Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Secret API of Banks

gduverger.com

Post reply on HN
Print view View original

151–160 of 257 posts

Re: The Secret API of Banks

#151

Post by ikeboy »

KirinDave wrote: post #150
ikeboy wrote: post #149

Earlier quoted context omitted.

Doubt over 5 people log in to a single bank from most starbucks over a 24 hour period. If it's a big enough bank, the threshold should be higher. But they can easily pull the data and set a threshold that cuts off only the peak of the distribution

You'd certainly better hope so. A national bank going down is national news. You're gonna end up sending some muckety muck out to the press to bob their heads and apologize. They'd don't take kindly to that. My prior investigations suggest that this strategy is ineffective. You suss out a ratelimit then pick a CSP and start spawning instances. Bonus points if it's a CSP that has a contract with that bank, they'll be…

They better be tracking logins or how do they investigate fraud? If they don't have a database of every login tied to an IP, I would assert they're negligent with regard to blocking fraud.

A lot of the measures taken to prevent fraud also block proxies and the like.

Re customer service: they say "here's how you can download your statements in pdf format", or for many banks in quickbooks/excel/etc format as well

I don't know how many of them had mandatory 2FA then, but I think many more have now. It would be far less risky to invalidate cookies on those high-volume IPs and force a new 2FA validation. Then legitimate users could reverify.

Re: The Secret API of Banks

#152

Post by ikeboy »

KirinDave wrote: post #150
ikeboy wrote: post #149

Earlier quoted context omitted.

Doubt over 5 people log in to a single bank from most starbucks over a 24 hour period. If it's a big enough bank, the threshold should be higher. But they can easily pull the data and set a threshold that cuts off only the peak of the distribution

You'd certainly better hope so. A national bank going down is national news. You're gonna end up sending some muckety muck out to the press to bob their heads and apologize. They'd don't take kindly to that. My prior investigations suggest that this strategy is ineffective. You suss out a ratelimit then pick a CSP and start spawning instances. Bonus points if it's a CSP that has a contract with that bank, they'll be…

CSP?

Re: The Secret API of Banks

#154

Post by ikeboy »

KirinDave wrote: post #150
ikeboy wrote: post #149

Earlier quoted context omitted.

Doubt over 5 people log in to a single bank from most starbucks over a 24 hour period. If it's a big enough bank, the threshold should be higher. But they can easily pull the data and set a threshold that cuts off only the peak of the distribution

You'd certainly better hope so. A national bank going down is national news. You're gonna end up sending some muckety muck out to the press to bob their heads and apologize. They'd don't take kindly to that. My prior investigations suggest that this strategy is ineffective. You suss out a ratelimit then pick a CSP and start spawning instances. Bonus points if it's a CSP that has a contract with that bank, they'll be…

My belief is that organizations that can be gamed as easily as you describe have less than 1 fulltime person dedicated to preventing scraping. Or equivalently, 1 fulltime person should be sufficient to make it difficult to scrape at scale.

What do you think of the canary account I suggested?

Re: The Secret API of Banks

#155

Post by KirinDave »

ikeboy wrote: post #151
KirinDave wrote: post #150

Earlier quoted context omitted.

You'd certainly better hope so. A national bank going down is national news. You're gonna end up sending some muckety muck out to the press to bob their heads and apologize. They'd don't take kindly to that. My prior investigations suggest that this strategy is ineffective. You suss out a ratelimit then pick a CSP and start spawning instances. Bonus points if it's a CSP that has a contract with that bank, they'll be…

They better be tracking logins or how do they investigate fraud? If they don't have a database of every login tied to an IP, I would assert they're negligent with regard to blocking fraud. A lot of the measures taken to prevent fraud also block proxies and the like. Re customer service: they say "here's how you can download your statements in pdf format", or for many banks in quickbooks/excel/etc format as well I don…

> They better be tracking logins or how do they investigate fraud? If they don't have a database of every login tied to an IP, I would assert they're negligent with regard to blocking fraud.

Look there are limits to what I'm able to talk about, but consider that a fraud subsystem functioning in transaction-time is running much more slowly than something running in request time.

> A lot of the measures taken to prevent fraud also block proxies and the like.

When was the last time you couldn't use your banking website over a proxy? Only a few mobile apps actually make the decision to do this (mine did) and it's not popular.

> I don't know how many of them had mandatory 2FA then, but I think many more have now.

Which national bank has mandatory 2fa? Not that this would matter. We dealt with 2FA at level via Intuit, that wasn't great at it. Plaid got incredibly good at it. It became pedestrian when we experimented with Plaid.

Re: The Secret API of Banks

#156

Post by KirinDave »

ikeboy wrote: post #154
KirinDave wrote: post #150

Earlier quoted context omitted.

You'd certainly better hope so. A national bank going down is national news. You're gonna end up sending some muckety muck out to the press to bob their heads and apologize. They'd don't take kindly to that. My prior investigations suggest that this strategy is ineffective. You suss out a ratelimit then pick a CSP and start spawning instances. Bonus points if it's a CSP that has a contract with that bank, they'll be…

My belief is that organizations that can be gamed as easily as you describe have less than 1 fulltime person dedicated to preventing scraping. Or equivalently, 1 fulltime person should be sufficient to make it difficult to scrape at scale. What do you think of the canary account I suggested?

> What do you think of the canary account I suggested?

I don't know how such a canary account would ever end up as a target for financial aggregation. It'd probably be a lawsuit from the aggregator for TOS violation if it was a sting operation.

Re: The Secret API of Banks

#157

Post by ikeboy »

KirinDave wrote: post #156
ikeboy wrote: post #154

Earlier quoted context omitted.

My belief is that organizations that can be gamed as easily as you describe have less than 1 fulltime person dedicated to preventing scraping. Or equivalently, 1 fulltime person should be sufficient to make it difficult to scrape at scale. What do you think of the canary account I suggested?

> What do you think of the canary account I suggested? I don't know how such a canary account would ever end up as a target for financial aggregation. It'd probably be a lawsuit from the aggregator for TOS violation if it was a sting operation.

You'd submit it manually.

>lawsuit

You really think an aggregator who's blatantly violating bank TOS is going to sue?

Re: The Secret API of Banks

#158

Post by KirinDave »

ikeboy wrote: post #157
KirinDave wrote: post #156

Earlier quoted context omitted.

> What do you think of the canary account I suggested? I don't know how such a canary account would ever end up as a target for financial aggregation. It'd probably be a lawsuit from the aggregator for TOS violation if it was a sting operation.

You'd submit it manually. >lawsuit You really think an aggregator who's blatantly violating bank TOS is going to sue?

Yes! There's only upside.

Re: The Secret API of Banks

#159

Post by ikeboy »

KirinDave wrote: post #155
ikeboy wrote: post #151

Earlier quoted context omitted.

They better be tracking logins or how do they investigate fraud? If they don't have a database of every login tied to an IP, I would assert they're negligent with regard to blocking fraud. A lot of the measures taken to prevent fraud also block proxies and the like. Re customer service: they say "here's how you can download your statements in pdf format", or for many banks in quickbooks/excel/etc format as well I don…

> They better be tracking logins or how do they investigate fraud? If they don't have a database of every login tied to an IP, I would assert they're negligent with regard to blocking fraud. Look there are limits to what I'm able to talk about, but consider that a fraud subsystem functioning in transaction-time is running much more slowly than something running in request time. > A lot of the measures taken to preven…

>Look there are limits to what I'm able to talk about, but consider that a fraud subsystem functioning in transaction-time is running much more slowly than something running in request time.

I was suggesting checking one day snapshots of access counts by IP to see what the distribution looks like to then determine what to block.

2fa: I know that chase asks me for 2fa every time I change IP, and I don't think there's a way to stop that. Should be easy for them to require 2fa on every login for any IP with a high rate of requests.

Post reply on HN