4 ms·

The article fails to recognize the value of the "security images" to the banks. The banks have used these images to satisfy the requirements of the FFIEC guidan

by dfc 14y ago

The article fails to recognize the value of the "security images" to the banks. The banks have used these images to satisfy the requirements of the FFIEC guidance "Authentication in an Internet Banking Environment"[1]. Any complaints about the value of the security images should not be addressed to banks. You should direct your complaints to the FFIEC and/or to your banks regulator (OTS, OCC or NCUA). [1] http://www.ffiec.gov/pdf/Auth-ITS-Final%206-22-11%20%28FFIEC%20Formated%29.pdf http://www.ffiec.gov/pdf/Auth-ITS-Final%206-22-11%20%28FFIEC...

latimer 14y ago
Interesting, I've always wondered why so many banks use this system online instead of something more robust like two-step auth.
- dfc 14y ago
  The only reason the banks use these systems to begin with is the FFIEC guidance. These "improvements" were not voluntarily put in place by forward thinking bankers, they had to because their regulators told them to. So it is all about the cost of the system. Before anyone says Chase/HSBC makes X billion dollars profit keep in mind that these regulations also apply to smaller community banks with 5 Billion in holdings. Keep this in mind when you assess any of these systems; the authentication systems are not put in place to manage customer risk, they are put into place to manage regulatory risk.
- mortehu 14y ago
  When I signed up for USAA, by default they had a silly authentication system based on "security questions". I was very disappointed until I found out that they support several mechanisms, and allow you to disable the ones you won't use. Hence, I use the one where I combine my password with a token generated by a mobile app. Maybe other banks have alternate authentication mechanisms stashed away as well?
  - snowwrestler 14y ago
    They do. Bank of America, which to my knowledge is the largest bank that still uses the "security image", also allows users to enable 2-factor authentication via SMS.
    - yourapostasy 14y ago
      Not just via SMS, but you can also purchase a token card called a SafePass.
- svachalek 14y ago
  I've only seen two step used to validate the user to the server. Are there sites that use two step to verify the server to the client?
gojomo 14y ago
Are they the people to blame for the 15-minute bank login timeouts everywhere, too? Because I can't think of a more frustrating and anti-security policy that claims to be "for your security". (By requiring many more repeated logins, the risk rises that I'll slip one time and not carefully check that the DNS/SSL info is correct.)
- Firehed 14y ago
  It's a trade off between that and allowing some random stranger to transfer your money if you get up and forget to lock your computer. Our first alpha didn't have the auto-logout and by far the most common piece of feedback we got was that we needed it.
  - nikcub 14y ago
    It isn't just if you step away from a computer. A session token that never expires is as good as a password, but with weaker protection. If I intercept a session token via a proxy, network dump, XSS or browser bug I can use it and replay it at any time in the form it was intercepted. Passwords get sent once and are usually protected and encrypted or hashed on the server. Session tokens are not, hence why they need to be temporary.
    - gojomo 14y ago
      Holding everything else constant, shorter session tokens reduce one avenue of exploitation, yes. But everything else isn't constant: shorter sessions mean more password-typing-transactions, and especially into older tabs that have a "logout successful for your protection" message. That increases the risk of a successful phish, including by the same vulnerabilities you fear could compromise a session token. And practically, the problem with a password compromise is that it gives access to a indefinite stream of new session tokens. So there's a balance between session-token-risks and login-transaction-risks. I doubt 15 minutes is the optimal tradeoff time -- I'm sure it isn't for me, with my habits on my own computers, and I haven't seen any rigorous evidence it's the right level for the banking masses. Its maddening uniformity across the industry "smells like" an arbitrary check-box from some regulatory document somewhere.
nwh 14y ago
Great, they're probably responsible for this too. Every time you try and use a new tab or navigation (back, forward, refresh) on my banks website, you get kicked out to the main page. It's like someone has never heard of form keys. http://i.imgur.com/erm0faA.png http://i.imgur.com/erm0faA.png
Firehed 14y ago
I skimmed the PDF and didn't see what you're referring to; however, I did see it explicitly point out the ineffectiveness of "security" questions.
- dfc 14y ago
  This all started with the first supplement the FFIEC put out regarding authentication in an internet environment in 2005[1]. This initial supplement was put out to clarify what was expected of banks especially with regards to the FFIEC examination handbooks regarding e-banking[2] and information security[3]. (This all began with 12CFR30B[4][5]) Are you familiar with reading federal regulator-ese? They do not ever come out and make blanket statements such as use XYZ, ensure X bit keys and so on. The entire process is based on the banks and the examiner's interpretation of the bank's risk profile. If you are interested in learning more about this reading some of the banking industry press coverage at the time may be easier to digest. [1] http://www.ffiec.gov/bsa_aml_infobase/documents/new_5_2007/OCC/BL_2005_35.pdf http://www.ffiec.gov/bsa_aml_infobase/documents/new_5_2007/O... [2] http://ithandbook.ffiec.gov/it-booklets/e-banking.aspx http://ithandbook.ffiec.gov/it-booklets/e-banking.aspx [3] http://ithandbook.ffiec.gov/it-booklets/information-security.aspx http://ithandbook.ffiec.gov/it-booklets/information-security... [4] http://ithandbook.ffiec.gov/media/21989/occ-12cfr30-safe_sound_standards.pdf http://ithandbook.ffiec.gov/media/21989/occ-12cfr30-safe_sou... [5] I say 12cfr30b because that is what got the ball rolling for OCC regulated banks and at the time I worked for an OCC regulated bank. Depending on who the regulator (OTS, NCUA, etc) is the "ball rolling document" will be different.
ryen 14y ago
Not a lot of information regarding security images in there and not all banks use them. BofA does, but not Chase. Therefore I have to assume its some lame compliance committee within the bank determining usage.
- dfc 14y ago
  You are safe assuming that risk managment at banks is not implemented uniformly across the industry. Were you expecting it to say "security images are required"?

by dfc 14y ago

latimer 14y ago

Interesting, I've always wondered why so many banks use this system online instead of something more robust like two-step auth.

dfc 14y ago
The only reason the banks use these systems to begin with is the FFIEC guidance. These "improvements" were not voluntarily put in place by forward thinking bankers, they had to because their regulators told them to. So it is all about the cost of the system. Before anyone says Chase/HSBC makes X billion dollars profit keep in mind that these regulations also apply to smaller community banks with 5 Billion in holdings. Keep this in mind when you assess any of these systems; the authentication systems are not put in place to manage customer risk, they are put into place to manage regulatory risk.
mortehu 14y ago
When I signed up for USAA, by default they had a silly authentication system based on "security questions". I was very disappointed until I found out that they support several mechanisms, and allow you to disable the ones you won't use. Hence, I use the one where I combine my password with a token generated by a mobile app. Maybe other banks have alternate authentication mechanisms stashed away as well?
- snowwrestler 14y ago
  They do. Bank of America, which to my knowledge is the largest bank that still uses the "security image", also allows users to enable 2-factor authentication via SMS.
  - yourapostasy 14y ago
    Not just via SMS, but you can also purchase a token card called a SafePass.
svachalek 14y ago
I've only seen two step used to validate the user to the server. Are there sites that use two step to verify the server to the client?

gojomo 14y ago

Are they the people to blame for the 15-minute bank login timeouts everywhere, too? Because I can't think of a more frustrating and anti-security policy that claims to be "for your security". (By requiring many more repeated logins, the risk rises that I'll slip one time and not carefully check that the DNS/SSL info is correct.)

Firehed 14y ago
It's a trade off between that and allowing some random stranger to transfer your money if you get up and forget to lock your computer. Our first alpha didn't have the auto-logout and by far the most common piece of feedback we got was that we needed it.
- nikcub 14y ago
  It isn't just if you step away from a computer. A session token that never expires is as good as a password, but with weaker protection. If I intercept a session token via a proxy, network dump, XSS or browser bug I can use it and replay it at any time in the form it was intercepted. Passwords get sent once and are usually protected and encrypted or hashed on the server. Session tokens are not, hence why they need to be temporary.
  - gojomo 14y ago
    Holding everything else constant, shorter session tokens reduce one avenue of exploitation, yes. But everything else isn't constant: shorter sessions mean more password-typing-transactions, and especially into older tabs that have a "logout successful for your protection" message. That increases the risk of a successful phish, including by the same vulnerabilities you fear could compromise a session token. And practically, the problem with a password compromise is that it gives access to a indefinite stream of new session tokens. So there's a balance between session-token-risks and login-transaction-risks. I doubt 15 minutes is the optimal tradeoff time -- I'm sure it isn't for me, with my habits on my own computers, and I haven't seen any rigorous evidence it's the right level for the banking masses. Its maddening uniformity across the industry "smells like" an arbitrary check-box from some regulatory document somewhere.

nwh 14y ago

Great, they're probably responsible for this too. Every time you try and use a new tab or navigation (back, forward, refresh) on my banks website, you get kicked out to the main page. It's like someone has never heard of form keys. http://i.imgur.com/erm0faA.png http://i.imgur.com/erm0faA.png

Firehed 14y ago

I skimmed the PDF and didn't see what you're referring to; however, I did see it explicitly point out the ineffectiveness of "security" questions.

dfc 14y ago
This all started with the first supplement the FFIEC put out regarding authentication in an internet environment in 2005[1]. This initial supplement was put out to clarify what was expected of banks especially with regards to the FFIEC examination handbooks regarding e-banking[2] and information security[3]. (This all began with 12CFR30B[4][5]) Are you familiar with reading federal regulator-ese? They do not ever come out and make blanket statements such as use XYZ, ensure X bit keys and so on. The entire process is based on the banks and the examiner's interpretation of the bank's risk profile. If you are interested in learning more about this reading some of the banking industry press coverage at the time may be easier to digest. [1] http://www.ffiec.gov/bsa_aml_infobase/documents/new_5_2007/OCC/BL_2005_35.pdf http://www.ffiec.gov/bsa_aml_infobase/documents/new_5_2007/O... [2] http://ithandbook.ffiec.gov/it-booklets/e-banking.aspx http://ithandbook.ffiec.gov/it-booklets/e-banking.aspx [3] http://ithandbook.ffiec.gov/it-booklets/information-security.aspx http://ithandbook.ffiec.gov/it-booklets/information-security... [4] http://ithandbook.ffiec.gov/media/21989/occ-12cfr30-safe_sound_standards.pdf http://ithandbook.ffiec.gov/media/21989/occ-12cfr30-safe_sou... [5] I say 12cfr30b because that is what got the ball rolling for OCC regulated banks and at the time I worked for an OCC regulated bank. Depending on who the regulator (OTS, NCUA, etc) is the "ball rolling document" will be different.

ryen 14y ago

Not a lot of information regarding security images in there and not all banks use them. BofA does, but not Chase. Therefore I have to assume its some lame compliance committee within the bank determining usage.

dfc 14y ago
You are safe assuming that risk managment at banks is not implemented uniformly across the industry. Were you expecting it to say "security images are required"?