4 ms·

As horrible as this is, I suspect this will be far worse in enterprise companies. We’ve already seen issues with email impersonation where top managers or CEOs

by devjab 3y ago

As horrible as this is, I suspect this will be far worse in enterprise companies. We’ve already seen issues with email impersonation where top managers or CEOs order money transfers, and since this works better than it should, we now use confirmation of some sort. Imagine if you’d get both the email and a call, maybe even a video call in the future with the confirmation… Especially CEOs will be very “easy” to impersonate since there is often quite a lot of video footage freely available of them. You’re going to have to rely on personal confirmation, or digital signatures to do these sort of transfers. We use the digital signature since we have a system for that in Denmark, but we can’t use that for our Japanese department as an example as they don’t have a similar system which integrates with our national digital ID for companies. I guess our national system will eventually be extendable to Japanese citizens in some way, but it’ll likely never be extended to al the countries we operate in for various reasons. And this is us being sort of ahead of the curve on this, even for most companies around here in the worlds most digitalised country (unless that’s Estonia now). Interesting times.

BOOSTERHIDROGEN 3y ago
Interesting any article about the systems on denmark
- piva00 3y ago
  It's more than Denmark, the Nordics in general use digital signatures for accessing banking, government services (tax agencies, healthcare, pension systems, etc.), online payment ID checks, and so on. In Denmark I believe NemID/MitID is the most used one, here in Sweden we have BankID (most used), and Freja eID, there are a few smaller ones as well; Norway has their own BankID that is independent from the Swedish one; Finland has their own as well (and I heard it's been live before the 2000s).
  - buzer 3y ago
    The original Finnish one was TUPAS, it has been available since at least 1998. It was phased out in 2019 as it was not compatible with eIDAS. For end users there isn't really any difference but the old system required separate contracts between each bank and service provider. Due to that service providers also couldn't use 3rd party (think service like Auth0) who would handle contracts with individual banks. From my understanding it was also fairly expensive (in terms of per authentication event). The new one is called Finnish Trust Network and uses OIDC and in some cases SAML, TUPAS had it's own protocol (I'm not sure if there even was a standard protocol for that kind of authentication back then, even SAML 1.0 came out only in 2002).
- codingminds 3y ago
  I don't know about the danish system, but I guess it's similar to the ones used by Norway and Sweden https://bankid.no/ https://bankid.no/ (Norway) https://www.bankid.com/ https://www.bankid.com/ (Sweden)
macrolime 3y ago
You can use digital signatures without relying on a national system. There are plenty of available digital signature systems available. While that may not work well for communicating with external actors, within an enterprise it should be no problem.
hiddencost 3y ago
Japan is an interesting example. My understanding is that Japan relies heavily on the Hanko (a physical stamp), which makes business difficult as agreements need to be stamped in person.
_visgean 3y ago
I wonder if the problem is with impersonating C-level executives or if the problem is that they have power to just send money.. In recent John Oliver episode there was banker who simply bankrupted his bank by sending money to the scammer. Or this guy https://www.npr.org/2019/03/25/706715377/man-pleads-guilty-to-phishing-scheme-that-fleeced-facebook-google-of-100-million https://www.npr.org/2019/03/25/706715377/man-pleads-guilty-t.... Do these companies not have proper process for sending so much money with multiple levels of people involved?
- Turing_Machine 3y ago
  > I wonder if the problem is with impersonating C-level executives or if the problem is that they have power to just send money. Yeah, I guess I'm surprised that executives are allowed to do this without a "second opinion", so to speak. In my (thankfully) long-ago days as a manager, I had a petty cash fund (used for stuff like office supplies and coffee filters and such). I'd spend that as I saw fit, and just send in my receipts once in a while (usually only when the petty cash box got low). No one got too worried about that. Above that, I could make medium-sized purchases without approval, but I had to send in the paperwork immediately, along with a justification of why I'd spent the money. Anything above that required approval at a higher level. At the very least, it seems like both the CEO and the CFO should have to sign off on any money transfers of a potentially company-bankrupting size. Maybe even add the CTO (or some other executive), just to have a third watchdog on the case.
vermorel 3y ago
As a CEO, this is one of the many reasons why I do not do money transfers myself. Ps: your insights are spot on. Been plagued by this issue for years. Deep fake is merely a refinement of a pre-existing fraud pattern.

by devjab 3y ago

BOOSTERHIDROGEN 3y ago

Interesting any article about the systems on denmark

piva00 3y ago
It's more than Denmark, the Nordics in general use digital signatures for accessing banking, government services (tax agencies, healthcare, pension systems, etc.), online payment ID checks, and so on. In Denmark I believe NemID/MitID is the most used one, here in Sweden we have BankID (most used), and Freja eID, there are a few smaller ones as well; Norway has their own BankID that is independent from the Swedish one; Finland has their own as well (and I heard it's been live before the 2000s).
- buzer 3y ago
  The original Finnish one was TUPAS, it has been available since at least 1998. It was phased out in 2019 as it was not compatible with eIDAS. For end users there isn't really any difference but the old system required separate contracts between each bank and service provider. Due to that service providers also couldn't use 3rd party (think service like Auth0) who would handle contracts with individual banks. From my understanding it was also fairly expensive (in terms of per authentication event). The new one is called Finnish Trust Network and uses OIDC and in some cases SAML, TUPAS had it's own protocol (I'm not sure if there even was a standard protocol for that kind of authentication back then, even SAML 1.0 came out only in 2002).
codingminds 3y ago
I don't know about the danish system, but I guess it's similar to the ones used by Norway and Sweden https://bankid.no/ https://bankid.no/ (Norway) https://www.bankid.com/ https://www.bankid.com/ (Sweden)

macrolime 3y ago

You can use digital signatures without relying on a national system. There are plenty of available digital signature systems available. While that may not work well for communicating with external actors, within an enterprise it should be no problem.

hiddencost 3y ago

Japan is an interesting example. My understanding is that Japan relies heavily on the Hanko (a physical stamp), which makes business difficult as agreements need to be stamped in person.

_visgean 3y ago

I wonder if the problem is with impersonating C-level executives or if the problem is that they have power to just send money.. In recent John Oliver episode there was banker who simply bankrupted his bank by sending money to the scammer. Or this guy https://www.npr.org/2019/03/25/706715377/man-pleads-guilty-to-phishing-scheme-that-fleeced-facebook-google-of-100-million https://www.npr.org/2019/03/25/706715377/man-pleads-guilty-t.... Do these companies not have proper process for sending so much money with multiple levels of people involved?

Turing_Machine 3y ago
> I wonder if the problem is with impersonating C-level executives or if the problem is that they have power to just send money. Yeah, I guess I'm surprised that executives are allowed to do this without a "second opinion", so to speak. In my (thankfully) long-ago days as a manager, I had a petty cash fund (used for stuff like office supplies and coffee filters and such). I'd spend that as I saw fit, and just send in my receipts once in a while (usually only when the petty cash box got low). No one got too worried about that. Above that, I could make medium-sized purchases without approval, but I had to send in the paperwork immediately, along with a justification of why I'd spent the money. Anything above that required approval at a higher level. At the very least, it seems like both the CEO and the CFO should have to sign off on any money transfers of a potentially company-bankrupting size. Maybe even add the CTO (or some other executive), just to have a third watchdog on the case.

vermorel 3y ago

As a CEO, this is one of the many reasons why I do not do money transfers myself. Ps: your insights are spot on. Been plagued by this issue for years. Deep fake is merely a refinement of a pre-existing fraud pattern.