This is a legit good idea and I don't think there's any reason not to do this. I had a similar idea to instead render the balance amount inside a canvas to make it difficult for a scammer to change it. Could also add event listeners to the canvas so when the canvas element or its nearby/parent elements get removed or changed, the page could automatically logout and show an alert message warning about a possible scam. For accessibility, aria-* tags could still be added and there could be ways to allow copying the balance amount too.
Ask HN: Why don't banks render numbers as PNGs instead of using HTML?
21–26 of 26 posts
Re: Ask HN: Why don't banks render numbers as PNGs instead of using HTML?
#22If you are already dealing with scammers. Well they will find the ways around it and put energy in it.
And for the rest it will just many times annoy them for no gain.
Re: Ask HN: Why don't banks render numbers as PNGs instead of using HTML?
#23I often login to my bank to copy an account number when I need it. I don’t like to rely on typing it correctly. This change would kill that. Sure, I could use OCR on the image, but that isn’t 100% perfect, like a text copy is. They will also likely just come up with a small tweak on the scam if there is a change like this. I’ve watched some of the videos where they pull up a command prompt and run a script where the…
I don't think we need to do it for every number. Account number, for example, could still be HTML. Balance could be converted, though. The harder we make it for scammers, the worse it is for them. I'm not claiming this is fool proof - scammers might be able to generate a png on the fly and inject that as the image like solrdev mentioned in another comment. They would still need to match background colors or possibly…
I don't think this is completely unheard of, FWIW. For a few years, one of the big banks (maybe BofA? can't remember for sure) was actually doing this (rendering text as images) for account numbers, not balances.
Personally I found it quite annoying, both because (philosophically) it's just security theater that doesn't actually protect anything, and (pragmatically), like the other poster said, it made copying & pasting more difficult. It also broke page zoom (I'm old and need to enlarge all the fonts to read). But such a feature did exist.
Re: Ask HN: Why don't banks render numbers as PNGs instead of using HTML?
#24Earlier quoted context omitted.
Wouldn't banks have content security setup?
Maybe? You'd hope, but who knows. Still easy to just replace the image with plain text in the HTML, or a data URL (if allowed). Or put an iframe in there. Point is, if they control the HTML they can do pretty much anything. Edit: Just tried it with Chase, Merrill Lynch, Citibank, Bank of America, and Wells Fargo. Only Wells Fargo had a CSP in place to prevent this. But even Walls Fargo let you just inject a data URL…
Systems that these banks have provided are provided for feasible access to your account.
They are not in any way interested inn tightening of fortgaurding their portal's rendering, until it ends up causing them to give more money i.e. bad for business.
Re: Ask HN: Why don't banks render numbers as PNGs instead of using HTML?
#25My bank used to do this. They also forced you to type things for certain operations using a screen keyboard where key labels were shuffled.
Re: Ask HN: Why don't banks render numbers as PNGs instead of using HTML?
#26I often login to my bank to copy an account number when I need it. I don’t like to rely on typing it correctly. This change would kill that. Sure, I could use OCR on the image, but that isn’t 100% perfect, like a text copy is. They will also likely just come up with a small tweak on the scam if there is a change like this. I’ve watched some of the videos where they pull up a command prompt and run a script where the…
I don't think we need to do it for every number. Account number, for example, could still be HTML. Balance could be converted, though. The harder we make it for scammers, the worse it is for them. I'm not claiming this is fool proof - scammers might be able to generate a png on the fly and inject that as the image like solrdev mentioned in another comment. They would still need to match background colors or possibly…
One sees this argument a lot in security circles, mostly by people with little to no training. This idea that "every little bit helps, so let's toss in some obfuscation ".
Security doesn't work like that. Mostly because (as in this case) the obfuscation is trivial to bypass. I simply replace your set of pngs with my html text.
It's probably worth understanding that professional scammers are not deterred by these trivial speed bumps.
The way to defeat scammers is to train those you know to accept that every one who phones you is a scammer. Every email you get is a scam. Trust nothing. Believe no one. The more they protest the more scammey they are.
And just for kicks, if you make any mistakes, if you do anything without consulting me first, I'm putting you in a home! (I wouldn't, but the point is made.)
Pngs on the bank page or not won't make my mom safe. Rabid terror of being scammed will.