4 ms·

That's bizarre - someone tried to scam me in a similar way literally a few minutes ago. I am selling something on a marketplace. Someone contacted me - they wa

That's bizarre - someone tried to scam me in a similar way literally a few minutes ago. I am selling something on a marketplace. Someone contacted me - they want to buy the thing I am selling. Do I still have it? I say yes. They say they are sending a GLS courier to collect the item. I figure they need the item fast - we are celebrating Christmas tomorrow. Why not. The "buyer" sends me a link to a service supposedly offered by GLS, where GLS works as an intermediary - they collected the money from the buyer; when they collect the item, they will pay me. This is happening in the Czech Republic, and services like that seem plausible here. I do not know every detail of every delivery service offered here. The page looks just like an ordinary GLS page. I am in a hurry. I do not pay that much attention. I pause and check only when redirected to my bank's authentication page (this is the phishing part, obviously). Turns out GLS offers no such service. I was closer to giving them what they wanted than I imagined possible. I was on autopilot until the last second. Not even my bank's login page surprised me that much - we have something called "bank identity" that lets you authenticate stuff by your bank ID. It is so convenient that I got used to it and I do it carelessly. >> I hate scammers Yes, me too.

Gys 2y ago
I missed something: why do you as a seller have to enter your bankdetails?
- honzabe 2y ago
  That is the thing - you don't. In Czechia, something called bank ID is commonly used to authenticate. The point is to verify it is you, for example when you sign a contract online, fill in tax returns online... stuff like that. The way it works is that you are on some site, you get redirected to your internet banking, you log in (that's what I meant by "bank details", I am sorry about expressing myself so clumsily), and your bank redirects you back to that site with confirmation that is you. Do I need to verify my identity when someone wants to send me money? Who knows. This is the part that made me check. But I was close to not checking simply because it is habitual, and you do stuff like that automatically. Nowadays, we are often dealing with systems we do not fully understand. You get redirected to some familiar login form, you log in, and you don't even pause. Well, at least I do it. I should be a lot more careful, apparently.
  - XorNot 2y ago
    Login page redirects have become a big user security hazard it would seem - and OAuth is basically the culprit.
    - dylan604 2y ago
      The entire social engineering of sending everything off to 3rd party is something that really irks me. The touted convenience of faster to deploy updates by using 3rd party rather than depending on local version updates has never been enough for me. It also was the sugar pill for switching to rent seeking SaaS to gain traction. I don't want my web server dependent on anyone else's server/service being available or in any other way slowing down my user's experience. The only service that I have no local solution is payment processing.
  - ustad 2y ago
    Holy crap. What a terrible system and I hope my part of the world never implements such forms of tech.
    - noprocrasted 2y ago
      It's an actually really good system, as the origin (aka the domain displayed in your URL bar) changes during the redirect. The problem is the lack of user education as to what an "origin" is. But assuming there is good user education, this is the proper way to do it. One (untrusted) origin redirects you to a trusted one with instructions to give it some information. The trusted origin asks for your authentication and tells you what the untrusted origin is requesting. If you approve, the untrusted origin only gets the very specific data it requested (and you approved) and nothing else.
      - ustad 2y ago
        I’ll repeat what I said above/below: Sorry, I was not clear. I was talking about having to use your bank for authentication/sign in.
    - 2y ago
lifestyleguru 2y ago
The problem is using bank account for anything else than managing and transferring money. Confirming identity is a "convenience" no one asked for. Government services have their own authentication. Bank shouldn't know where and when you are accessing any other services, they _will_ use it for profiling or could even escalate into some KYC enquiry. Government should know only your IBAN. Connecting these dots for various service providers will never work in your favor.

Gys 2y ago

I missed something: why do you as a seller have to enter your bankdetails?

honzabe 2y ago
That is the thing - you don't. In Czechia, something called bank ID is commonly used to authenticate. The point is to verify it is you, for example when you sign a contract online, fill in tax returns online... stuff like that. The way it works is that you are on some site, you get redirected to your internet banking, you log in (that's what I meant by "bank details", I am sorry about expressing myself so clumsily), and your bank redirects you back to that site with confirmation that is you. Do I need to verify my identity when someone wants to send me money? Who knows. This is the part that made me check. But I was close to not checking simply because it is habitual, and you do stuff like that automatically. Nowadays, we are often dealing with systems we do not fully understand. You get redirected to some familiar login form, you log in, and you don't even pause. Well, at least I do it. I should be a lot more careful, apparently.
- XorNot 2y ago
  Login page redirects have become a big user security hazard it would seem - and OAuth is basically the culprit.
  - dylan604 2y ago
    The entire social engineering of sending everything off to 3rd party is something that really irks me. The touted convenience of faster to deploy updates by using 3rd party rather than depending on local version updates has never been enough for me. It also was the sugar pill for switching to rent seeking SaaS to gain traction. I don't want my web server dependent on anyone else's server/service being available or in any other way slowing down my user's experience. The only service that I have no local solution is payment processing.
- ustad 2y ago
  Holy crap. What a terrible system and I hope my part of the world never implements such forms of tech.
  - noprocrasted 2y ago
    It's an actually really good system, as the origin (aka the domain displayed in your URL bar) changes during the redirect. The problem is the lack of user education as to what an "origin" is. But assuming there is good user education, this is the proper way to do it. One (untrusted) origin redirects you to a trusted one with instructions to give it some information. The trusted origin asks for your authentication and tells you what the untrusted origin is requesting. If you approve, the untrusted origin only gets the very specific data it requested (and you approved) and nothing else.
    - ustad 2y ago
      I’ll repeat what I said above/below: Sorry, I was not clear. I was talking about having to use your bank for authentication/sign in.
  - 2y ago

lifestyleguru 2y ago

The problem is using bank account for anything else than managing and transferring money. Confirming identity is a "convenience" no one asked for. Government services have their own authentication. Bank shouldn't know where and when you are accessing any other services, they _will_ use it for profiling or could even escalate into some KYC enquiry. Government should know only your IBAN. Connecting these dots for various service providers will never work in your favor.