Earlier quoted context omitted.
Quite the opposite: the free market will deal with this just fine, giving a big penalty to companies that don't care enough. The government, on the other hand, imposes bad businesses, enables regulatory capture and has proven many times that it has no idea how to handle infosec. These white hat consultants aren't perfect but through competition they're still better than lobbied lawmakers.
Do you think that the free market worked as desired in the case of Equifax?
Postbank to replace 12M bank cards after employees steal 'master key'
51–60 of 194 posts
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#52Earlier quoted context omitted.
And not the first government run entity in SA to have funds stolen from it. Transnet/PRASA (railways) Eskom (electricity) SAA (airline) All have had just totally monumental theft often at the top levels. It all seems to be pretty consequence free. Meanwhile, the hawks open immediate investigations and charge people almost immediately who are trying to expose things - which is kind of funny - 10 years to investigate t…
South Africa has insane levels of graft and corruption that have been going on for decades. They also have a lot of politically motivated assassinations. Total basket case of a country.
It was really the Zuma years that messed things up and the new folks don't seem interested in any cleanup (the ANC has had a lock on power a long time). They are still a great country relatively speaking in Africa, with incredible potential.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#53That proves my point again that there are not enough regulations on electronic security standards that applies to private companies. All you have are white hat security consultant experts that only have their dollars and reputation to work with. The public is highly vulnerable on those things yet I don't see politicians really caring.
Quite the opposite: the free market will deal with this just fine, giving a big penalty to companies that don't care enough. The government, on the other hand, imposes bad businesses, enables regulatory capture and has proven many times that it has no idea how to handle infosec. These white hat consultants aren't perfect but through competition they're still better than lobbied lawmakers.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#54>The breach resulted from the printing of the bank's encrypted master key in plain, unencrypted digital language at the Postbank's old data centre in the Pretoria city centre I can't read anymore. Is there anymore technical explanation? Was it actually 'printed' ... on paper? Was it even an actual encryption key or just a password or something?
People seem to forget why credit cards came into existence. It was not for security. Ever. Credit Cards were introduced as a less-secure-but-more-convenient-check. The store then would have a stock of "blank checks" with absolutely no security features where they would imprint with carbon paper and a pressure roll the credit card information and pretty much "mint" the client a check on the spot. Over time the raised…
Yeah, no. Diners Club was the first credit card and was released in the 1950's to aggregate and streamline paying for things on account. It was, as the name suggests a line of credit. Checking accounts could become credit accounts if they allow overdrafts but this is not the normal intent.
It was not until First National of Seattle released a debit card (also now known as a check card) in 1978 that any of those plastic cards behaved as a check.
It's an important distinction because in one case (credit) the money transferred first is the bank's. This has important implications on who holds the liability and how long investigstions take into fraud allegations.
Chip security was added first overseas because online authorization was less ubiquitous. The US was able to have online terminals pretty much everywhere since the 1980's and knucklebusters became a rare sight in the 1990's. The chip security now is less to prevent card-present fraud in the US, more to prevent reauthorizations of stored CC information (see, target breach). With a chip or NFC the card generates a unique signature for every transaction so there's nothing a POS system could store to reauthorize future transactions.
This is why in the US for credit cards a pin is mostly unheard of and we are finally moving away from signatures which have been obsolete since the time offline batching mostly went away.
Edit: Consider 1980's America was under the monopoly of AT&T. This greatly influenced the design of payment card networks. Europe, for example, probably had probably over 100 different companies in dozens of countries, so universal online authorization was less feasible.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#55Earlier quoted context omitted.
And not the first government run entity in SA to have funds stolen from it. Transnet/PRASA (railways) Eskom (electricity) SAA (airline) All have had just totally monumental theft often at the top levels. It all seems to be pretty consequence free. Meanwhile, the hawks open immediate investigations and charge people almost immediately who are trying to expose things - which is kind of funny - 10 years to investigate t…
South Africa has insane levels of graft and corruption that have been going on for decades. They also have a lot of politically motivated assassinations. Total basket case of a country.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#56Earlier quoted context omitted.
Quite the opposite: the free market will deal with this just fine, giving a big penalty to companies that don't care enough. The government, on the other hand, imposes bad businesses, enables regulatory capture and has proven many times that it has no idea how to handle infosec. These white hat consultants aren't perfect but through competition they're still better than lobbied lawmakers.
Do you think that the free market worked as desired in the case of Equifax?
Government intervention rarely happens proactively, just as major market changes rarely happen proactively. Supplier failure on a large scale makes it apparent that change is necessary, and only then do changes follow, either from the top down by government intervention, or from the bottom up by the market.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#57Re: Postbank to replace 12M bank cards after employees steal 'master key'
#58Earlier quoted context omitted.
People seem to forget why credit cards came into existence. It was not for security. Ever. Credit Cards were introduced as a less-secure-but-more-convenient-check. The store then would have a stock of "blank checks" with absolutely no security features where they would imprint with carbon paper and a pressure roll the credit card information and pretty much "mint" the client a check on the spot. Over time the raised…
The few places is everywhere in the EU at least. Signing card transactions is very last century in more advanced nations. ;) Edit: also the pin is verified each Transaction unlike with receipt signatures, which as you say were rarely checked by anyone.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#59>The breach resulted from the printing of the bank's encrypted master key in plain, unencrypted digital language at the Postbank's old data centre in the Pretoria city centre I can't read anymore. Is there anymore technical explanation? Was it actually 'printed' ... on paper? Was it even an actual encryption key or just a password or something?
Probably a backup. It makes sense to have an offline backup in cleartext (for DR), as long as you have the appropriate storage and security controls in place to protect it.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#60Earlier quoted context omitted.
Probably a backup. It makes sense to have an offline backup in cleartext (for DR), as long as you have the appropriate storage and security controls in place to protect it.
It makes absolutely no sense. Such highly valuable secrets are usually saved using Shamir's secret sharing with parts of the split secret held by people unlikely to collude. Key ceremonies are done in a way that at no point a human being is in position to single-handedly extract the secret from its HSM. This is a huge failure.
So just exporting the private key so easily without some pretty involved hight-tech HSM key extraction sounds insane.