Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Postbank to replace 12M bank cards after employees steal 'master key'

timeslive.co.za

Post reply on HN
Print view View original

161–170 of 194 posts

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#161

Post by ndesaulniers »

erikig wrote: post #135
LeonM wrote: post #100

Insane. Just think of the risk that this 'master key' exposed to the bank's employees. Having access to something as insanely valuable as a bank 'master key' puts the employees at risk of blackmail, extortion, etc. That's why you have HSMs, key ceremonies, Shamir's secret sharing etc. It's not just for trust, it's also for protection of those involved. Unauthorized wire transfers can be undone, or covered by insuranc…

I appreciate this. I wasn't familiar with Adi Shamir's secret sharing scheme. I found this video quite helpful in clarifying how it works for cases where only a subset of the participants are required to confirm the secret. https://www.youtube.com/watch?v=iFY5SyY3IMQ

Interesting, thanks for sharing (I too was curious).

This is my favorite video on Diffie-Hellman key exchange which is a slightly different problem (sharing a secret, without the constraint of dividing the key): https://www.youtube.com/watch?v=YEBfamv-_do (oh, hey, same channel! Guess I'll need to check out more videos from here!)

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#162

Post by panopticon »

swimfar wrote: post #122
SAI_Peregrinus wrote: post #95

Earlier quoted context omitted.

Or check a metal case with a lock the TSA can't open: buy a flare gun (legally a firearm, cheaper than normal guns), declare it, and have your other valuables in the same bag. Legally firearms must be in checked luggage, without ammunition, in hard cases (not soft bags), locked by a mechanism only the owner can open . But unless you travel with valuables quite often it is definitely cheaper to ship it insured.

This sounds like a better idea than flying with AR-15 parts. Less likely to scare people, and less likely to raise flags or get put on some list.

I feel like a flare gun is more likely to scare than a lower receiver. A flare gun immediately looks like "a gun" whereas a block of metal doesn't look very threatening (assuming you don't have a tacti-cool one with skulls and garbage on it).

I only flew with a stripped lower once, and the baggage attendant at the Delta counter had to wave a TSA agent over because they did not believe it was a firearm. I never had an issue checking a handgun though.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#163

Post by mulmen »

lmm wrote: post #155
mulmen wrote: post #151

Earlier quoted context omitted.

The problem is not access to the luggage. The problem is access to the firearm . That is why when you are transporting a firearm TSA does not retain the ability to access the firearm outside of your supervision. TSA's procedures are as robust as a high school recital of A Midsummer Night’s Dream. The TSA knows this and so when it matters (like when firearms are involved) the rules change.

Most locks have master keys and most find their way into the hands of sufficiently motivated criminals, right? Is there any lock you could put on your firearm case for which there wouldn't be authorised people who had the master key to it?

I don't think your initial assertion is correct and even if it is nothing requires you to use such a lock.

Most high security locks can be re-keyed. There's no need for it to be keyed to any existing master. I consider that better than "one of these 6 predefined TSA keys that can be 3d printed oh and also it is labelled."

Nor does the threat model of "dedicated attacker" make a lot of sense. If that is your constraint then flying with complete guns is probably not for you.

There are easier ways for criminals to get guns than a mole in the TSA or baggage handling. Like, stores. A decent padlock can secure a gun case beyond the "crime of opportunity" level required for protection in a secured environment like an airport.

If you're really paranoid you can even build in trap pins so attempting picking or using the wrong key can permanently bind the lock. The point is you are in full control of the lock and don't have a government mandated, well understood backdoor included.

Finally, all of this misses the point which is that you can put a firearm such as a starting pistol, flare gun, frame or lower [1] in your luggage and use whatever lock you want. This means you can protect the rest of your stuff from getting swiped by TSA or baggage handlers.

[1]: https://www.atf.gov/firearms/firearms-guides-importation-ver...

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#164

Post by Havoc »

gsnedders wrote: post #160
Havoc wrote: post #158

Postbank is a subsidiary of South Africa's Post Office. An entity that is bankrupt and barely functional despite having a state mandated monopoly on an entire country's postal system. As per article they're also running the SASSA social grant system which is a train wreck in itself and has been buried in legal disputes for years (not random small cases...a challenge to the legitimacy of their core mandate on grants).…

> An entity that is bankrupt and barely functional despite having a state mandated monopoly on an entire country's postal system. To be fair, plenty of state-mandated monopolies of postal systems still aren't profitable, often because they don't significantly control their revenue stream insofar as they don't set the prices of their products.

Your argument is broadly sound, but not applicable in this particular case.

Currently people are paying a massive premium to utilize private courier to have their stuff privately couriered. People are literally going f that I don't care what it costs I don't trust the postal system.

A sane postal service would review this situation and try to understand why the people think "f you". SAPO has decided that the correct solution to this situation is to simply legally mandate that everyone has to use their useless service thus making couriers illegal for this category. Literally:

https://mybroadband.co.za/news/business/346729-online-stores...

I personally take a pretty dim view on "nobody wants this...fine...so we'll just force it by law" dynamics

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#165

Post by anitil »

LeonM wrote: post #100

Insane. Just think of the risk that this 'master key' exposed to the bank's employees. Having access to something as insanely valuable as a bank 'master key' puts the employees at risk of blackmail, extortion, etc. That's why you have HSMs, key ceremonies, Shamir's secret sharing etc. It's not just for trust, it's also for protection of those involved. Unauthorized wire transfers can be undone, or covered by insuranc…

When I was doing IT support one off the trickiest things was trying to get people to stop giving me their passwords. I am not interested in that sort of liability if something gets stolen!

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#166

Post by lioeters »

erikig wrote: post #135
LeonM wrote: post #100

Insane. Just think of the risk that this 'master key' exposed to the bank's employees. Having access to something as insanely valuable as a bank 'master key' puts the employees at risk of blackmail, extortion, etc. That's why you have HSMs, key ceremonies, Shamir's secret sharing etc. It's not just for trust, it's also for protection of those involved. Unauthorized wire transfers can be undone, or covered by insuranc…

I appreciate this. I wasn't familiar with Adi Shamir's secret sharing scheme. I found this video quite helpful in clarifying how it works for cases where only a subset of the participants are required to confirm the secret. https://www.youtube.com/watch?v=iFY5SyY3IMQ

Yesterday there was a Show HN about a purely client-side (?) implementation of Shamir's secret sharing algorithm.

https://news.ycombinator.com/item?id=23541949

https://github.com/simonfrey/s4

Additional references from the app's About page.

- What is Key Sharding? Shamir’s Secret Sharing Explained (Easy) https://www.youtube-nocookie.com/embed/TQ-DsEZBuQY

- Shamir's Secret Sharing - Solution and alternative to Lagrange (More in-depth) https://www.youtube-nocookie.com/embed/rWPZoz0aux4

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#167

Post by buyx »

Havoc wrote: post #158

Postbank is a subsidiary of South Africa's Post Office. An entity that is bankrupt and barely functional despite having a state mandated monopoly on an entire country's postal system. As per article they're also running the SASSA social grant system which is a train wreck in itself and has been buried in legal disputes for years (not random small cases...a challenge to the legitimacy of their core mandate on grants).…

To clarify: no one is compelled to use the South African Post Office. There are dozens of courier companies that offer much better service (legally). The SAPO operating model is the same as many/most other legacy postal services around the world, but more incompetently executed.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#169

Post by lmm »

mulmen wrote: post #163
lmm wrote: post #155

Earlier quoted context omitted.

Most locks have master keys and most find their way into the hands of sufficiently motivated criminals, right? Is there any lock you could put on your firearm case for which there wouldn't be authorised people who had the master key to it?

I don't think your initial assertion is correct and even if it is nothing requires you to use such a lock. Most high security locks can be re-keyed. There's no need for it to be keyed to any existing master. I consider that better than "one of these 6 predefined TSA keys that can be 3d printed oh and also it is labelled." Nor does the threat model of "dedicated attacker" make a lot of sense. If that is your constrain…

Can you explain how using a TSA lock on a gun case you're flying with, if you want to, is "a big no-no and could result in problems with the law"? That's the part I'm disagreeing with. Surely if a knave uses a stolen master key (or makes unauthorised use of a master key they have as part of their job) to open your gun case, that's not your liability.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#170

Post by jimmydorry »

buyx wrote: post #167
Havoc wrote: post #158

Postbank is a subsidiary of South Africa's Post Office. An entity that is bankrupt and barely functional despite having a state mandated monopoly on an entire country's postal system. As per article they're also running the SASSA social grant system which is a train wreck in itself and has been buried in legal disputes for years (not random small cases...a challenge to the legitimacy of their core mandate on grants).…

To clarify: no one is compelled to use the South African Post Office. There are dozens of courier companies that offer much better service (legally). The SAPO operating model is the same as many/most other legacy postal services around the world, but more incompetently executed.

That's not true. When you order something that goes through customs, it will be sent to a random SAPO (not even necessarily your closest one or the same one each time) for you to pay the customs fee in person with cash and sometime card. This is regardless of whether that package was headed for processing and distribution by one of the private post offices.
Post reply on HN