4 ms·

Did we expect more? there's one hell of a difference between a large financial organisation or an exchange and some half arsed startup who hacked up a web site

by bananas 13y ago

Did we expect more? there's one hell of a difference between a large financial organisation or an exchange and some half arsed startup who hacked up a web site in PHP that just happens to handle something that represents a currency. The former at least probably has a QA team, knows industry regulations and best practices and designs their architecture properly. Oh and they have cumulative experience and a designated location you can visit with burning torches and pitchforks when they steal your money. I'm ignoring regulation as I've worked in the compliance industry and it's entirely about working around it. Not joking and I'm sure that this is going to stand on a few toes but some of the stuff I've seen on HN is verging on criminal. So many immature poorly thought out and damn right dangerous products being thrown out. Lots of people are sitting on ticking bombs like this.

kiba 13y ago
And yet you still see banking security that insists on alphanumeric password only and no 2FA. Seriously, that's screwed up. That being said, banks have insurance and all that jazz. So even though the state of security is not that great, it seems that you are less likely to get screwed incase of a screwup.
- bananas 13y ago
  Not seen that in Europe for a long time. In fact all four UK bank accounts I have use two-factor auth.
  - vertex-four 13y ago
    My UK bank account (Bank of Scotland) does not have two-factor auth, and there's no stated plans to implement it, as far as I can tell.
    - bananas 13y ago
      My RBS and Natwest accounts both have CAP devices: http://en.wikipedia.org/wiki/Chip_Authentication_Program http://en.wikipedia.org/wiki/Chip_Authentication_Program Edit: apparently I don't need them any more. HSBC does still require it though.
    - arethuza 13y ago
      They used to offer 2 factor authentication to some personal account holders but they have removed that and it only appears to be available for business accounts: https://www.bankofscotland.co.uk/online/portal/ https://www.bankofscotland.co.uk/online/portal/
      - bananas 13y ago
        That's news to me - not that I've logged into my accounts for a few months! :)
dtf 13y ago
Large financial organisations can be surprisingly criminal and incompetent when it comes to IT - you don't have to look far. Knight Capital, NatWest, HSBC... just a few names that pop into my head. The big guys spend large amounts of time and money convincing regulators and the public that they're clean and clever. It's public confidence that counts.
- bananas 13y ago
  They're pretty fine to be honest. They have mitigation and FCA oversight which means you're not in the shit as a customer (usually). Knight capital was a cock up in a high risk trading env. They paid for that. HSBC was money laundering which is basically the entire purpose of a bank. NatWest was a process cock up. However no money went "oops we lost it" and was never seen again. At most, even with HSBC consumer withdrawal limits it's a minor inconvenience for a couple of days. Much like mobile phone networks, people expect 100% uptime but that's unrealistic in practice. Always keep £200 rolled up in your mattress.
  - CaptainZapp 13y ago
    HSBC was money laundering which is basically the entire purpose of a bank. This is a very strong statement. Do you mind backing it up, or is this just meant as a glib throwaway quip?
    - bananas 13y ago
      I suppose that was a throwaway quip directed at HSBC who seems to have managed to get away with laundering on a large scale with some slapped wrists.
    - andrewaylett 13y ago
      I'm not the OP, but I think I can see what he means, and I think he means it in a non-pejorative way too. One of the functions of banks is indeed to hide the source and destination of your money. My grocer doesn't get to know who employs me; my employer doesn't see where I spend my money. Yes, you can achieve that with cash, without directly involving a bank. But the money is still issued by a bank. I'm not saying that it's impossible to achieve this level of information hiding without banks, but I can see where the GP is coming from in his argument.

by bananas 13y ago

kiba 13y ago

And yet you still see banking security that insists on alphanumeric password only and no 2FA. Seriously, that's screwed up. That being said, banks have insurance and all that jazz. So even though the state of security is not that great, it seems that you are less likely to get screwed incase of a screwup.

bananas 13y ago
Not seen that in Europe for a long time. In fact all four UK bank accounts I have use two-factor auth.
- vertex-four 13y ago
  My UK bank account (Bank of Scotland) does not have two-factor auth, and there's no stated plans to implement it, as far as I can tell.
  - bananas 13y ago
    My RBS and Natwest accounts both have CAP devices: http://en.wikipedia.org/wiki/Chip_Authentication_Program http://en.wikipedia.org/wiki/Chip_Authentication_Program Edit: apparently I don't need them any more. HSBC does still require it though.
  - arethuza 13y ago
    They used to offer 2 factor authentication to some personal account holders but they have removed that and it only appears to be available for business accounts: https://www.bankofscotland.co.uk/online/portal/ https://www.bankofscotland.co.uk/online/portal/
    - bananas 13y ago
      That's news to me - not that I've logged into my accounts for a few months! :)

dtf 13y ago

Large financial organisations can be surprisingly criminal and incompetent when it comes to IT - you don't have to look far. Knight Capital, NatWest, HSBC... just a few names that pop into my head. The big guys spend large amounts of time and money convincing regulators and the public that they're clean and clever. It's public confidence that counts.

bananas 13y ago
They're pretty fine to be honest. They have mitigation and FCA oversight which means you're not in the shit as a customer (usually). Knight capital was a cock up in a high risk trading env. They paid for that. HSBC was money laundering which is basically the entire purpose of a bank. NatWest was a process cock up. However no money went "oops we lost it" and was never seen again. At most, even with HSBC consumer withdrawal limits it's a minor inconvenience for a couple of days. Much like mobile phone networks, people expect 100% uptime but that's unrealistic in practice. Always keep £200 rolled up in your mattress.
- CaptainZapp 13y ago
  HSBC was money laundering which is basically the entire purpose of a bank. This is a very strong statement. Do you mind backing it up, or is this just meant as a glib throwaway quip?
  - bananas 13y ago
    I suppose that was a throwaway quip directed at HSBC who seems to have managed to get away with laundering on a large scale with some slapped wrists.
  - andrewaylett 13y ago
    I'm not the OP, but I think I can see what he means, and I think he means it in a non-pejorative way too. One of the functions of banks is indeed to hide the source and destination of your money. My grocer doesn't get to know who employs me; my employer doesn't see where I spend my money. Yes, you can achieve that with cash, without directly involving a bank. But the money is still issued by a bank. I'm not saying that it's impossible to achieve this level of information hiding without banks, but I can see where the GP is coming from in his argument.