So if you don't know, how can you be unimpressed?
        logicalmonster 5y ago
        As I said, I don't have proof about parts I can't see and never claimed so. But the parts I can see are IMO bad, so it's reasonable to be skeptical about the parts I can't see. Also, I haven't worked with my actual bank, but I've done multiple bits of consulting in the past on some other national bank's technology, and my time there was such a disorganized mess that I have to doubt the quality of all of their systems and practices.
      - logicalmonster 5y ago
        Also as an additional followup comment, the legal structure surrounding banks probably impacts how digital robberies are targeted as well. A cyber-criminal organization who wants to rob some big player like Goldman Sachs, BlackRock, or Citibank of 9+ figures probably knows that they're going to have a devil of a time getting away with any big-time theft. The US government is actually going to go after anybody who tries to pull money out of big banks accounts to the point that they might even be willing to go to war in the right circumstance. If you're a cyber criminal, even if you could hack into some big bank systems and force a transfer, how would you get away with the cash in most cases? If they really target you with their full weight, you're probably completely screwed. In comparison, random Crypto Financial Agents are on many power-players "Naughty List". Depending on the exact circumstances of some crypto-robbery, the full weight of the US Government probably isn't going to be deployed against some cyber criminal organization who manages to take out a crypto firm's assets in the same way that they would if you targeted the existing banks. So maybe relatively more cyber attacks happen against crypto than other types of assets because it's known as a safer target. (I have no clue, this is just a reasonable hypothesis to me)
    - lanstin 5y ago
      Yet they seem to prevent banks from having all their stored value exfiltrated. of all my worries about my credit union, them having all their money shipped of to an anonymous crypto wallet obfuscator is not one. I can manage the risks of systems i interact with directly, but some non zero chance of the assets disappearing i cannot manage
    - Daishiman 5y ago
      User-facing security is just the tip of the iceberg for bank security, and IMO one of the less important factors. You have regulations like CPI on how to store credit card credentials, transaction history, and audit logging. You have regulations on physical access and who's allowes to touch production. There's enormous amounts of regulation on auditing and software that's permitted to generate bank transactions. Having worked in the space I am definitely impressed; it's taken very seriously, there are real, concrete consequences for not taking is seriously, and you generally don't see retail banks failing because someone messed around with ACH transactions, for example.

raesene9 5y ago

So one example, in the UK if my bank goes bust then up to £75k I get my money back. This is funded by a levy on all the banks.

kkjjkgjjgg 5y ago
OK but so far most countries don't have that many crypto exchanges.
- raesene9 5y ago
  Ok another one. In the UK we have a Financial services ombudsman https://www.financial-ombudsman.org.uk/ https://www.financial-ombudsman.org.uk/ which can mediate in any dispute a customer has with a bank. So if a bank takes funds or won't release funds, there's a route you can use to get that back. One look at the sub-reddits for most crypto exchanges will show quite a few posts from people who can't get withdrawals and the exchanges are just stonewalling them.
  - kkjjkgjjgg 5y ago
    Hm, I don't think that amounts to a guarantee that you get your money back? Surely you can also sue a crypto exchange already? But if they don't have your money, it won't help - likewise with the banks. Were customers even affected in this Bitcoin heist? Just because some crypto was stolen from the exchange, doesn't mean they won't pay their customers? 150M loss might not be that much in the greater scheme of things. A bank could also make losses of 150M by investing their customers money? You can also lose your money on the stock exchange, with regular banks as brokers.
    - raesene9 5y ago
      If a bank defrauds you in the UK you generally get the money back, there have been multiple cases. As to them having your money, that's what capital adequacy controls (another form of regulation) are for. banks are required to keep a percentage of their assets in low/no risk securities to mitigate the risk of insolvency due to bets going wrong. Many many many customers have been affected by hacks on crypto coin exchanges. To take one recent example I think the customers of Cream finance basically lost it all after cream were hacked for the 3rd time in a year. You can ofc lose money on the stock exchange, and in the UK there are regulations about what products can be offered to retail customers. things like leveraged investing are restricted. None of this is to say that financial regulations are perfect, they're very much not, but that there are reasons why they have evolved in the way they have, generally in response to the kind of things happening to the crypto market right now.