4 ms·

Apart from creepyness, it is absolutely amazing that the bank does that. I'm very impressed that a bank has such creative hacker minds to build a warning system

Apart from creepyness, it is absolutely amazing that the bank does that. I'm very impressed that a bank has such creative hacker minds to build a warning system like that.

nijave 4y ago
I'm guessing they see enough fraud that such a system quickly paid for itself. Still on the fence whether the creepiness is worth it, though. Seems like there are easier alternatives like "graylisting" where a transaction is in a pending state for 2-3 days where it's cancellable (and maybe can be expedited with a phone call). Seems like that'd offer a nice middle-ground between scanning your computer and protecting from scammers.
tpmx 4y ago
Agreed. I'd want to be a customer of that bank. Banks should be on the offense against fraud by default.
- Mindwipe 4y ago
  Somewhat. As one of their customers, I think their password policies are extremely unhelpful to creating secure logons, and make it almost impossible to use a password manager.
asolove 4y ago
This is actually very common for any kind of security fingerprinting use-case in the browser, especially in banking/payments. If you work forwards from "wow, fonts are a weird fingerprint technique" it seems clever. But the reality is it's much more straightforward if you just work it backwards. Someone said: we have access to the customer's browser, what can we grab to throw into our ML model? You look in the DOM spec, grab every piece of data you can get from the customer's system and send it all. Fonts is one thing that ended up being useful. (I am not condoning this practice, just happen to be aware of it very well.)
- somedude895 4y ago
  I suppose they have also been in contact with Teamviewer and maybe they were the ones who suggested this solution being that they were the ones adding that hidden font.
323 4y ago
In many countries bank are sort of responsible if they authorize a payment from a hacked client. So there is a lot of incentives to detect hacked clients.
amendegree 4y ago
Its cool but really annoying that they still don't have a good API for importing my transactions to a budgeting app. At least their US site still requires logging in and scrapping, and of course their 2FA is still cell number only.
duxup 4y ago
My local credit union teller told me that they chat up old customers who are moving money around to see if they are being scammed. Supposedly they did help one person who told them what they were up to and they stopped them.

Apart from creepyness, it is absolutely amazing that the bank does that. I'm very impressed that a bank has such creative hacker minds to build a warning system like that.

nijave 4y ago

I'm guessing they see enough fraud that such a system quickly paid for itself. Still on the fence whether the creepiness is worth it, though. Seems like there are easier alternatives like "graylisting" where a transaction is in a pending state for 2-3 days where it's cancellable (and maybe can be expedited with a phone call). Seems like that'd offer a nice middle-ground between scanning your computer and protecting from scammers.

tpmx 4y ago

Agreed. I'd want to be a customer of that bank. Banks should be on the offense against fraud by default.

Mindwipe 4y ago
Somewhat. As one of their customers, I think their password policies are extremely unhelpful to creating secure logons, and make it almost impossible to use a password manager.

asolove 4y ago

This is actually very common for any kind of security fingerprinting use-case in the browser, especially in banking/payments. If you work forwards from "wow, fonts are a weird fingerprint technique" it seems clever. But the reality is it's much more straightforward if you just work it backwards. Someone said: we have access to the customer's browser, what can we grab to throw into our ML model? You look in the DOM spec, grab every piece of data you can get from the customer's system and send it all. Fonts is one thing that ended up being useful. (I am not condoning this practice, just happen to be aware of it very well.)

somedude895 4y ago
I suppose they have also been in contact with Teamviewer and maybe they were the ones who suggested this solution being that they were the ones adding that hidden font.

323 4y ago

In many countries bank are sort of responsible if they authorize a payment from a hacked client. So there is a lot of incentives to detect hacked clients.

amendegree 4y ago

Its cool but really annoying that they still don't have a good API for importing my transactions to a budgeting app. At least their US site still requires logging in and scrapping, and of course their 2FA is still cell number only.

duxup 4y ago

My local credit union teller told me that they chat up old customers who are moving money around to see if they are being scammed. Supposedly they did help one person who told them what they were up to and they stopped them.