4 ms·

Okay, now I'm wondering about something. A point that Bruce has harped on for years is that the law often creates the wrong incentives for security policies. I

Okay, now I'm wondering about something. A point that Bruce has harped on for years is that the law often creates the wrong incentives for security policies. In particular, in the U.S., the downside of what we call "identity theft" often falls squarely on the consumer, while the security policies for the banking industry are designed by banks. Thus the policy makers may not have to live with the downsides of their own policies. I'm guessing that the incentives created by the law for banking security are rather different in Singapore -- maybe not ideal, but certainly different. Can you (or anyone else) comment knowledgeably on this?

ghshephard 11y ago
Government regulation. The MAS (Monetary Authority of Singapore) basically decreed that all financial institutions follow a standard set of (really, really good) guidelines for Internet Banking. Two-Factor authentication and Transaction-Signing by External Token are just a couple of the 182 requirements. http://www.mas.gov.sg/~/media/MAS/Regulations%20and%20Financial%20Stability/Regulatory%20and%20Supervisory%20Framework/Risk%20Management/IBTRM%20Checklist.pdf http://www.mas.gov.sg/~/media/MAS/Regulations%20and%20Financ... For example, check out: Appendix A - "COUNTERING MAN-IN-THE-MIDDLE ATTACKS " It has specific guidance such as "Digital signatures and key-based message authentication codes (KMAC) for payment or fund transfer transactions could be used for the detection of unauthorised modification or injection of transaction data in a middleman attack. For this security solution to work effectively, a customer using a hardware token would need to be able to distinguish the process of generating a one-time password from the process of digitally signing a transaction. What he signs digitally must also be meaningful to him. This means the token should at least explicitly show the payee account number and the payment amount from which a hash value may be derived for the purpose of creating a digital signature. Different crypto keys should be used for generating OTPs and for signing transactions. " The United States (at least the Banks I dealt with) are way behind where Singapore is in terms of Security.

ghshephard 11y ago

Government regulation. The MAS (Monetary Authority of Singapore) basically decreed that all financial institutions follow a standard set of (really, really good) guidelines for Internet Banking. Two-Factor authentication and Transaction-Signing by External Token are just a couple of the 182 requirements. http://www.mas.gov.sg/~/media/MAS/Regulations%20and%20Financial%20Stability/Regulatory%20and%20Supervisory%20Framework/Risk%20Management/IBTRM%20Checklist.pdf http://www.mas.gov.sg/~/media/MAS/Regulations%20and%20Financ... For example, check out: Appendix A - "COUNTERING MAN-IN-THE-MIDDLE ATTACKS " It has specific guidance such as "Digital signatures and key-based message authentication codes (KMAC) for payment or fund transfer transactions could be used for the detection of unauthorised modification or injection of transaction data in a middleman attack. For this security solution to work effectively, a customer using a hardware token would need to be able to distinguish the process of generating a one-time password from the process of digitally signing a transaction. What he signs digitally must also be meaningful to him. This means the token should at least explicitly show the payee account number and the payment amount from which a hash value may be derived for the purpose of creating a digital signature. Different crypto keys should be used for generating OTPs and for signing transactions. " The United States (at least the Banks I dealt with) are way behind where Singapore is in terms of Security.