3 ms·

my experience with banks has been the opposite - they're always a ways behind the rest of the web on security measures. some banks are still rolling out 2fa.

my experience with banks has been the opposite - they're always a ways behind the rest of the web on security measures. some banks are still rolling out 2fa. and look how horrifically insecure credit cards are. not because they don't care, but because they see technical measures as only a small piece of their overall security strategy, and online access as only a small part of their business that they consider untrustworthy no matter how much security is implemented. where most of the web treats authenticated users as trusted, banks still treat an authenticated user as mostly untrustworthy, and all of their actions as still being a potential risk, so securing the authentication isn't so important.

freedomben 3y ago
Some banks are definitely behind on the curve, but notably I think that tends to be around customer-facing stuff. Given that whatever they use has to work for very elderly people as well young people, it surely makes it difficult to move/change things. WEI though is entirely on the backend though. It can be implemented as soon as the major OSes have it integrated, and it requires nothing from the user (besides installing their updates, which is mostly forced).
dredmorbius 3y ago
As others have noted, banks are governed by (often multiple) regulators, at the local, state/regional, and national levels typically. As Brian Krebs has noted, on top of the already-oligopic banking sector is an even more ologopic banking-computer-services sector: "What Is Your Bank’s Security Banking On?" (2018).[1] Sadly, the industry is dominated by a small handful of banking platform providers. Four, Fiserv, Jack Henry, FIS, and CSI, serv over 80% of the market. Bank regulators, responding to Krebs, said that "small to mid-sized banks are massively beholden to their platform providers, and many banks simply accept the defaults instead of pushing for stronger alternatives." This does also suggest that there may be a small number of points of control over which to enact useful change, though of course there's also a concentrated lobbying interest in avoiding or counterinfluencing same. ________________________________ Notes: 1. <https://krebsonsecurity.com/2018/03/what-is-your-banks-security-banking-on/ https://krebsonsecurity.com/2018/03/what-is-your-banks-secur...> (HN: <https://news.ycombinator.com/item?id=20203482 https://news.ycombinator.com/item?id=20203482>)
JohnFen 3y ago
A couple of decades back, I worked on middleware applications for banks. So my knowledge is 100% dated and things may have changed. But back then, bank security was terrible when viewed through the lens of how hard it is to break in and do bad things. On the other hand, bank security was fantastic in terms of being able to detect when this happened and to be able to find the perpetrators.

freedomben 3y ago

Some banks are definitely behind on the curve, but notably I think that tends to be around customer-facing stuff. Given that whatever they use has to work for very elderly people as well young people, it surely makes it difficult to move/change things. WEI though is entirely on the backend though. It can be implemented as soon as the major OSes have it integrated, and it requires nothing from the user (besides installing their updates, which is mostly forced).

dredmorbius 3y ago

As others have noted, banks are governed by (often multiple) regulators, at the local, state/regional, and national levels typically. As Brian Krebs has noted, on top of the already-oligopic banking sector is an even more ologopic banking-computer-services sector: "What Is Your Bank’s Security Banking On?" (2018).[1] Sadly, the industry is dominated by a small handful of banking platform providers. Four, Fiserv, Jack Henry, FIS, and CSI, serv over 80% of the market. Bank regulators, responding to Krebs, said that "small to mid-sized banks are massively beholden to their platform providers, and many banks simply accept the defaults instead of pushing for stronger alternatives." This does also suggest that there may be a small number of points of control over which to enact useful change, though of course there's also a concentrated lobbying interest in avoiding or counterinfluencing same. ________________________________ Notes: 1. <https://krebsonsecurity.com/2018/03/what-is-your-banks-security-banking-on/ https://krebsonsecurity.com/2018/03/what-is-your-banks-secur...> (HN: <https://news.ycombinator.com/item?id=20203482 https://news.ycombinator.com/item?id=20203482>)

JohnFen 3y ago

A couple of decades back, I worked on middleware applications for banks. So my knowledge is 100% dated and things may have changed. But back then, bank security was terrible when viewed through the lens of how hard it is to break in and do bad things. On the other hand, bank security was fantastic in terms of being able to detect when this happened and to be able to find the perpetrators.