Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 67 posts

Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#1

Post by fanseed »

I was watching the network logs as I logged into my credit union and saw that they attempt to request favicons from lots of third parties including dropbox, accounts.google.com, stackoverflow.com, squareup.com, instagram.com, skype.com, tumblr.com, expedia.de, pinterest.com, de.foursquare.com, eu.battle.net, store.steampowered.com, reddit.com.

The favicons are usually loaded from the login page of the service, so I'm guessing they are doing that old trick to see if the browser is logged into those services by requesting the favicon.

I emailed them about this and after two months all they said is that it's part of their security software checks and not from anything suspicious.

Do they do this to create a 'social media fingerprint' of me as an additional check? Even though a few of the services are the German versions (credit union is in the US) and a few have fixed this so that it doesn't work anymore. It just seems strange and excessive.

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#2

Post by iamNumber4 »

I would suggest the following when connecting to this site.

1. use a dedicated browser, and only use that browser for this site.

2. utilize private mode if you don't want to dedicate a browser only for this site

3. use different profiles in your normal daily browser. for example firefox, and chrome allows you to have multiple profiles. Create a new profile to use when going to this site.

4. analyze the javascript and see if it is coming from a 3rd party/CDN url. if so download the javascript files, modifiy it to just return a success state, etc..., deploy it to your own server running apache or nginx. clone the URL structure on that server. then edit your hosts file to cause your computer to point that host in the url to your own server, serving up your modified version of the .js files.

5. least level of effort: Get a different credit union.

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#4

Post by soared »

I'm sure you already know the answer, but the more data they can collect on you the better. If they are technically capable of building out a full profile on you, they can use it to recommend products, make credit decisions, etc.

Favicons is only the tip of the iceberg - download ghostery and see what 3rd party scripts are running. Like a ton, including some from oracle that connect you to all their data in their device graph. So even if you used a brand new phone and logged into your account, all your previous history would be tied to your new phone and vice versa.

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#5

Post by soared »

iamNumber4 wrote: post #2

I would suggest the following when connecting to this site. 1. use a dedicated browser, and only use that browser for this site. 2. utilize private mode if you don't want to dedicate a browser only for this site 3. use different profiles in your normal daily browser. for example firefox, and chrome allows you to have multiple profiles. Create a new profile to use when going to this site. 4. analyze the javascript and…

Without blacklisting a bunch of 3rd party scripts using a different browser or even device would be useless. Once you log in to your account, this new browser/device is automatically linked to all your old browsers/devices, so there is no difference.

From 2015: https://adexchanger.com/data-driven-thinking/when-evaluating...

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#6

Post by blakes »

soared wrote: post #5
iamNumber4 wrote: post #2

I would suggest the following when connecting to this site. 1. use a dedicated browser, and only use that browser for this site. 2. utilize private mode if you don't want to dedicate a browser only for this site 3. use different profiles in your normal daily browser. for example firefox, and chrome allows you to have multiple profiles. Create a new profile to use when going to this site. 4. analyze the javascript and…

Without blacklisting a bunch of 3rd party scripts using a different browser or even device would be useless. Once you log in to your account, this new browser/device is automatically linked to all your old browsers/devices, so there is no difference. From 2015: https://adexchanger.com/data-driven-thinking/when-evaluating...

Qubes OS pretty much solves this problem!

https://www.qubes-os.org/

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#7

Post by bwl »

kristoff_it wrote: post #3

Use Firefox Containers and live happy. https://testpilot.firefox.com/experiments/containers/

Great advice, and Containers has actually graduated from experiments to a full release.

https://addons.mozilla.org/en-US/firefox/addon/multi-account...

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#8

Post by endymi0n »

blakes wrote: post #6
soared wrote: post #5

Earlier quoted context omitted.

Without blacklisting a bunch of 3rd party scripts using a different browser or even device would be useless. Once you log in to your account, this new browser/device is automatically linked to all your old browsers/devices, so there is no difference. From 2015: https://adexchanger.com/data-driven-thinking/when-evaluating...

Qubes OS pretty much solves this problem! https://www.qubes-os.org/

...or "how to immediately get flagged as a paranoid weirdo nerd and die without credit FOREVER ALONE"

A little like the paradox that by using more secure browsers and configurations, any browser fingerprinting algorithm will single you out reliably from all the other sheep.

Re: Ask HN: Why does my credit union check if I'm logged into Steam and Reddit?

#9

Post by swanson »

A few maybe-not-so-nefarious options I can think of:

a) some kind of third-party OAuth sign in library that may not be properly configured? Is it possible to log in the website using some kind of single-sign in?

b) requesting favicons to use as a visual icon when displaying/categorizing transactions?

c) some external user tracking package that could be used for analytics or support?

Post reply on HN