3 ms·

When a major company, especially a financial services company, is subject to public security vulnerability disclosures like this, it should really make other co

by epenn 15y ago

When a major company, especially a financial services company, is subject to public security vulnerability disclosures like this, it should really make other companies stand up and take notice. There is absolutely no excuse for these kinds of vulnerabilities to exist on a production system. When Citibank was recently hacked by simply changing the account number in URLs, that should have been enough for other financial institutions to do an internal security audit to make sure they weren't susceptible to anything similar. Don't wait until it's too late. For the sake of their customers I hope this is resolved swiftly.

joelhaasnoot 15y ago
Not to mention that that's a trivial security mistake. ActiveRecord makes it very easy to just "read" the id, and ignore whether or not the user actually has access to it, or just guessed the id. Any operation using an id needs to be checking if you actually have rights to the object. Yes it requires an extra SELECT before you UPDATE or an extra condition (my ORM doesn't do that), but it's secure.
viraptor 15y ago
It seems the bigger the company is the more irresponsible they become. In UK in the bank I use, you can activate protection of your debit card / current account (usage analysis, higher insurance), but to do that you need to register with Experian (credit rating company). The process for that is: put your recent bill, bank statement and photocopy of ID in an envelope and post it to them via normal mail. I decided to ignore that great offer and keep my account secure in traditional way. Apparently ignorance with regards to the internet sites is not what causes big companies to act in stupid ways. It's the whole mindset...
- sliverstorm 15y ago
  I'm pretty sure normal mail is generally quite secure. Sure, there's very little barrier to someone opening your envelope, but perhaps because the ratio of sensitive stuff vs. letters to grandma is so low, I'm not aware of it ever happening much.
  - viraptor 15y ago
    There's one big difference in those letters though. The letter to grandma will be addressed to a person. The letter with documents for Experian will be addressed to... Experian, which is a known company dealing with money and personal data.
    - sliverstorm 15y ago
      True, but the sheer volume of mail makes sorting through it a formidable task. The US Postal Service has sorting capacity like you wouldn't believe. A criminal could in theory target Experian's mailing address, so perhaps it simply comes down to whether you believe they can secure their property.

by epenn 15y ago

joelhaasnoot 15y ago

Not to mention that that's a trivial security mistake. ActiveRecord makes it very easy to just "read" the id, and ignore whether or not the user actually has access to it, or just guessed the id. Any operation using an id needs to be checking if you actually have rights to the object. Yes it requires an extra SELECT before you UPDATE or an extra condition (my ORM doesn't do that), but it's secure.

viraptor 15y ago

It seems the bigger the company is the more irresponsible they become. In UK in the bank I use, you can activate protection of your debit card / current account (usage analysis, higher insurance), but to do that you need to register with Experian (credit rating company). The process for that is: put your recent bill, bank statement and photocopy of ID in an envelope and post it to them via normal mail. I decided to ignore that great offer and keep my account secure in traditional way. Apparently ignorance with regards to the internet sites is not what causes big companies to act in stupid ways. It's the whole mindset...

sliverstorm 15y ago
I'm pretty sure normal mail is generally quite secure. Sure, there's very little barrier to someone opening your envelope, but perhaps because the ratio of sensitive stuff vs. letters to grandma is so low, I'm not aware of it ever happening much.
- viraptor 15y ago
  There's one big difference in those letters though. The letter to grandma will be addressed to a person. The letter with documents for Experian will be addressed to... Experian, which is a known company dealing with money and personal data.
  - sliverstorm 15y ago
    True, but the sheer volume of mail makes sorting through it a formidable task. The US Postal Service has sorting capacity like you wouldn't believe. A criminal could in theory target Experian's mailing address, so perhaps it simply comes down to whether you believe they can secure their property.