*main key
If they used main key this wouldn't be a problem
Postbank to replace 12M bank cards after employees steal 'master key'
71–80 of 194 posts
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#72Earlier quoted context omitted.
So why not limit the magstripe to gas pumps and give them a time frame of 5-10 years to upgrade existing pumps, and mandate chip capable card readers in new pumps? At the same time fees could be raised 2% for non-chip transactions to incentivize upgrades.
Looks like they have deadline of 10/2020 before visa and mastercard start holding owners liable for fraud if they haven't upgraded to chip readers. https://www.latimes.com/business/technology/story/2020-01-07...
That's stupid. Just issue cards without stripe and the problem will solve itself.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#73That proves my point again that there are not enough regulations on electronic security standards that applies to private companies. All you have are white hat security consultant experts that only have their dollars and reputation to work with. The public is highly vulnerable on those things yet I don't see politicians really caring.
Quite the opposite: the free market will deal with this just fine, giving a big penalty to companies that don't care enough. The government, on the other hand, imposes bad businesses, enables regulatory capture and has proven many times that it has no idea how to handle infosec. These white hat consultants aren't perfect but through competition they're still better than lobbied lawmakers.
Free markets do not capture all externalities.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#74Earlier quoted context omitted.
And not the first government run entity in SA to have funds stolen from it. Transnet/PRASA (railways) Eskom (electricity) SAA (airline) All have had just totally monumental theft often at the top levels. It all seems to be pretty consequence free. Meanwhile, the hawks open immediate investigations and charge people almost immediately who are trying to expose things - which is kind of funny - 10 years to investigate t…
South Africa has insane levels of graft and corruption that have been going on for decades. They also have a lot of politically motivated assassinations. Total basket case of a country.
1. Most of the graft and corruption has been going on at least 7 decades. i.e. Long before the ANC government.
2. "politically motivated assasinations"? Citation wanted, please.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#75Ah hah hah haha! And our (USA) law enforcement agencies promise us that any encryption master keys required by their grandiose plans will only be used in cases with proper legal court warrants (ignore the FISA court warrant abuse based on lies and deceit) and will be super secure and never stolen. Just like those secret hacking tools stolen from the CIA. Or these private master keys.
Don't forget the TSA travel master keys, which can now be 3-D printed by anyone using this repo: https://github.com/Xyl2k/TSA-Travel-Sentry-master-keys
Those things were useless anyway, based on my experience. The one time I used them, TSA neglected to even try opening the lock carefully and simply broke the zipper getting into my luggage.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#76Earlier quoted context omitted.
Probably a backup. It makes sense to have an offline backup in cleartext (for DR), as long as you have the appropriate storage and security controls in place to protect it.
It makes absolutely no sense. Such highly valuable secrets are usually saved using Shamir's secret sharing with parts of the split secret held by people unlikely to collude. Key ceremonies are done in a way that at no point a human being is in position to single-handedly extract the secret from its HSM. This is a huge failure.
Interesting.. What Open source tools do you use for this? I would love to read further how I can not have a printed copy of a master key in a safety deposit box.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#77Earlier quoted context omitted.
I've worked at more than one location where the Cameras in customer areas were conspicuous but the cameras in the employee area were hidden.
> but the cameras in the employee area were hidden. Is this legal? Sounds like a lawsuit waiting to happen.
In the UK at least, if you believe that crimes are occurring (e.g. stock discrepancies suggest employees are stealing) you can get permission from your local police to use hidden cameras.
With that prior police authorisation it's legal to record more or less anywhere without those recorded knowing.
The police knowing you were authorised means when Sandra finds a camera in the employee locker room and freaks out, the cops who attend can verify that yes, Sandra's manager's boss got that OK'd two weeks ago when six £700 graphics cards "vanished" versus no this is some camera planted by an unknown creep and if the cops figure out who it was they'll be arrested.
If the "unknown creep" turns out to be the boss, the existence of this authorisation mechanism means they have no excuse - if they'd asked "Hey, can I secretly film my employees to get evidence of theft?" the answer would be "First, go to a police station to get guidance" not "Sure, act exactly like a pervert and just hide a camera".
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#78Re: Postbank to replace 12M bank cards after employees steal 'master key'
#79Ah hah hah haha! And our (USA) law enforcement agencies promise us that any encryption master keys required by their grandiose plans will only be used in cases with proper legal court warrants (ignore the FISA court warrant abuse based on lies and deceit) and will be super secure and never stolen. Just like those secret hacking tools stolen from the CIA. Or these private master keys.
Don't forget the TSA travel master keys, which can now be 3-D printed by anyone using this repo: https://github.com/Xyl2k/TSA-Travel-Sentry-master-keys
You can use a ball point pen to pop open the zipper on any luggage.
I understand that the illusion of control is very helpful for nervous passengers, but your luggage is leaving your control and it's mostly nylon fabric and plastic.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#80Earlier quoted context omitted.
It makes absolutely no sense. Such highly valuable secrets are usually saved using Shamir's secret sharing with parts of the split secret held by people unlikely to collude. Key ceremonies are done in a way that at no point a human being is in position to single-handedly extract the secret from its HSM. This is a huge failure.
What surprises me is that you can extract the private key at all - I would expect it to be firmly inside a HSM, that only accepts signing requests and the key never leaves the module & the HSM wipes the key if it detects tampering (there is usually a battery inside to power the tampering detection even if the device is not plugged in). So just exporting the private key so easily without some pretty involved hight-tec…
I worked on a new internal PKI, nothing as high stakes as banking, but we did have a security consultant who had been around the block. We did, of course, purchase such HSMs and design a signing ceremony. But in his opinion it was also normal and expected to keep a decryptable copy of the private key, in case of e.g. changing HSM vendors. It would be even less accessible, but it would exist.