Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your Mother’s Maiden Name Is Not a Secret

nytimes.com

Post reply on HN
Print view View original

231–240 of 274 posts

Re: Your Mother’s Maiden Name Is Not a Secret

#231

Post by djsumdog »

Larrikin wrote: post #222
djsumdog wrote: post #145

Earlier quoted context omitted.

Most other countries allow direct person-to-person transfers with just a name and account number. In Australia you can put in someone's details and payment for something and it will be there the next morning, with no fees, directly through the government interbank system. In the US if you want a fee-free transfer, you need to use your bank's app and take a photo of someone's check. And no, Paypal/Vinmo are not good a…

This is a little outdated. Most banks finally got Zelle setup this year. It hasn't fully caught on but you can get free transfers between nearly all big banks and a lot of small banks simply by setting it up and knowing the persons email or phone number. I've been trying to get my friends to move off Venmo, but the option to do it is usually buried inside of the banking apps so it isn't as convenient.

It's still not quite the same. In Germany, Australia and NZ, you can send money to anyone at any bank, for free, and you don't need to use their phone number or e-mail address. It's mandated by the government.

It'd be more like the Federal Reserve enforcing free customer-to-customer ACH for everyone. There are some banks that do offer free person-to-person ACH (I believe 5/3 is one of them).

Zelle is basically the banks getting together and going around that critical lack of infrastructure. It does look like they have a lot of major and minor banks. Mine is still missing from the list though, and I suspect it will be years until everyone is supported or banks will feel they need to support it to enter the market. So no, the US is still way behind.

Re: Your Mother’s Maiden Name Is Not a Secret

#232

Post by HoyaSaxa »

zkms wrote: post #7
Aardwolf wrote: post #4

Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…

> maybe a slow cobol mainframe somewhere Inter-bank money transfers in US are handled by a system that needs multiple "business days" for a transaction to be finalised so you're on the money here: https://engineering.gusto.com/how-ach-works-a-developer-pers...

The US ACH system does rely upon COBOL mainframe systems which only support batch processing. But that constraint does not cause the multi-day process. In fact, since September 2017, the US ACH system has supported same-day ACH processing (with a slightly higher fee of 5.2 cents).

The main constraint has been more related to operations. There are thousands of people whose sole job is to process ACH files. They mostly work at bankers' banks and corporate credit unions (credit unions' banks). But also at financial institutions that range from under $1mm in assets to over $100bn. Most of these jobs could be fully automated away, but they haven't been yet for a variety of reasons.

Re: Your Mother’s Maiden Name Is Not a Secret

#233

Post by u801e »

sethammons wrote: post #224
u801e wrote: post #105

Earlier quoted context omitted.

It may sound difficult at first, but with plenty of help (step-by-step tutorials, etc.) provided by the bank, then it shouldn't be too hard to implement. It could be started as a trial for a certain subset of customers and then rolled out to larger and larger groups as time goes on. Banks could provide an incentive by stating that using this is much more secure than just using a password, and that it's also largely a…

In school, did you ever do the "give instructions to make a peanut butter and jelly sandwich" activity? I'm guessing not. I'm willing to bet you could have a video with transcript and pictures of the user's exact home set up and many people still couldn't figure it out. You are dealing with people who still don't understand why you don't have to double click links since they have to double click apps and don't know t…

> I'm willing to bet you could have a video with transcript and pictures of the user's exact home set up and many people still couldn't figure it out.

I think you're giving most people less credit than they deserve in terms of figuring things out. Yes, there are people who are technically illiterate, but they probably still conduct most of their business in a manner similar to the pre-commercial internet days. That is, they either use the bank teller drive-through lanes, ATM, or go inside the bank to do banking business. They may not even try logging into their online account.

But that doesn't mean that the bank shouldn't provide options for the more technically literate users who either already understand the concepts or can pick it up with some step-by-step instructions.

I certainly don't like banks providing half-baked security solutions like easily guessable "security" questions or passwords that can only be up to some relatively short length and highly restricted character-set which can be brute-forced or easily obtained from a plain-text dump of their compromised database.

Re: Your Mother’s Maiden Name Is Not a Secret

#234

Post by hocuspocus »

Amezarak wrote: post #225
hocuspocus wrote: post #216

Earlier quoted context omitted.

Modern banks really don't. In Germany you truly have no use for cheques anymore. SEPA works both ways (wire transfers and direct debit from your account are free for you and very cheap for business accounts). While for instance in France, Orange launched their own bank recently, they're 100% mobile, yet you can request a checkbook (for free, afaik they cannot legally charge you).

It's free to send money to other bank accounts in the US, too, and in some cases instantaneous, in no case I know of longer than a couple days. The problem isn't that the infrastructure isn't there - it is. Older people and a few stodgy institutions rely on checks, but that's not because they have to. In Germany, what do people without bank accounts do? In the US, there's a lot of these people, but you (or their empl…

While I imagine it can exist among the homeless, I have never heard of anyone without a bank account in Europe. The EU even introduced a right to a basic bank account.[1]

If you have an employer, I don't see how you could not have a bank account. Even retired/unemployed, you will need one to receive any kind of pension, benefits or social welfare.

I know that old habits die hard, and France is a good example (cheques could be easily phased out). But governments are able to kill them off when needed. For instance many European countries are lowering legal limits regarding cash transactions, in an effort to curb all kinds of tax avoidance.

[1] https://europa.eu/youreurope/citizens/consumers/financial-pr...

Re: Your Mother’s Maiden Name Is Not a Secret

#235

Post by pluma »

Amezarak wrote: post #225
hocuspocus wrote: post #216

Earlier quoted context omitted.

Modern banks really don't. In Germany you truly have no use for cheques anymore. SEPA works both ways (wire transfers and direct debit from your account are free for you and very cheap for business accounts). While for instance in France, Orange launched their own bank recently, they're 100% mobile, yet you can request a checkbook (for free, afaik they cannot legally charge you).

It's free to send money to other bank accounts in the US, too, and in some cases instantaneous, in no case I know of longer than a couple days. The problem isn't that the infrastructure isn't there - it is. Older people and a few stodgy institutions rely on checks, but that's not because they have to. In Germany, what do people without bank accounts do? In the US, there's a lot of these people, but you (or their empl…

In Germany you just have a bank account. You can get one for free if you have a sufficient monthly income or are a student under a certain age. You can also get one fairly cheap otherwise.

I'd say more people have a bank account than an Internet connection. OTOH credit cards are relatively rare.

Re: Your Mother’s Maiden Name Is Not a Secret

#236

Post by Amezarak »

pluma wrote: post #235
Amezarak wrote: post #225

Earlier quoted context omitted.

It's free to send money to other bank accounts in the US, too, and in some cases instantaneous, in no case I know of longer than a couple days. The problem isn't that the infrastructure isn't there - it is. Older people and a few stodgy institutions rely on checks, but that's not because they have to. In Germany, what do people without bank accounts do? In the US, there's a lot of these people, but you (or their empl…

In Germany you just have a bank account. You can get one for free if you have a sufficient monthly income or are a student under a certain age. You can also get one fairly cheap otherwise. I'd say more people have a bank account than an Internet connection. OTOH credit cards are relatively rare.

Bank accounts are free here too (or at least most of them are), but for various reasons some people choose not to get them.

https://en.wikipedia.org/wiki/Unbanked

Re: Your Mother’s Maiden Name Is Not a Secret

#237

Post by Amezarak »

hocuspocus wrote: post #234
Amezarak wrote: post #225

Earlier quoted context omitted.

It's free to send money to other bank accounts in the US, too, and in some cases instantaneous, in no case I know of longer than a couple days. The problem isn't that the infrastructure isn't there - it is. Older people and a few stodgy institutions rely on checks, but that's not because they have to. In Germany, what do people without bank accounts do? In the US, there's a lot of these people, but you (or their empl…

While I imagine it can exist among the homeless, I have never heard of anyone without a bank account in Europe. The EU even introduced a right to a basic bank account.[1] If you have an employer, I don't see how you could not have a bank account. Even retired/unemployed, you will need one to receive any kind of pension, benefits or social welfare. I know that old habits die hard, and France is a good example (cheques…

In the US, if you don't have a bank account, the government will just send you a debit card that they will load a balance on for your benefits/welfare. For example, here's a description of the Social Security debit card program.

https://www.ssa.gov/pubs/EN-05-10073.pdf

Most of these people do have access to a bank account - most of them are free - if they wanted one, but they choose not to get one for various reasons.

I think in terms of American politics, there would be some resistance in requiring people to have a bank account.

Re: Your Mother’s Maiden Name Is Not a Secret

#238

Post by HoyaSaxa »

Aardwolf wrote: post #4

Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…

There are three main reasons: (1) a huge long tail of financial institutions and (2) an incredibly strong enforcement and justice system, and (3) a lack of new financial institutions.

The United States has around 40x more financial institutions than the United Kingdom (8x when adjusting for population differences). The US has such a long tail of financial institutions because of regulatory and market forces. The US regulators/lawmakers have traditionally provided incentives for smaller financial institutions because of the belief that they fill a very important role in powering our diverse economic engine (a belief I hold as well). This has made change harder to impose and coordinate.

Most United States payment schemes are inherently insecure. Both checks and ACHs simply require the routing number, account number, and name on the account. There is no concept of a one-time use token. So why is the US not plagued with fraud? Our enforcement and justice systems are perhaps the strongest in the world. The secret service and FBI devote an incredible amount of resources to investigating financial fraud, and punishments are typically harsh.

Finally, the lack of new bank charters granted by the regulators (especially post 2008) has reduced competition and innovation in the space. Banks are able to levy high fees as a result. The amount lost to fraud each year is generally more than covered by these fees (with the exception of small financial institutions) so there is not a strong incentive for change.

Re: Your Mother’s Maiden Name Is Not a Secret

#239

Post by sethammons »

u801e wrote: post #233
sethammons wrote: post #224

Earlier quoted context omitted.

In school, did you ever do the "give instructions to make a peanut butter and jelly sandwich" activity? I'm guessing not. I'm willing to bet you could have a video with transcript and pictures of the user's exact home set up and many people still couldn't figure it out. You are dealing with people who still don't understand why you don't have to double click links since they have to double click apps and don't know t…

> I'm willing to bet you could have a video with transcript and pictures of the user's exact home set up and many people still couldn't figure it out. I think you're giving most people less credit than they deserve in terms of figuring things out. Yes, there are people who are technically illiterate, but they probably still conduct most of their business in a manner similar to the pre-commercial internet days. That i…

:) "most" vs "many."

I don't think most users would have a terrible time. I think most users would not bother with setting up anything fancy, but could if they had ok instructions. But I think there are many who would absolutely flounder. As a technical person, I would like more security for sure.

"Security" questions should be gone. Everything important should be 2FA or have a key fob. I think just about everyone who has a phone and does online banking can understand "input the code we just texted you."

Re: Your Mother’s Maiden Name Is Not a Secret

#240

Post by grzm »

Kiro wrote: post #185
grzm wrote: post #140

Earlier quoted context omitted.

The password manager is typically on a machine you control. If your machine is owned, you've got issues regardless. A password manager provides a way to effectively utilize higher-entropy, per-account passwords. As with all security-related matters, it's a tradeoff. I expect many choose password managers for this reason.

Pretty sure the typical password manager user does not control the machine.

In terms of physical control of the machine? In terms of what software is loaded on the machine? Would you elaborate on what you mean "typical password manager user" and "does not control"?
Post reply on HN