5 ms·

> If we start to imagine adding steps to the interview process to protect against an imposter job candidate, the “solutions” we come up with are quite aggressiv

by bambax 5y ago

> If we start to imagine adding steps to the interview process to protect against an imposter job candidate, the “solutions” we come up with are quite aggressive. We could ask candidates on video (or in person) to see a photo ID and match the ID against the resume. But this would seem very weird. It starts an interview off in a hostile manner, and send the a strong message of distrust. > Computers don’t have emotions; I don’t need to worry insulting the vast majority of S3 objects when I defensively check integrity every time. But humans are different; when we design a human system around uncommon cases, we do need to consider the ramifications on the majority. That's very true. It could be called "the tragedy of security": annoying and insulting everyone just to ward off a few bad actors. For example, in Europe, online payments are becoming annoying to a degree that would have been unthinkable ten years ago. To use a VISA card online includes typing its 16-digits number, expiration date, "security code" (which is printed on the card), then receiving a code in a text message and typing it back, and now typing yet another personal code (or in some cases, the access code to one's online account!!) And after all that, it may still fail. It's insane. I'm sure there are good reasons from the banks or regulators POV to act like this, but the consequences are incredibly painful for the vast majority of people, and probably economically detrimental as well (I sometimes give up from buying something online when the system doesn't accept a simpler payment method than VISA). There has to be a better way.

rvba 5y ago
payU, BLIK and other processors mostly solve this but they seem to be popular only in some european countries. They also beat paypal easily.
ginja 5y ago
> then receiving a code in a text message and typing it back, and now typing yet another personal code Really? In my experience aside from typing the card numbers, all I have to do is approve the transaction with 3D secure which is one tap in my bank's app. It has never failed in my experience. Maybe you need to switch banks? :)
- jraph 5y ago
  - ginja 5y ago
    Ah that makes sense. I respect you not wanting to use an app, but most likely >90% of the people who make online purchases also have their bank's app so it makes sense that the flow is optimized for that. I use Wise too, but they also support 3D secure and it is generally required on European merchants... Works great in the app, but it's probably clunky without it too :/
  - IshKebab 5y ago
    > I don't have any Android or iOS device on which I can install your app, and I would not do that anyway. I don't think you can really complain that they aren't using convenient 2FA because you don't have a smartphone. It's a pretty reasonable thing to require these days. You didn't complain that the online shop itself required the use of a computer.
    - pinephoneguy 5y ago
      Not for 2fa. There are standards for that and they don't need smartphones. Also: I would trust the security of a computer owned by someone without a phone more than that of the average smartphone at this point.
    - jraph 5y ago
      I don't think forcing people to go to the GAFAM is fine, no. (And yes, I have a smartphone but that should not be a requirement neither. My computer should suffice). > You didn't complain that the online shop itself required the use of a computer. Obviously online shopping requires a computer. It would not make sense to complain about this (though if I had to be a bit pedantic, the computer does not have to be mine. I don't need to own a computer). At the moment the situation is workable for someone not having a smartphone, so, fine, but I hope it stays this way.
  - joshvm 5y ago
goblin89 5y ago
Security codes is a special case of fraud ruining things for everyone. I recently gave up on becoming a Hetzner customer (to set up a Minecraft server for friends). After going through all the security checks it declined to provision the server, demanding a photo of me with my ID—even though it successfully made a transaction to validate my payment method, it matches my name and address on file, etc. I blame crypto miners playing chargebacks.
- marcosdumay 5y ago
  Hum... I think they require it from everybody that isn't from the EU. I don't know if they have any means of validating the identity of EU citizens, or if they do that too. I imagine Germany has some laws about identifying who you host things for.
markstos 5y ago
My dad calls this “punishing the masses for the indiscretions of the few”. Like airport security theater.
mprime1 5y ago
> incredibly painful Now, now… calling extra security steps for online purchases ‘extremely painful’ and ‘economically detrimental’ seems a bit excessive. In fact, I think these steps may be there just to make people feel more secure about buying online (this would totally work with my mom, who after many years of visiting me in the USA is still afraid of giving her card to the waiter in a restaurant to pay for dinner).
- rkangel 5y ago
  > this would totally work with my mom, who after many years of visiting me in the USA is still afraid of giving her card to the waiter in a restaurant to pay for dinner To be fair - her instincts aren't bad. It was always a shitty security model, it led to a lot of fraud, and it was one of the design principles of Chip and Pin to eliminate it.
BiteCode_dev 5y ago
Before, you had to go to the store.
- bambax 5y ago
  Well, yes and no. There was a time when we could shop online without all this nonsense. It's getting worse every year, instead of better. And also, going to the store has its own rewards. You get to talk to real people, see and touch the things you want to buy, etc. Now we're alone behind a screen, jumping through absurd and arbitrary hoops that keep getting harder and harder (tried to solve a captcha lately) and fighting "AI" systems fed with stupid data.
whoomp12342 5y ago
that tragedy is much more prolific than just security. It applies to workplace policies, classroom rules, tourism etc...
lrem 5y ago
Three European accounts I sometimes use for online payments, each from a different country, don't make me miserable like that. Apparently one of these banks was founded early in Abraham Lincoln's presidency, so it's not a matter of choosing the new coolness too.
ed_balls 5y ago
Revolut does this better. You put card info and press Approve in the app a few seconds later.
Doxin 5y ago
> in Europe, online payments are becoming annoying to a degree that would have been unthinkable ten years ago. I'd just like to chime in here to say that this isn't universal across Europe. The dutch iDeal payment system only requires you to scan a QR code with your phone and enter your PIN also on your phone. I believe belgium at least uses a similar system, but I'm sure iDeal is not unique. Not to discount your experience of course, sounds like a real hassle and an unnecessary one at that.

by bambax 5y ago

rvba 5y ago

payU, BLIK and other processors mostly solve this but they seem to be popular only in some european countries. They also beat paypal easily.

ginja 5y ago

> then receiving a code in a text message and typing it back, and now typing yet another personal code Really? In my experience aside from typing the card numbers, all I have to do is approve the transaction with 3D secure which is one tap in my bank's app. It has never failed in my experience. Maybe you need to switch banks? :)

jraph 5y ago
- ginja 5y ago
  Ah that makes sense. I respect you not wanting to use an app, but most likely >90% of the people who make online purchases also have their bank's app so it makes sense that the flow is optimized for that. I use Wise too, but they also support 3D secure and it is generally required on European merchants... Works great in the app, but it's probably clunky without it too :/
- IshKebab 5y ago
  > I don't have any Android or iOS device on which I can install your app, and I would not do that anyway. I don't think you can really complain that they aren't using convenient 2FA because you don't have a smartphone. It's a pretty reasonable thing to require these days. You didn't complain that the online shop itself required the use of a computer.
  - pinephoneguy 5y ago
    Not for 2fa. There are standards for that and they don't need smartphones. Also: I would trust the security of a computer owned by someone without a phone more than that of the average smartphone at this point.
  - jraph 5y ago
    I don't think forcing people to go to the GAFAM is fine, no. (And yes, I have a smartphone but that should not be a requirement neither. My computer should suffice). > You didn't complain that the online shop itself required the use of a computer. Obviously online shopping requires a computer. It would not make sense to complain about this (though if I had to be a bit pedantic, the computer does not have to be mine. I don't need to own a computer). At the moment the situation is workable for someone not having a smartphone, so, fine, but I hope it stays this way.
- joshvm 5y ago

goblin89 5y ago

Security codes is a special case of fraud ruining things for everyone. I recently gave up on becoming a Hetzner customer (to set up a Minecraft server for friends). After going through all the security checks it declined to provision the server, demanding a photo of me with my ID—even though it successfully made a transaction to validate my payment method, it matches my name and address on file, etc. I blame crypto miners playing chargebacks.

marcosdumay 5y ago
Hum... I think they require it from everybody that isn't from the EU. I don't know if they have any means of validating the identity of EU citizens, or if they do that too. I imagine Germany has some laws about identifying who you host things for.

markstos 5y ago

My dad calls this “punishing the masses for the indiscretions of the few”. Like airport security theater.

mprime1 5y ago

> incredibly painful Now, now… calling extra security steps for online purchases ‘extremely painful’ and ‘economically detrimental’ seems a bit excessive. In fact, I think these steps may be there just to make people feel more secure about buying online (this would totally work with my mom, who after many years of visiting me in the USA is still afraid of giving her card to the waiter in a restaurant to pay for dinner).

rkangel 5y ago
> this would totally work with my mom, who after many years of visiting me in the USA is still afraid of giving her card to the waiter in a restaurant to pay for dinner To be fair - her instincts aren't bad. It was always a shitty security model, it led to a lot of fraud, and it was one of the design principles of Chip and Pin to eliminate it.

BiteCode_dev 5y ago

Before, you had to go to the store.

bambax 5y ago
Well, yes and no. There was a time when we could shop online without all this nonsense. It's getting worse every year, instead of better. And also, going to the store has its own rewards. You get to talk to real people, see and touch the things you want to buy, etc. Now we're alone behind a screen, jumping through absurd and arbitrary hoops that keep getting harder and harder (tried to solve a captcha lately) and fighting "AI" systems fed with stupid data.

whoomp12342 5y ago

that tragedy is much more prolific than just security. It applies to workplace policies, classroom rules, tourism etc...

lrem 5y ago

Three European accounts I sometimes use for online payments, each from a different country, don't make me miserable like that. Apparently one of these banks was founded early in Abraham Lincoln's presidency, so it's not a matter of choosing the new coolness too.

ed_balls 5y ago

Revolut does this better. You put card info and press Approve in the app a few seconds later.

Doxin 5y ago

> in Europe, online payments are becoming annoying to a degree that would have been unthinkable ten years ago. I'd just like to chime in here to say that this isn't universal across Europe. The dutch iDeal payment system only requires you to scan a QR code with your phone and enter your PIN also on your phone. I believe belgium at least uses a similar system, but I'm sure iDeal is not unique. Not to discount your experience of course, sounds like a real hassle and an unnecessary one at that.