6 ms·

I don't know how it works in the US, but in Norway most online banks can only be accessed through a Java applet where you enter SSN, password and token-code. Ex

by hucker 14y ago

I don't know how it works in the US, but in Norway most online banks can only be accessed through a Java applet where you enter SSN, password and token-code. Extremely frustrating since whether it works or not in Linux seems like a function of the day of the week, and, well, it's a Java applet.

rodolphoarruda 14y ago
We have the same scenario in Brazil.
- franze 14y ago
  well, in brazil you even have gbieh.dll - an undeletable, unkillable, always running, mysterious, "security" file/process from banco do brasil. http://www.file.net/process/gbieh.dll.html http://www.file.net/process/gbieh.dll.html that's even (slightly) worse than a java applet.
  - rodolphoarruda 14y ago
    yeah, Banco Itaú has its own DLL too. http://rodolphoarruda.pro.br/d/dll.jpg http://rodolphoarruda.pro.br/d/dll.jpg
    - slig 14y ago
      Can't tell if trolling or not. That's an URL and they can name it with whatever name they want (.dll, 1761,1238,196.htm, .php, etc), and has absolutely nothing to do with an actual process running on your machine.
    - ioquatix 14y ago
      Why don't you just switch to another Bank?
      - b-man 14y ago
        No so easy mate. Brazil has one of the largest bank concentration in the world, orchestraded of course by the central bank. We have the choice of 6 major banks, in this order of size -> Banco do Brasil, Itaú, Bradesco, BNDES, Caixa Econômica Federal, Santander They are all highly regulated and with very little incentive to innovate. So they can screw around and do pretty much nothing at all. The fascist/socialist banking system that exists across the globe is even more pronounced here. For those of you that can read portuguese, I recommend this article: http://www.mises.org.br/Article.aspx?id=1387 http://www.mises.org.br/Article.aspx?id=1387
      - rbanffy 14y ago
        Pretty much every bank in Brazil optimizes for its largest target audience. Since most of their account holders run Windows and Internet Explorer and are able to install a Java runtime, that's what they will go for. I have accounts on three banks that work well with Ubuntu and Firefox. Only one of them mandates a Java runtime to be installed (and only enforces the requirement on Windows and OSX).
josteink 14y ago
Not debating the rest of your post, but not all Norwegian banks rely solely on BankID. Just clarifying that there is no national mandated standard here, just a system which banks can opt in on to use. And then they don't have to opt in fully or exclusively. One example of one who manages to get authentication right, through HTML alone is Skandiabanken. No Java, nonsense or security pains required. They allow you to use BankID too if you like to, but you don't have to. I prefer not to.
- kjetil 14y ago
  Or just use BankID for mobile or the BankID app for iOS, no need for applets.
kmfrk 14y ago
This is why it's great when banks release iOS apps. So much crap you don't have to endure.
- josteink 14y ago
  Why iOS? It's the minority platform? If you are to promote mobile apps, why not go for the big platform, Android?
  - bryne 14y ago
    Fragmentation.
    - kaffiene 14y ago
      Fragmentation? For three fields input? Put down the koolaide and use your brain.
vegardx 14y ago
Java is a never ending story of fun. I had a case where my grandma had issues logging into her online banking account, because the applet threw some sort of error response to her. Turns out that Chrome shipped with a newer version of Java than the banks accepted, and instead of telling her that, they threw an "You're running an old and outdated version of Java, please contact support"-error.
- theatrus2 14y ago
  Chrome doesn't ship with Java, only Flash. Java has that pesky auto-update-Yahoo-toolbar-installer thing.
w1ntermute 14y ago
At least you guys don't have a system that uses ActiveX. That's how it is in South Korea[0], supposedly the world's "most wired" nation. You can only use IE, on Windows, to access online banking services. Things are slowly getting better thanks to the explosion of iPhone/iPad/Mac popularity in Korea (particularly the iPhone), but even now, IE has more than 91% market share in South Korea[1]. 0: http://www.kanai.net/weblog/archive/2007/01/26/00h53m55s http://www.kanai.net/weblog/archive/2007/01/26/00h53m55s 1: http://blog.mozilla.org/gen/2012/05/29/browser-competition-in-korea/ http://blog.mozilla.org/gen/2012/05/29/browser-competition-i...
- justincormack 14y ago
  Indeed. This is a typical South Korean bank website[1]. I despair. [1] http://www.globalibk.com/home.jsp http://www.globalibk.com/home.jsp
  - w1ntermute 14y ago
    Yep, they don't even let you access the site without spoofing your user ID. For example, for that site in Chrome you get: > Microsoft Internet Explorer 사용자만 사용가능합니다. Translation: Only Microsoft Internet Explorer users can use the site.
  - slig 14y ago
    The page won't even show up. if(typeof(navigator.appName)=='undefined' || navigator.userAgent.indexOf("MSIE")<0) { top.wgmain.location.href='about:blank'; alert('Microsoft Internet Explorer 사용자만 사용가능합니다.'); return false; }
    - jff 14y ago
      Wow that Javascript sure is interesting, glad you pasted it three goddamn times!
      - slig 14y ago
        Sorry. HN seemed to have chewed up and I didn't check my threads link to see if it had worked or not.
0x0 14y ago
Why is a (signed, therefore running without a sandbox, nonetheless!) java applet required for three text input form fields?
- samuellb 14y ago
  Because the applet produces a digital signature from a cryptographic key on your hard drive. This is much more secure and scalable than sending the password, see [1] and [2]. An alternative solution would be to use an SSL client certificate[3] or the WebCrypto[4] API (still under development). [1] http://security.stackexchange.com/questions/3605/certificate-based-authentication-vs-username-and-password-authentication http://security.stackexchange.com/questions/3605/certificate... [2] http://en.wikipedia.org/wiki/Public-key_infrastructure http://en.wikipedia.org/wiki/Public-key_infrastructure [3] http://www.mozilla.org/projects/security/pki/psm/help_21/glossary.html#1014561 http://www.mozilla.org/projects/security/pki/psm/help_21/glo... [4] http://www.w3.org/2012/webcrypto/WebCryptoAPI/ http://www.w3.org/2012/webcrypto/WebCryptoAPI/

by hucker 14y ago

rodolphoarruda 14y ago

We have the same scenario in Brazil.

franze 14y ago
well, in brazil you even have gbieh.dll - an undeletable, unkillable, always running, mysterious, "security" file/process from banco do brasil. http://www.file.net/process/gbieh.dll.html http://www.file.net/process/gbieh.dll.html that's even (slightly) worse than a java applet.
- rodolphoarruda 14y ago
  yeah, Banco Itaú has its own DLL too. http://rodolphoarruda.pro.br/d/dll.jpg http://rodolphoarruda.pro.br/d/dll.jpg
  - slig 14y ago
    Can't tell if trolling or not. That's an URL and they can name it with whatever name they want (.dll, 1761,1238,196.htm, .php, etc), and has absolutely nothing to do with an actual process running on your machine.
  - ioquatix 14y ago
    Why don't you just switch to another Bank?
    - b-man 14y ago
      No so easy mate. Brazil has one of the largest bank concentration in the world, orchestraded of course by the central bank. We have the choice of 6 major banks, in this order of size -> Banco do Brasil, Itaú, Bradesco, BNDES, Caixa Econômica Federal, Santander They are all highly regulated and with very little incentive to innovate. So they can screw around and do pretty much nothing at all. The fascist/socialist banking system that exists across the globe is even more pronounced here. For those of you that can read portuguese, I recommend this article: http://www.mises.org.br/Article.aspx?id=1387 http://www.mises.org.br/Article.aspx?id=1387
    - rbanffy 14y ago
      Pretty much every bank in Brazil optimizes for its largest target audience. Since most of their account holders run Windows and Internet Explorer and are able to install a Java runtime, that's what they will go for. I have accounts on three banks that work well with Ubuntu and Firefox. Only one of them mandates a Java runtime to be installed (and only enforces the requirement on Windows and OSX).

josteink 14y ago

Not debating the rest of your post, but not all Norwegian banks rely solely on BankID. Just clarifying that there is no national mandated standard here, just a system which banks can opt in on to use. And then they don't have to opt in fully or exclusively. One example of one who manages to get authentication right, through HTML alone is Skandiabanken. No Java, nonsense or security pains required. They allow you to use BankID too if you like to, but you don't have to. I prefer not to.

kjetil 14y ago
Or just use BankID for mobile or the BankID app for iOS, no need for applets.

kmfrk 14y ago

This is why it's great when banks release iOS apps. So much crap you don't have to endure.

josteink 14y ago
Why iOS? It's the minority platform? If you are to promote mobile apps, why not go for the big platform, Android?
- bryne 14y ago
  Fragmentation.
  - kaffiene 14y ago
    Fragmentation? For three fields input? Put down the koolaide and use your brain.

vegardx 14y ago

Java is a never ending story of fun. I had a case where my grandma had issues logging into her online banking account, because the applet threw some sort of error response to her. Turns out that Chrome shipped with a newer version of Java than the banks accepted, and instead of telling her that, they threw an "You're running an old and outdated version of Java, please contact support"-error.

theatrus2 14y ago
Chrome doesn't ship with Java, only Flash. Java has that pesky auto-update-Yahoo-toolbar-installer thing.

w1ntermute 14y ago

At least you guys don't have a system that uses ActiveX. That's how it is in South Korea[0], supposedly the world's "most wired" nation. You can only use IE, on Windows, to access online banking services. Things are slowly getting better thanks to the explosion of iPhone/iPad/Mac popularity in Korea (particularly the iPhone), but even now, IE has more than 91% market share in South Korea[1]. 0: http://www.kanai.net/weblog/archive/2007/01/26/00h53m55s http://www.kanai.net/weblog/archive/2007/01/26/00h53m55s 1: http://blog.mozilla.org/gen/2012/05/29/browser-competition-in-korea/ http://blog.mozilla.org/gen/2012/05/29/browser-competition-i...

justincormack 14y ago
Indeed. This is a typical South Korean bank website[1]. I despair. [1] http://www.globalibk.com/home.jsp http://www.globalibk.com/home.jsp
- w1ntermute 14y ago
  Yep, they don't even let you access the site without spoofing your user ID. For example, for that site in Chrome you get: > Microsoft Internet Explorer 사용자만 사용가능합니다. Translation: Only Microsoft Internet Explorer users can use the site.
- slig 14y ago
  The page won't even show up. if(typeof(navigator.appName)=='undefined' || navigator.userAgent.indexOf("MSIE")<0) { top.wgmain.location.href='about:blank'; alert('Microsoft Internet Explorer 사용자만 사용가능합니다.'); return false; }
  - jff 14y ago
    Wow that Javascript sure is interesting, glad you pasted it three goddamn times!
    - slig 14y ago
      Sorry. HN seemed to have chewed up and I didn't check my threads link to see if it had worked or not.

0x0 14y ago

Why is a (signed, therefore running without a sandbox, nonetheless!) java applet required for three text input form fields?

samuellb 14y ago
Because the applet produces a digital signature from a cryptographic key on your hard drive. This is much more secure and scalable than sending the password, see [1] and [2]. An alternative solution would be to use an SSL client certificate[3] or the WebCrypto[4] API (still under development). [1] http://security.stackexchange.com/questions/3605/certificate-based-authentication-vs-username-and-password-authentication http://security.stackexchange.com/questions/3605/certificate... [2] http://en.wikipedia.org/wiki/Public-key_infrastructure http://en.wikipedia.org/wiki/Public-key_infrastructure [3] http://www.mozilla.org/projects/security/pki/psm/help_21/glossary.html#1014561 http://www.mozilla.org/projects/security/pki/psm/help_21/glo... [4] http://www.w3.org/2012/webcrypto/WebCryptoAPI/ http://www.w3.org/2012/webcrypto/WebCryptoAPI/