3 ms·

I've been coming to an opinion on these issues that may be unpopular with the tech crowd: The big banks have the right idea when it comes to security, and we ar

by ufmace 12y ago

I've been coming to an opinion on these issues that may be unpopular with the tech crowd: The big banks have the right idea when it comes to security, and we are misguided at best with our obsession over the minutia of password handling. Why? All of these big banks and investment houses have holdings in the neighborhood of billions of dollars. Like billions in actual cash. If they are so vulnerable and insecure, why aren't all of the hackers targeting them, with their potential upside of billions of dollars in cash, and instead target little web apps to steal some credit card numbers or user data, worth tens of thousands to maybe a few million on black markets? Think about how much effort we've seen put towards stealing cool Twitter handles and other such trivial things. Does anybody really believe that there aren't many more people working much harder to hack banks, with their billion dollar paydays? They may not be the greatest on password handling, but the evidence suggests that they have a much more healthy security culture overall than your average internet startup. Apparently, they are worlds better at making their systems secure enough that nobody can steal these user databases in the first place. They most likely also have a pile of fraud detection and validation on account activity, especially anything involving moving significant amounts of money out of the accounts. They are probably in the right on this - what's the point in building a perfect lock for the front door if, once an attacker gets in, they can transfer the whole balance to a Russian bank and nobody will notice? Consider how, with some well-publicized recent hacks, you can apparently do anything at all once you get through that front door at most major tech companies. I'll happily change my tune if any of these banks get hacked and lose big money. Until then, maybe we should ask these banks how they get it so right overall instead of worrying and hassling them about how long their passwords are and how they're storing them.

briholt 12y ago
JP Morgan got hit pretty hard. https://news.ycombinator.com/item?id=8403459 https://news.ycombinator.com/item?id=8403459
- ufmace 12y ago
  Hmm, looking at that, I'd say it more proves my point. At the top of their Wikipedia entry[0], it says that JPMorgan Chase has roughly 2.5 TRILLION in assets. According to this[1] site, 1.29 TRILLION in customer deposits. Hackers believed to be from Russia breached some of their systems and stole... drumroll please... customer names, addresses, phone numbers, and email addresses. There's stuff in there of value comparable to national economies, a mind-boggling amount of money, and they didn't get a penny of it. All they got was a glorified phone book. Apple can't seem to protect their Apple IDs or iCloud data from determined attackers. Amazon and GoDaddy have given over total control of user's accounts to pretty simple social engineering attacks, both giving the attackers the keys to the castle. None of these attackers seem to have much in the way of funding or organization, and the stolen data doesn't seem to monetize terribly well. Do you think these companies would be able to keep trillions of dollars of their customers' money safe from attackers? Chase seems to be able to. Maybe the tech companies should take a few lessons from them. [0] http://www.wikiwand.com/en/JPMorgan_Chase#/Financial_data http://www.wikiwand.com/en/JPMorgan_Chase#/Financial_data [1] http://www.marketwatch.com/investing/stock/jpm/financials/balance-sheet http://www.marketwatch.com/investing/stock/jpm/financials/ba...
superuser2 12y ago
A substantial volume of low-level fraud occurs every day and is baked into the cost of doing business because that costs less than reengineering fundamentally insecure systems. A system where you can pull money by knowing a set of "secret" numbers shared with every entity an account holder has ever done business with is just insane to begin with. We rely on reading transactions after the fact looking for red flags. You can beat the filters sometimes by running millions of credit cards. You can't really expect to move $100 billion from an investment bank to your checking account without anyone noticing and using their central authority to reverse the transaction.
- ufmace 12y ago
  There's some truth to all that, but I'd say it's kind of another point. We don't have and never really did have a logically secure finance system. We have a human-secured finance system instead, where for virtually every transaction, there is a human somewhere who has the power to review and reverse it. It seems clumsy to the programmer's mind, but it largely works pretty well. I don't think we even have a really solid idea what a logically secure financial system would look like, how to build it, or if it's practical. Bitcoin seems to be the closest and most practical thing we have so far to that. While Bitcoin is cool and interesting in a lot of ways, the practical security of it leaves much to be desired, based on the observed results so far.
cdolan 12y ago
Excuse the short answer, with family for the evening. In short I think that the reason you see hackers target web startups and credit cards is because you can get away with it. Example - it's easy to use a credit card, buy something online, and have it shipped to a big office or apartment. And to steal from a bank account? You'd need another bank account! Bank accounts require you to put up your own personal info, which is a huge barrier for Off shore hackers to overcome
brianpgordon 12y ago
Did you finish the article? At the end the author claims that their two-factor authentication can be defeated by appending extra characters to your password. In other words, they have no two-factor authentication. This isn't a matter of differing points of view, this is objectively awful. With computer security, you have to obsess over the minutia because a single vulnerability is all it takes to defeat the system.
- ufmace 12y ago
  I did, and that is a pretty epic screwup. But in the end, it seems that the cost of them screwing that up, aside from maybe a few techies cancelling their accounts, is zero. I'd say that more than obsessing over the minutia, you have to obsess over the entirety of the system as used in practice, of which the authentication system is only a small part. I don't know finance that well so I'm kinda spitballing here, but stuff like exactly how the system that approves transactions actually communicates with the systems authorized to actually move money, what types of transactions are allowed and to where, what kind of checking is done against various transaction types, how to correlate to the user's activity history. If user normally connects from Atlanta and uses an online billpay system to send checks to a handful of companies, be very suspicious and probably flag and review the transaction if somebody suddenly logs in from a different address and requests a wire transaction to a foreign bank, etc. The evidence (lack of constant ripoffs) suggests that they are quite good indeed at obsessing over the minutia of the rest of the system. This allows them to get away with authentication practices that are, depending on your point of view, somewhere between actively awful and bending over well past backwards to make things simpler and less error-prone for unsophisticated users. Got any idea how many users with 7-figure or more account balances still want to login on their flip-phones, bank online with IE6 on WinXP, use their account even after they epically screw up their password or their TFA key, etc? Neither do I, but I bet it's a lot higher than any of us would like.
- jeremyt 12y ago
  Author here. To be fair, the bug only prevents you from activating 2fa. If you manage to activate it, it seems to work fine.

by ufmace 12y ago

briholt 12y ago

JP Morgan got hit pretty hard. https://news.ycombinator.com/item?id=8403459 https://news.ycombinator.com/item?id=8403459

ufmace 12y ago
Hmm, looking at that, I'd say it more proves my point. At the top of their Wikipedia entry[0], it says that JPMorgan Chase has roughly 2.5 TRILLION in assets. According to this[1] site, 1.29 TRILLION in customer deposits. Hackers believed to be from Russia breached some of their systems and stole... drumroll please... customer names, addresses, phone numbers, and email addresses. There's stuff in there of value comparable to national economies, a mind-boggling amount of money, and they didn't get a penny of it. All they got was a glorified phone book. Apple can't seem to protect their Apple IDs or iCloud data from determined attackers. Amazon and GoDaddy have given over total control of user's accounts to pretty simple social engineering attacks, both giving the attackers the keys to the castle. None of these attackers seem to have much in the way of funding or organization, and the stolen data doesn't seem to monetize terribly well. Do you think these companies would be able to keep trillions of dollars of their customers' money safe from attackers? Chase seems to be able to. Maybe the tech companies should take a few lessons from them. [0] http://www.wikiwand.com/en/JPMorgan_Chase#/Financial_data http://www.wikiwand.com/en/JPMorgan_Chase#/Financial_data [1] http://www.marketwatch.com/investing/stock/jpm/financials/balance-sheet http://www.marketwatch.com/investing/stock/jpm/financials/ba...

superuser2 12y ago

A substantial volume of low-level fraud occurs every day and is baked into the cost of doing business because that costs less than reengineering fundamentally insecure systems. A system where you can pull money by knowing a set of "secret" numbers shared with every entity an account holder has ever done business with is just insane to begin with. We rely on reading transactions after the fact looking for red flags. You can beat the filters sometimes by running millions of credit cards. You can't really expect to move $100 billion from an investment bank to your checking account without anyone noticing and using their central authority to reverse the transaction.

ufmace 12y ago
There's some truth to all that, but I'd say it's kind of another point. We don't have and never really did have a logically secure finance system. We have a human-secured finance system instead, where for virtually every transaction, there is a human somewhere who has the power to review and reverse it. It seems clumsy to the programmer's mind, but it largely works pretty well. I don't think we even have a really solid idea what a logically secure financial system would look like, how to build it, or if it's practical. Bitcoin seems to be the closest and most practical thing we have so far to that. While Bitcoin is cool and interesting in a lot of ways, the practical security of it leaves much to be desired, based on the observed results so far.

cdolan 12y ago

Excuse the short answer, with family for the evening. In short I think that the reason you see hackers target web startups and credit cards is because you can get away with it. Example - it's easy to use a credit card, buy something online, and have it shipped to a big office or apartment. And to steal from a bank account? You'd need another bank account! Bank accounts require you to put up your own personal info, which is a huge barrier for Off shore hackers to overcome

brianpgordon 12y ago

Did you finish the article? At the end the author claims that their two-factor authentication can be defeated by appending extra characters to your password. In other words, they have no two-factor authentication. This isn't a matter of differing points of view, this is objectively awful. With computer security, you have to obsess over the minutia because a single vulnerability is all it takes to defeat the system.

ufmace 12y ago
I did, and that is a pretty epic screwup. But in the end, it seems that the cost of them screwing that up, aside from maybe a few techies cancelling their accounts, is zero. I'd say that more than obsessing over the minutia, you have to obsess over the entirety of the system as used in practice, of which the authentication system is only a small part. I don't know finance that well so I'm kinda spitballing here, but stuff like exactly how the system that approves transactions actually communicates with the systems authorized to actually move money, what types of transactions are allowed and to where, what kind of checking is done against various transaction types, how to correlate to the user's activity history. If user normally connects from Atlanta and uses an online billpay system to send checks to a handful of companies, be very suspicious and probably flag and review the transaction if somebody suddenly logs in from a different address and requests a wire transaction to a foreign bank, etc. The evidence (lack of constant ripoffs) suggests that they are quite good indeed at obsessing over the minutia of the rest of the system. This allows them to get away with authentication practices that are, depending on your point of view, somewhere between actively awful and bending over well past backwards to make things simpler and less error-prone for unsophisticated users. Got any idea how many users with 7-figure or more account balances still want to login on their flip-phones, bank online with IE6 on WinXP, use their account even after they epically screw up their password or their TFA key, etc? Neither do I, but I bet it's a lot higher than any of us would like.
jeremyt 12y ago
Author here. To be fair, the bug only prevents you from activating 2fa. If you manage to activate it, it seems to work fine.