6 ms·
Trackers and bank accounts
- archimedespi 12y agoFun hack, but - yet another stupid large bank/corporation, probably underpaying their devs and not reviewing code ever. Any other ideas on why this happens so often?
- goodcanadian 12y agoPeople who don't know much about programming, let alone computer security, doing the hiring. They can't write an attractive job description. They probably don't offer enough money. And, they probably are unable to identify the good candidates reliably even if they do show up. This is a cost centre for the business, not a revenue centre, so it probably will never get the attention it deserves.
- pyre 12y agoSeems funny though that the goal of "keeping money protected" is something that the banks want to drag their heels about since they might have to pay for it... On the other hand, "you get what you pay for" seems to apply when they are shopping around for the cheapest devs they can find.
- pbhjpbhj 12y agoWouldn't shoring up holes in security ultimately reduce costs though - safes cost money but banks still recognise the benefit of putting them in, and they don't just buy the cheapest one available. I don't think this simplistic "it's a cost centre" gets to the heart of why banks are seemingly so bad at online security.
- _delirium 12y agoIf Finland is anything like Denmark, not enough money is probably not the issue. Bank IT is a pretty well-paid job here, near the top of the scale for programmers. But nonetheless has a reputation for being poorly run and just somewhat boring, with a workplace dominated by "suits". In fact you might have to actually wear a suit to work yourself. So it attracts people who want a stable job with no overtime and a large paycheck, and are willing to put up with high management overhead and banking-sector culture.
- Kalium 12y agoOn top of the issues goodcanadian describes, people often either don't talk to or don't listen to infosec professionals. Not long ago, I saw a job posting for an infosec person who "Knows how to solve problems without saying no". Security is hard. Hard enough that a lot of people prefer to ignore it.
- mpeg 12y agoI'm not sure if censoring "google" out of the tag is even worth it, considering how recognizable that url is :)
- deleted 12y ago[deleted]
- baldeagle 12y agoWould it have worked if it just provided a sessionID to each request that could be matched on the backend to account number and such for their analytics?
- sfeng 12y agoThey could also have used a real encryption method like AES.
- chias 12y agoNot useful for tracking unless used in ECB mode, and if they're encrypting anything larger than 120 bits (AES block size) then AES in ECB mode would itself leak information about the encrypted information. The real thing to do if they wanted pseudonymous values (none of this is anonymous in any way) is either just associate a fresh random value with every account, or if you don't want to have to store any additional information, HMAC the account number with a reasonably long secret key.
- rudolf0 12y agoIt's sad to see so many applications use SHA1/SHA256 when they really need to be using HMAC-SHA1/HMAC-SHA256.
- cm2187 12y agoWhy would they care that someone tempers with the analytics if it is meant to be anonymous
- baldeagle 12y agoI assume they want the pseudonymous values, since they probably want to do analytics on the backend. Thanks for the reply about HMAC. I've got some new learning to look into tonight. :)
- malingo 12y ago> HMAC the account number with a reasonably long secret key By "reasonably long" you mean "of the correct length"? That is to say, equal to the block size of the underlying hash (e.g. 64 bytes for HMAC-SHA256). Any longer that that does not increase strength. Shorter keys will be zero-padded out to the block size and are therefore weaker.
- revelation 12y agoThis "just SHA1 it" approach to data anonymization is getting really old. Previous: http://dataabinitio.com/?p=442 http://dataabinitio.com/?p=442
- vortico 12y agoThey thought they ended the debate with that Twitter post, but they were merely joining it... on the wrong side!
- fapjacks 12y agoWindytan is one of the coolest hackers I've ever met.
- pearjuice 12y agoIf you actually met her, it's probably not the perceived coolness but rather sexual attraction for the opposite sex. Because so few females are actually hackers and your interests are a very close match to hers, that "coolness" is perceived and she becomes more interesting because she offers what you would call a more valuable match. You might meet a technically more skilled hacker but yet she would have the advantage for being of the opposite sex.
- deleted 12y ago[deleted]
- rjzzleep 12y agoi came to say the same thing. her ccc talks are actually worth watching, was really fun to watch her play around with radio. https://media.ccc.de/browse/congress/2013/30C3_-_5588_-_en_-_saal_g_-_201312281600_-_my_journey_into_fm-rds_-_oona_raisanen.html#video https://media.ccc.de/browse/congress/2013/30C3_-_5588_-_en_-...
- twowordbird 12y agoThis is great fun. Very accessible.
- cushychicken 12y agoI agree; Oona is a modern genius when it comes to signal processing.
- lucb1e 12y agoYour username is strangely creepy in this context.
- Joona 12y agoInterestingly, the same bank rolled out a new website last year, with no notification of it being updated to the customers. Just found myself staring at an unknown site one day.
- carlob 12y agoPlease note that an IBAN is not enough to set up direct debit. So giving out users' bank accounts it's not as bad as it would be using ACH.
- contingencies 12y agoIn a bad case the IBAN may tell you the branch they are at and roughly when they opened their account. Direct debit is a US thing, mostly.
- mattmanser 12y agoYou're talking nonsense: http://en.wikipedia.org/wiki/Direct_debit http://en.wikipedia.org/wiki/Direct_debit Even scanning that page there's a lot of major economies that work on DDs.
- contingencies 12y agoI was discussing usage, not theoretical existence for some subset of cases. Direct debit is rare in Australia/New Zealand (most people prefer to perform transactions themselves on a one-off basis), I've never seen it in Asia in 15 years, and according to my US bank the American implementation is often fundamentally broken and based on some kind of print-and-mail-a-check system, though widely used.
- daurnimator 12y ago> Direct debit is rare in Australia/New Zealand (most people prefer to perform transactions themselves on a one-off basis) I disagree; I used to work in an ISP billing department and about 50% of our customers used direct debit. Then ~25% on credit card; and 25% via BPay.
- contingencies 12y agoFair enough. Out of interest, used to = how many years ago? I'd wager it's waning. (Rationale: need for strong country-specific presence to justify increased integration cost vs. credit card only, consumer gets zero points/benefits)
- lifeisstillgood 12y agoI am reminded of Scheiner's adage that we live in an age of data pollution, like Victorian smogs and it takes real pea-soupers like this to make us think there might be better ways. I mean - that is dumb by anyone's standards.
- late2part 12y agoThis is probably actionable. As in lawsuit. But, that's probably too American of me to bring up. Regardless, this really sucks. Thank you for pointing it out and bringing attention to it.
- lifeisstillgood 12y agoWeirdly, IBAN numbers do not have an agreed international standard beyond the country code and checksum. I guess Finish IBANs are slightly more amenable to brute forcing than UK - but only by 26 digits. http://en.m.wikipedia.org/wiki/International_Bank_Account_Number http://en.m.wikipedia.org/wiki/International_Bank_Account_Nu...
- luchs 12y agoThis makes the switch to IBAN very simple - it's just the country code, a checksum and whatever numbers were in use before the switch. Local businesses can still ask for the old numbers and then transform them to IBAN.
- snowwrestler 12y agoNote that it is against the Google Analytics terms of service to record personally identifying data. So even if someone wanted to do this, reporting it to Google would get their GA account suspended.
- drakenot 12y ago"In the case of the taxi data, one way to improve on the hashing would be to substitute a random number for each license ID, then hash the random numbers. Not only does this make the hashed values harder to re-identify (because the input has no consistent format), but even if the data are re-identified, the random values are not personally identifiable." What is the point of re-hashing the random numbers? Once you have replaced the actual values with random numbers I don't know what you get from then hashing those.
- CamperBob2 12y agoAwesome. In the US, just discovering that script would probably get you a visit from Federal marshals, much less reverse-engineering the hash to discover your own account number.
- grkvlt 12y agoI don't think so. This isn't like the AT&T case involving manipulation of a URLs query paramaters to discover other users details. This is just analysis of data describing the current user (you) that your browser is already sending to a remote site. No manipulation of the traffic takes place. As I understand it, there is (can be) no law against using view-source: or the browser debug tools to see what other URLs are accessed when a page loads.
- attilak 12y agoPeople want the banks to have better and more usable netbanking pages. Improving the UX without tracking the users behaviour is pretty hard. If some lawyers then say that SHA1 is enough, it is enough, the people implementing it might not even be involved in that discussion. The real problem I see here is that the tracking data is forwarded to Google servers outside of the EU. This might be against EU laws.