6 ms·
I found a Reddit post today about a German bank mailing USB sticks containing their new general terms and conditions: https://www.reddit.com/r/de/comments/1ax7k
by hubraumhugo 3y ago
I found a Reddit post today about a German bank mailing USB sticks containing their new general terms and conditions: https://www.reddit.com/r/de/comments/1ax7ky3/milde_interessant_die_sparkasse_schickt_mir_einen/ https://www.reddit.com/r/de/comments/1ax7ky3/milde_interessa...
You can't make this up.
- Kwpolska 3y agoThere's an EU law demanding such documents to be delivered on a "durable medium". Some banks and financial institutions may have a strange approach to those, even though email attachments seem to be enough for others.
- yau8edq12i 3y agoI've never heard of this "EU law". Which one are you talking about? I live in the EU and my bank pretty much only contacts me through email.
- Repulsion9513 3y agohttps://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A62011CC0049 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
- ar0 3y agoI do not read this court decision like that at all: the point of contention there seems to be that the customer was just sent a link to a webpage (where the contractual terms can be changed from under him at will by the company, thus this not being durable). The court makes it pretty clear in my (non-lawyer) opinion that attaching a PDF to the email would have been fine.
- actionfromafar 3y agoI was prepared to disagree with you, but I now have the same interpretation you have. Durable medium can be email - but the example seems a little fuzzy, for instance a durable medium is definitely when the email is stored on a HDD on a customer device. But is it still durable medium if the email only exists in a webmail? Probably yes, but maybe no. So the conservative approach would be to send paper for some things. (Or in this case, stupidly, USB devices. Banks, don't do that, please.) Ramble Edit: it's unfortunate IMHO that there is no "read only" medium anymore. Not sure what it would look like now when USB-C is taking over the world, and that ship probably sailed, but it would be really cool and useful to have the option of a "data only" USB. Maybe computers could have one USB port marked as "ROM". Or a switch or LED symbol indicating "ROM safe" mode. When using such a ROM port, anything USB inserted there would only look like a DVD reader. A USB drive would get its files "mirrored" into a virtual ISO filesystem. Any other devices, such as keyboards etc would be just ignored and not connected to at all.
- jimktrains2 3y agoThat doesn't fix the issue though. The issue is a killer USB or a virus on the disk. Being able to only read an infected file still allows it to be read. Also, this is only a software solution as the USB protocol would require bidirectional transmission.
- actionfromafar 3y agoIt doesn't fix the issue vs paper. But it would bring us back to being as safe as a CD or diskette was. I was thinking a special chip, talking bidirectionally both ways, pretending to be a PC host to the USB drive, and pretending to a DVD-ROM to the actual PC.
- dfox 3y agoMost USB flash controllers support being read-only by either just being read-only or emulating optical drive. Obviously for the WORM usecase this is only an software solution inside the controller configuration as the underlying medium is still writable/erasable flash. In theory one could replace the flash with some kind of mask ROM with NAND-like interface and make it truly read only, but the cost makes that impractical for most applications. Then there are LTO tapes that have WORM version, which is notionally not overwritable, but that is IIRC also only enforced by software (of the drive).
- Repulsion9513 3y ago> There's an EU law demanding such documents to be delivered on a "durable medium". Some banks and financial institutions may have a strange approach to those, even though email attachments seem to be enough for others. Even the (*-grand)parent never said the law actually says it can't be an email attachment, they said companies seem to interpret it that way. Which would not be surprising in the least. Then someone said they've never heard of any such law, and I pointed out that it exists. I'm not sure who you're arguing with but it isn't me or in fact any of the people in this thread.
- yau8edq12i 3y agoPutting aside the fact that the conclusion of this text is not at all what GP said... You do realize that this is not a law, not even a court decision, but that it is a prosecutor's opinion / suggestion to the court??
- Repulsion9513 3y agoPutting aside what? Go back and read what the GP actually said, and what the parent comment (yours) actually said as well. All I was pointing out is that there is in fact such a law (requiring a durable medium), because you said you had never heard of such a law. Sheesh, reading comprehension, please. That or stop moving the goalposts
- Kwpolska 3y agohttps://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62011CC0049 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...
- verticalscaler 3y agoHaha, nice try!
- pornel 3y agoIt defers to a repealed 97/7/EC, replaced by 2011/83/EU: > Durable media should enable the consumer to store the information for as long as it is necessary for him to protect his interests stemming from his relationship with the trader. Such media should include in particular paper, USB sticks, CD-ROMs, DVDs, memory cards or the hard disks of computers as well as e-mails. USB sticks are on the list, but so is paper and e-mail. This USB stick could have been an e-mail.
- yau8edq12i 3y agoPutting aside the fact that the conclusion of this text is not at all what GP said... You do realize that this is not a law, not even a court decision, but that it is a prosecutor's opinion / suggestion to the court?? Yes, if two people are going to answer with the exact same link and nothing else, I'm going to answer both with the exact same comment.
- Kwpolska 3y agoIt is a court decision. Citing the actual law and context for it.
- yau8edq12i 3y agoUh... Are we reading the same document? > Opinion of Advocate General Mengozzi delivered on 6 March 2012. > [...] > In the light of the foregoing considerations, I suggest that the Court answer the question referred to it by the Oberlandesgericht as follows: It is not the court's decision.
- actionfromafar 3y agoFor some things, you must use paper (or as it turns out, USB). Why the bank decided to use USB for this purpose, instead of paper, is very strange.
- TeMPOraL 3y agoHere in Poland, I've already had several banks and at least one insurer send me CD-ROMs. Never heard of anyone sending USB sticks before, but I'm not surprised. The problem is, approximately no one owns a CD/DVD reader anymore, and there are no modern read-only physical media. With SD cards also going the way of the floppy, USB stick is just about the only medium you can hope most customers have means to read.
- actionfromafar 3y agoSD cards are really neat. Theoretically they could have been made with a fixed notch so they would always present as read-only.
- 01HNNWZ0MV43FF 3y agoSince SD cards and USB sticks are both just computers you plug in to a network port on your computer, they could definitely make write-once SD card controllers.
- TeMPOraL 3y agoAFAIK notch is just declaration of intent, like with floppies and magnetic tapes - it's politely asking the reading device to not write to the medium, and it's up to the device to respect it (or up to user to not bridge the notch with a piece of tape). Still, actual write-once (or read/write until hardware fuse is triggered, read-only afterwards) SD cards should be possible to make.
- vel0city 3y agoIt depends on the card. Sometimes it is just a suggestion to the firmware, sometimes it physically prevents writes. I've definitely encountered read-only SD cards which I couldn't figure out a way to set it back to RW mode.
- drooopy 3y agoLikewise. I have multiple accounts across different EU/Eurozone states and with the exception of the original contracts that I've had to sign to open said accounts, I've never had to deal with anything other than e-mail or in-app communication.
- evandale 3y agoIf you've never heard of it why not Google "eu durable medium"? Looks like the claim is true and I didn't need to ask for a source to figure it out. https://www.fca.org.uk/firms/durable-medium https://www.fca.org.uk/firms/durable-medium https://www.lexology.com/library/detail.aspx?g=788714a1-d7b6-4bef-a976-96a6fc7eb428 https://www.lexology.com/library/detail.aspx?g=788714a1-d7b6...
- tux3 3y agoI will simply refuse to believe this is real. As a psychological defense mechanism. What the hell.
- __jonas 3y agoClearly the safer option is sending the terms via CD https://t3n.de/news/sparkasse-digital-strategie-cds-per-post-verschickt-1453537/ https://t3n.de/news/sparkasse-digital-strategie-cds-per-post... Since no-one has a CD drive in their computer anymore, the security risk is negligible
- lifestyleguru 3y agoThe CD contains PDF with scanned terms and conditions?
- paulmd 3y agoSince nobody has cd drives anymore, I don’t think it functionally needs to? You could save on shipping costs by just mailing blank disks instead, plus hey free disks! It’s like aol all over again.
- cesarb 3y agoAnd even if you do have a CD drive in your computer, the risk is still lower than a USB stick. A CD contains only data, it cannot do things like emulating a keyboard. The worst it can do is shatter when your high-speed DVD-ripping drive spins it up a bit too fast.
- scns 3y agoInstall a rootkit? https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...
- kibwen 3y agoCD drives may not be able to emulate a keyboard, but they can certainly install software. You might not click on any system popups that appear after inserting a malicious CD, but the sort of people who plug in random USB sticks likely wouldn't bat an eye. "The Sony BMG CD copy protection scandal concerns the copy protection measures included by Sony BMG on compact discs in 2005. When inserted into a computer, the CDs installed one of two pieces of software that provided a form of digital rights management (DRM) by modifying the operating system to interfere with CD copying. Neither program could easily be uninstalled, and they created vulnerabilities that were exploited by unrelated malware. One of the programs would install and "phone home" with reports on the user's private listening habits, even if the user refused its end-user license agreement (EULA), while the other was not mentioned in the EULA at all. Both programs contained code from several pieces of copylefted free software in an apparent infringement of copyright, and configured the operating system to hide the software's existence, leading to both programs being classified as rootkits." https://en.m.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.m.wikipedia.org/wiki/Sony_BMG_copy_protection_roo...
- lifestyleguru 3y agoSome German banks created paid storage service with multiple plans available. They are required to deliver documents to their customers but managements have massive brainfuck about the requirement and the most absurd solutions and ideas are being sold to them.
- k8sToGo 3y agoMy bank offers that and I use it to store backups of important files.
- lifestyleguru 3y agoWhat makes bank a relevant or suitable service provider to store my "important files"? To store any files whatsoever other than those they're obliged to deliver to me?! "upload your testament, passport, and id documents here, you can trust us we are A BANK".
- hayyyyydos 3y agoIt's the electronic version of a safe deposit box
- OJFord 3y agoI can understand that marketing message making sense and appealing to.. some people; I am surprised to see it on HN though. This is like buying vegetable & olive oils from BP or Shell because they're oil experts looking for new income streams as we shift away from petroleum.
- jimktrains2 3y agoWithout knowing the details, one difference from your hypothetical could be ease of access to 3rd parties, especially after death.
- lifestyleguru 3y ago
- em-bee 3y agoi love this comment: ich arbeite als (externe) CyberCyberCyber Nase in einer Organisation irgendwo in der Sparkassengruppe. Ich kann dir versichern, dass niemand, der auch nur im entferntesten was mit InfoSec in der Bank zu tun hat, von dieser Marketing Idee erfahren hat. "I work as an (external) CyberCyberCyber nose in an organization somewhere in the Sparkassen-group. I can assure you that no one who is involved even the slightest with infosec at the bank, has heard anything about this marketing idea."
- jowea 3y agoHey at least it's 100% safe from a hacker who has broken SSL/TLS altering the terms and conditions on the wire.
- Aldipower 3y agoMan, this is just a marketing gimmick. I am always short in USB sticks. So, could have gotten another one.. How about a little bit more of humor?
- romwell 3y agoIf you give me your mailing address, I'll arrange it that the bank will mail you one, too. Just be sure to use the included NOTVIRUS.EXE viewer for best experience.
- marcosdumay 3y agoJust set it to autorun. I'm sure anybody you mail it to will just confirm running it without even looking what they are doing.
- Aldipower 3y agoIn your fantasies. It is of course in the responsibility of the bank to check if this is virus free. I am using Linux anyway.. No autorun.exe here. Is this still a thing with Windows?
- NegativeK 3y agoThe problem isn't the bank verifying that the USB stick is clean; the problem is that the bank is distributing info in the exact same way that APTs would try to compromise an important target. Hyperbole, but it's like a bank employee calling you from an unknown number and asking for your email password so they can make sure their communications about your mortgage application don't go to the spam folder.
- romwell 3y ago>It is of course in the responsibility of the bank to check if this is virus free Oh, trust me, it'll absolutely come from the bank where they're doing all the due diligence necessary, and not from a random malicious party! It'll say FROM THE BANK on the envelope, so you'll know it's legit. >I am using Linux anyway.. No autorun.exe here. Oh, you'll have to do a bit more work then. Just follow the instructions included in the envelope, and run sudo ./notvirus.sh from the terminal from the root directory of the USB drive once you mount it.
- praptak 3y agoGerman IT is weird, German bank IT doubly so.
- vgalin 3y ago(translation provided by ChatGPT) > Terms and Conditions, Price and Service List, Conditions. > Dear customer, > our price and service list, our terms and conditions, as well as further conditions which will come into effect on May 1, 2024, can be found on the USB stick. > With kind regards, > The Sparkasse Bremen AG
- TurkTurkleton 3y ago[flagged]
- sannysanoff 3y agooften, chatgpt translates better.
- DonHopkins 3y agoThat, and you can ask it to translate literally or colloquially, to summarize or explain about acronyms, cultural references, names, code, syntax, diagrams, graphics, or anything else. GP: If you're going to play a curmudgeon, at least get some first hand experience with what you choose to complain about, otherwise your curmudgeoning isn't very effective, and you complain about things that aren't actually problems, and miss out on complaining about real problems. I love to hate and complain about Unix and X-Windows and C++ and GCS, but that's because I've used them, not because I succeeded in avoiding them.
- pmx 3y agoSheesh! Do you need a hug? Anyway, with chat GPT you can simply give it the image from the reddit post and get the OCRd and translated text. It's one step, it's fast, it's accurate enough. Why not use it?
- phito 3y agoIt's often better at picking up context
- ascar 3y ago
- grishka 3y agoAt least you get a free USB stick!