6 ms·

>I'd rather live in a world where banks are solely responsible for fraudulent withdrawals than one where banks can shirk responsibility to their patrons. That i

>I'd rather live in a world where banks are solely responsible for fraudulent withdrawals than one where banks can shirk responsibility to their patrons. That is only possible through regulation. I'd rather live in a world in which effective security measures prevent fraud than a world in which there are weak security measures and endless debates as to who should be blamed when they fail. Regardless of your political stance, I think we can agree that the system is more technicially-broken than it is socially-broken. I think understanding the problem in solely in terms of more/less regulation is a bone-headed thing to do. I think what we have isn't a free market but a duopoly of mastercard/visa each with control over their respective domain. You can't upgrade the security, privacy, or efficiency of the network because the big players benefit from the insecurity, surveilance, and inefficiency. Decreased regulation will probably increase their stranglehold on the industry, as you've noted. Increased regulation will cement current ineffective practices and make different buisness models impossible. People turn to cryptocurrency, not because it's more private/secure/etc but because it is the most private/secure/etc system that works without the permission of the big rent-seekers.

hayst4ck 4y ago
> I'd rather live in a world in which effective security measures prevent fraud than a world in which there are weak security measures and endless debates as to who should be blamed when they fail. Regardless of your political stance, I think we can agree that the system is more technicially-broken than it is socially-broken. But this is a problem of responsibility. Customer responsibility is an O(people) security problem. Bank responsibility is an O(banks) problem. In terms of alignment to fraud mitigation, bank responsibility leads to better technical security because they become the implementers of it to protect their own interests. From an outcome based perspective banks must be accountable. > I think understanding the problem in solely in terms of more/less regulation is a bone-headed thing to do. I don't have a more/less regulation perspective. I have a correct/incorrect regulation perspective. > People turn to cryptocurrency, not because it's more private/secure/etc but because it is the most private/secure/etc system that works without the permission of the big rent-seekers. But it isn't. It might be more secure because the average crypto holder is more savvy, but in terms of security properties, I wouldn't let my mom have a crypto wallet, and without a direct wallet, I don't see how crypto has different properties than a bank (an entity making transactions on your behalf), the interface is the same, but the implementation details are different. No?
- DennisP 4y ago
  I'd say that crypto personally held in a hardware wallet is less secure against the sort of frauds described in the article, where the victim personally authorizes a transaction, because there's nobody you can even ask for a refund. But hardware-secured crypto is much more secure against unauthorized access (e.g. a SIM swap without the user's involvement). After getting familiar with crypto, it boggles my mind that we handle so many payments by giving full credentials to the payee and just trusting them not to abuse it or be careless with it. Public keys have been around since the 1970s. Why don't we give retailers a digital signature authorizing a specific transaction? Why are we still using insecure 2FA and user-supplied passwords for bank website access? Ideally, we'd put secure elements and social recovery wallets in all our phones, and use them for everything. It's what we need for crypto, but we could use the same tech as access control for banking systems.
- cowtools 4y ago
  >But it isn't. It might be more secure because the average crypto holder is more savvy, but in terms of security properties, I wouldn't let my mom have a crypto wallet, and without a direct wallet, I don't see how crypto has different properties than a bank (an entity making transactions on your behalf), the interface is the same, but the implementation details are different. No? It's true to some extent that crypto users are more savvy than most, but I think cryptocurrency also has obviously superior security properties to the conventional banking system, technically speaking. In the conventional banking system, there are no "savvy" users because everyone is equally insecure no matter what. In the conventional banking systems it's all based on trust. Trust that the bank obeys the law, trust that law enforcement is not corrupt, etc. The security mechanisms of cryptocurrency are at most a superset of what you can do with the conventional banking systems. If you want to have a third party supervising transactions, you use 2-of-3 multisig for example (https://en.bitcoinwiki.org/wiki/Multisignature https://en.bitcoinwiki.org/wiki/Multisignature). If don't trust your family member to authorize payments without you, you use 2-of-2 multisig. If you don't trust yourself to not lose your keys, you back them up. If you want to limit your risk, you keep a small amount of cryptocurrency in a "hot" wallet. Secondly, I don't think that the idea of a keypair is beyond the understanding of an average person. They effectively already know how to manage secrets in the current system: passwords, bank routing numbers, etc. It's just that the keypair is superior to these systems of authentication which often require you to reveal the secret itself to authenticate (credit card number), do not have enough entropy (4-digit-pin), are open source (E.g. security questions like "what's your mother's maiden name?"), or rely on other centralized systems (SMS-based 2FA). Even if you implemented some sort of "custodial keypair" that allowed you to transparently sign transactions without revealing your secret, that would be a major improvement over the current system which is based on (typically bad) secrets. In many ways, the conventional banking system is more complicated than cryptocurrency, because the failures of cryptocurrencies are "solid" and well-defined (e.g. 51% attacks, MITM attacks, etc.) while the failures of the conventional banking system are "soft and fuzzy". For example, I was reading about a scam the other day wherein the attacker sends the victim a fake check, and asks them to cash out the money- this scam works because banks generally accept checks before validating them, allowing you to spend money that hasn't been validated yet and then charging you later. You might think this is obvious as a boomer, but as a zoomer who has never cashed a check before, this is not obvious at all. And I'm not necessarily saying that cryptocurrency is the end-all-be-all of payment systems. There are superior systems like chaumian cash (https://taler.net/en/ https://taler.net/en/) but they require the permission of the existing banking system (which generally profits off providing services that surveil users and """fix""" the existing insecurity), so they haven't taken off. I get the impression that regulation will never fix this because the nuances at hand will go over the head of any lawmaker who has merely accepted the insecurity of the status quo. I think that even if you get some libertarian or pro-cryptocurrency person in office which doesn't accept the current system, I highly doubt that they would make the right decision needed- it's more likely that any pro-cryptocurrency candidate is just going act in a way that benefits cryptocurrency owners. Compare this to a topic like net neutrality. Even though I am a libertarian, I am more aligned with the democrats' views on net neutrality because of the obama administration's actions. Why? Not because the democrats are especially aligned to solve this problem, but merely they happened to have a good cabinet member or something that happened to understand the issue that election cycle and advise obama on that issue. It seems just as likely to me that the opposite might happen, albeit the democrats tend to be more pro-consumer in general. My point being that elected officials will not campaign on this because it is too nuanced, so solving this through politics is futile. It is better to just to improve cryptocurrency (or some other non-permissive technical solution) until it is competitive and forces the government/banking system to adapt (e.g. Project Hamilton). P.S. I don't understand what you mean by a "direct wallet" here. A hardware wallet?
ClumsyPilot 4y ago
You are missing the forest for the trees -> there will always be some fraud, and thus a devision must be made regarding who is responsible. Furthermore, if the bank don't suffer from faud, they have no incentive to fight it. So there will be no effective securiry
- cowtools 4y ago
  You can just have a voluntary system wherein people decide beforehand how funds are distributed in the case of fraud. That doesn't necessarily require a third party like a bank to surveil and supervise every transaction.
thewebcount 4y ago
> I think what we have isn't a free market but a duopoly of mastercard/visa each with control over their respective domain. You can't upgrade the security, privacy, or efficiency of the network because the big players benefit from the insecurity, surveilance, and inefficiency. What does that have to do with the article? Neither MasterCard nor Visa is involved with Zelle, are they? The article says it's controlled by a group of banks. Presumably they've set up a new system, so they could make it as secure as they'd like.
- cowtools 4y ago
  It's just another proprietary network with its own gatekeepers. I don't see what the fundamental change is here over something like SWIFT. It may only be temporarily competitive as it tries to penetrate the market. Once it reaches a sufficient enough market share, they will be able to hike up fees and disregard users like the systems that came before it.

hayst4ck 4y ago

> I'd rather live in a world in which effective security measures prevent fraud than a world in which there are weak security measures and endless debates as to who should be blamed when they fail. Regardless of your political stance, I think we can agree that the system is more technicially-broken than it is socially-broken. But this is a problem of responsibility. Customer responsibility is an O(people) security problem. Bank responsibility is an O(banks) problem. In terms of alignment to fraud mitigation, bank responsibility leads to better technical security because they become the implementers of it to protect their own interests. From an outcome based perspective banks must be accountable. > I think understanding the problem in solely in terms of more/less regulation is a bone-headed thing to do. I don't have a more/less regulation perspective. I have a correct/incorrect regulation perspective. > People turn to cryptocurrency, not because it's more private/secure/etc but because it is the most private/secure/etc system that works without the permission of the big rent-seekers. But it isn't. It might be more secure because the average crypto holder is more savvy, but in terms of security properties, I wouldn't let my mom have a crypto wallet, and without a direct wallet, I don't see how crypto has different properties than a bank (an entity making transactions on your behalf), the interface is the same, but the implementation details are different. No?

DennisP 4y ago
I'd say that crypto personally held in a hardware wallet is less secure against the sort of frauds described in the article, where the victim personally authorizes a transaction, because there's nobody you can even ask for a refund. But hardware-secured crypto is much more secure against unauthorized access (e.g. a SIM swap without the user's involvement). After getting familiar with crypto, it boggles my mind that we handle so many payments by giving full credentials to the payee and just trusting them not to abuse it or be careless with it. Public keys have been around since the 1970s. Why don't we give retailers a digital signature authorizing a specific transaction? Why are we still using insecure 2FA and user-supplied passwords for bank website access? Ideally, we'd put secure elements and social recovery wallets in all our phones, and use them for everything. It's what we need for crypto, but we could use the same tech as access control for banking systems.
cowtools 4y ago
>But it isn't. It might be more secure because the average crypto holder is more savvy, but in terms of security properties, I wouldn't let my mom have a crypto wallet, and without a direct wallet, I don't see how crypto has different properties than a bank (an entity making transactions on your behalf), the interface is the same, but the implementation details are different. No? It's true to some extent that crypto users are more savvy than most, but I think cryptocurrency also has obviously superior security properties to the conventional banking system, technically speaking. In the conventional banking system, there are no "savvy" users because everyone is equally insecure no matter what. In the conventional banking systems it's all based on trust. Trust that the bank obeys the law, trust that law enforcement is not corrupt, etc. The security mechanisms of cryptocurrency are at most a superset of what you can do with the conventional banking systems. If you want to have a third party supervising transactions, you use 2-of-3 multisig for example (https://en.bitcoinwiki.org/wiki/Multisignature https://en.bitcoinwiki.org/wiki/Multisignature). If don't trust your family member to authorize payments without you, you use 2-of-2 multisig. If you don't trust yourself to not lose your keys, you back them up. If you want to limit your risk, you keep a small amount of cryptocurrency in a "hot" wallet. Secondly, I don't think that the idea of a keypair is beyond the understanding of an average person. They effectively already know how to manage secrets in the current system: passwords, bank routing numbers, etc. It's just that the keypair is superior to these systems of authentication which often require you to reveal the secret itself to authenticate (credit card number), do not have enough entropy (4-digit-pin), are open source (E.g. security questions like "what's your mother's maiden name?"), or rely on other centralized systems (SMS-based 2FA). Even if you implemented some sort of "custodial keypair" that allowed you to transparently sign transactions without revealing your secret, that would be a major improvement over the current system which is based on (typically bad) secrets. In many ways, the conventional banking system is more complicated than cryptocurrency, because the failures of cryptocurrencies are "solid" and well-defined (e.g. 51% attacks, MITM attacks, etc.) while the failures of the conventional banking system are "soft and fuzzy". For example, I was reading about a scam the other day wherein the attacker sends the victim a fake check, and asks them to cash out the money- this scam works because banks generally accept checks before validating them, allowing you to spend money that hasn't been validated yet and then charging you later. You might think this is obvious as a boomer, but as a zoomer who has never cashed a check before, this is not obvious at all. And I'm not necessarily saying that cryptocurrency is the end-all-be-all of payment systems. There are superior systems like chaumian cash (https://taler.net/en/ https://taler.net/en/) but they require the permission of the existing banking system (which generally profits off providing services that surveil users and """fix""" the existing insecurity), so they haven't taken off. I get the impression that regulation will never fix this because the nuances at hand will go over the head of any lawmaker who has merely accepted the insecurity of the status quo. I think that even if you get some libertarian or pro-cryptocurrency person in office which doesn't accept the current system, I highly doubt that they would make the right decision needed- it's more likely that any pro-cryptocurrency candidate is just going act in a way that benefits cryptocurrency owners. Compare this to a topic like net neutrality. Even though I am a libertarian, I am more aligned with the democrats' views on net neutrality because of the obama administration's actions. Why? Not because the democrats are especially aligned to solve this problem, but merely they happened to have a good cabinet member or something that happened to understand the issue that election cycle and advise obama on that issue. It seems just as likely to me that the opposite might happen, albeit the democrats tend to be more pro-consumer in general. My point being that elected officials will not campaign on this because it is too nuanced, so solving this through politics is futile. It is better to just to improve cryptocurrency (or some other non-permissive technical solution) until it is competitive and forces the government/banking system to adapt (e.g. Project Hamilton). P.S. I don't understand what you mean by a "direct wallet" here. A hardware wallet?

ClumsyPilot 4y ago

You are missing the forest for the trees -> there will always be some fraud, and thus a devision must be made regarding who is responsible. Furthermore, if the bank don't suffer from faud, they have no incentive to fight it. So there will be no effective securiry

cowtools 4y ago
You can just have a voluntary system wherein people decide beforehand how funds are distributed in the case of fraud. That doesn't necessarily require a third party like a bank to surveil and supervise every transaction.

thewebcount 4y ago

> I think what we have isn't a free market but a duopoly of mastercard/visa each with control over their respective domain. You can't upgrade the security, privacy, or efficiency of the network because the big players benefit from the insecurity, surveilance, and inefficiency. What does that have to do with the article? Neither MasterCard nor Visa is involved with Zelle, are they? The article says it's controlled by a group of banks. Presumably they've set up a new system, so they could make it as secure as they'd like.

cowtools 4y ago
It's just another proprietary network with its own gatekeepers. I don't see what the fundamental change is here over something like SWIFT. It may only be temporarily competitive as it tries to penetrate the market. Once it reaches a sufficient enough market share, they will be able to hike up fees and disregard users like the systems that came before it.