Live data from Hacker News

Postbank to replace 12M bank cards after employees steal 'master key'

timeslive.co.za

51–60 of 194 posts

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#51
post #41

Earlier quoted context omitted.

Quite the opposite: the free market will deal with this just fine, giving a big penalty to companies that don't care enough. The government, on the other hand, imposes bad businesses, enables regulatory capture and has proven many times that it has no idea how to handle infosec. These white hat consultants aren't perfect but through competition they're still better than lobbied lawmakers.

Do you think that the free market worked as desired in the case of Equifax?

Do you think we actually have a free market?

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#52
post #42

Earlier quoted context omitted.

And not the first government run entity in SA to have funds stolen from it. Transnet/PRASA (railways) Eskom (electricity) SAA (airline) All have had just totally monumental theft often at the top levels. It all seems to be pretty consequence free. Meanwhile, the hawks open immediate investigations and charge people almost immediately who are trying to expose things - which is kind of funny - 10 years to investigate t…

South Africa has insane levels of graft and corruption that have been going on for decades. They also have a lot of politically motivated assassinations. Total basket case of a country.

Not really a total basket case. They had a long and fantastic history actually of institution building, including credible tax services etc.

It was really the Zuma years that messed things up and the new folks don't seem interested in any cleanup (the ANC has had a lock on power a long time). They are still a great country relatively speaking in Africa, with incredible potential.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#53
post #41
post #16

That proves my point again that there are not enough regulations on electronic security standards that applies to private companies. All you have are white hat security consultant experts that only have their dollars and reputation to work with. The public is highly vulnerable on those things yet I don't see politicians really caring.

Quite the opposite: the free market will deal with this just fine, giving a big penalty to companies that don't care enough. The government, on the other hand, imposes bad businesses, enables regulatory capture and has proven many times that it has no idea how to handle infosec. These white hat consultants aren't perfect but through competition they're still better than lobbied lawmakers.

[deleted]

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#54
post #17
post #5

>The breach resulted from the printing of the bank's encrypted master key in plain, unencrypted digital language at the Postbank's old data centre in the Pretoria city centre I can't read anymore. Is there anymore technical explanation? Was it actually 'printed' ... on paper? Was it even an actual encryption key or just a password or something?

People seem to forget why credit cards came into existence. It was not for security. Ever. Credit Cards were introduced as a less-secure-but-more-convenient-check. The store then would have a stock of "blank checks" with absolutely no security features where they would imprint with carbon paper and a pressure roll the credit card information and pretty much "mint" the client a check on the spot. Over time the raised…

>Credit Cards were introduced as a less-secure-but-more-convenient-check.

Yeah, no. Diners Club was the first credit card and was released in the 1950's to aggregate and streamline paying for things on account. It was, as the name suggests a line of credit. Checking accounts could become credit accounts if they allow overdrafts but this is not the normal intent.

It was not until First National of Seattle released a debit card (also now known as a check card) in 1978 that any of those plastic cards behaved as a check.

It's an important distinction because in one case (credit) the money transferred first is the bank's. This has important implications on who holds the liability and how long investigstions take into fraud allegations.

Chip security was added first overseas because online authorization was less ubiquitous. The US was able to have online terminals pretty much everywhere since the 1980's and knucklebusters became a rare sight in the 1990's. The chip security now is less to prevent card-present fraud in the US, more to prevent reauthorizations of stored CC information (see, target breach). With a chip or NFC the card generates a unique signature for every transaction so there's nothing a POS system could store to reauthorize future transactions.

This is why in the US for credit cards a pin is mostly unheard of and we are finally moving away from signatures which have been obsolete since the time offline batching mostly went away.

Edit: Consider 1980's America was under the monopoly of AT&T. This greatly influenced the design of payment card networks. Europe, for example, probably had probably over 100 different companies in dozens of countries, so universal online authorization was less feasible.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#55
post #42

Earlier quoted context omitted.

And not the first government run entity in SA to have funds stolen from it. Transnet/PRASA (railways) Eskom (electricity) SAA (airline) All have had just totally monumental theft often at the top levels. It all seems to be pretty consequence free. Meanwhile, the hawks open immediate investigations and charge people almost immediately who are trying to expose things - which is kind of funny - 10 years to investigate t…

South Africa has insane levels of graft and corruption that have been going on for decades. They also have a lot of politically motivated assassinations. Total basket case of a country.

As a US expat living in Joburg, I agree that there is a lot of corruption in SA. But damn if 2020 hasn't shown a spotlight on the shady business in the US as well.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#56
post #41

Earlier quoted context omitted.

Quite the opposite: the free market will deal with this just fine, giving a big penalty to companies that don't care enough. The government, on the other hand, imposes bad businesses, enables regulatory capture and has proven many times that it has no idea how to handle infosec. These white hat consultants aren't perfect but through competition they're still better than lobbied lawmakers.

Do you think that the free market worked as desired in the case of Equifax?

The idea is not that the free market will always produce perfect results and perfect goods. The idea is that the free market will produce better results at a faster pace with less unintended consequences than government intervention.

Government intervention rarely happens proactively, just as major market changes rarely happen proactively. Supplier failure on a large scale makes it apparent that change is necessary, and only then do changes follow, either from the top down by government intervention, or from the bottom up by the market.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#58
post #17

Earlier quoted context omitted.

People seem to forget why credit cards came into existence. It was not for security. Ever. Credit Cards were introduced as a less-secure-but-more-convenient-check. The store then would have a stock of "blank checks" with absolutely no security features where they would imprint with carbon paper and a pressure roll the credit card information and pretty much "mint" the client a check on the spot. Over time the raised…

The few places is everywhere in the EU at least. Signing card transactions is very last century in more advanced nations. ;) Edit: also the pin is verified each Transaction unlike with receipt signatures, which as you say were rarely checked by anyone.

Also, nearly everywhere in Canada, the interac system really has it together up here.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#59
post #5

>The breach resulted from the printing of the bank's encrypted master key in plain, unencrypted digital language at the Postbank's old data centre in the Pretoria city centre I can't read anymore. Is there anymore technical explanation? Was it actually 'printed' ... on paper? Was it even an actual encryption key or just a password or something?

Probably a backup. It makes sense to have an offline backup in cleartext (for DR), as long as you have the appropriate storage and security controls in place to protect it.

HSM's properly implemented do not result in clearext backups of these highly important keys. You can do backups without that.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#60
post #47

Earlier quoted context omitted.

Probably a backup. It makes sense to have an offline backup in cleartext (for DR), as long as you have the appropriate storage and security controls in place to protect it.

It makes absolutely no sense. Such highly valuable secrets are usually saved using Shamir's secret sharing with parts of the split secret held by people unlikely to collude. Key ceremonies are done in a way that at no point a human being is in position to single-handedly extract the secret from its HSM. This is a huge failure.

What surprises me is that you can extract the private key at all - I would expect it to be firmly inside a HSM, that only accepts signing requests and the key never leaves the module & the HSM wipes the key if it detects tampering (there is usually a battery inside to power the tampering detection even if the device is not plugged in).

So just exporting the private key so easily without some pretty involved hight-tech HSM key extraction sounds insane.

Post reply on HN