Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Postbank to replace 12M bank cards after employees steal 'master key'

timeslive.co.za

Post reply on HN
Print view View original

171–180 of 194 posts

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#171

Post by jimmydorry »

gsnedders wrote: post #160
Havoc wrote: post #158

Postbank is a subsidiary of South Africa's Post Office. An entity that is bankrupt and barely functional despite having a state mandated monopoly on an entire country's postal system. As per article they're also running the SASSA social grant system which is a train wreck in itself and has been buried in legal disputes for years (not random small cases...a challenge to the legitimacy of their core mandate on grants).…

> An entity that is bankrupt and barely functional despite having a state mandated monopoly on an entire country's postal system. To be fair, plenty of state-mandated monopolies of postal systems still aren't profitable, often because they don't significantly control their revenue stream insofar as they don't set the prices of their products.

Unfortunately, I don't think there is a single state-run company in South Africa that isn't bankrupt or on the brink of bankruptcy.

The key factor has been unmitigated corruption and ineptitude.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#172

Post by irjustin »

I have this fantasy that there was some security engineer who said, "hrm this looks like you could steal/reconstruct this master key by..." raised it up to management and subsequently ignored or shot down because changing the solution was too expensive.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#173

Post by mulmen »

lmm wrote: post #169
mulmen wrote: post #163

Earlier quoted context omitted.

I don't think your initial assertion is correct and even if it is nothing requires you to use such a lock. Most high security locks can be re-keyed. There's no need for it to be keyed to any existing master. I consider that better than "one of these 6 predefined TSA keys that can be 3d printed oh and also it is labelled." Nor does the threat model of "dedicated attacker" make a lot of sense. If that is your constrain…

Can you explain how using a TSA lock on a gun case you're flying with, if you want to , is "a big no-no and could result in problems with the law"? That's the part I'm disagreeing with. Surely if a knave uses a stolen master key (or makes unauthorised use of a master key they have as part of their job) to open your gun case, that's not your liability.

> Can you explain how using a TSA lock on a gun case you're flying with, if you want to, is "a big no-no and could result in problems with the law"?

I'm not sure, those are not my words. Ask swimfar.

It strikes me as simply irresponsible gun ownership although I'm not sure what legal liability that may open you up to.

Again, the point of bringing this up is that you can decide to use an actual secure lock to protect your property if you just put a "firearm" in your luggage. It's not actually about firearms at all. It's about protecting yourself from an obviously broken and exploitable government backdoor.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#174

Post by selimthegrim »

roywiggins wrote: post #44
gcbw3 wrote: post #17

Earlier quoted context omitted.

People seem to forget why credit cards came into existence. It was not for security. Ever. Credit Cards were introduced as a less-secure-but-more-convenient-check. The store then would have a stock of "blank checks" with absolutely no security features where they would imprint with carbon paper and a pressure roll the credit card information and pretty much "mint" the client a check on the spot. Over time the raised…

Maybe 5 years ago or so a store in London pulled out their carbon copy machine from under the counter to accept my American credit card.

I've seen them in taxis once in a blue moon if their card reader is broken.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#175

Post by selimthegrim »

tialaramex wrote: post #61
aerostable_slug wrote: post #28

Earlier quoted context omitted.

Even more fun fact: we rely on mag stripes (vs. chip n pin / nfc / etc) because of gas pumps. The cost of refitting gas pumps holds us back. Yay.

Liability shift for gas pumps has been pushed back (October 2020 I think) but not eliminated. Liability shift works like this: Historically the merchant is protected if they had good faith belief that the payment card was authorised via things like a mag stripe. After liability shift that goes away unless you use EMV. You checked the card was "real" with just a mag stripe? Not interested, the chargeback comes out of…

Liability shift or not some of these gas stations keep insisting on ID with credit cards.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#176

Post by selimthegrim »

netsharc wrote: post #131
ScarZy wrote: post #18

This is quite surprising to me. Some of the banking technology and practices in Germany are extremely tight and their infrastructure seems problematic. Living there for a while as a non-native and being with PostBank, it was insanely difficult to login and understand. Germany is also heavily marred with bank cash groups, meaning you get charged elsewhere. It was great to see N26 come along and change that, and thank…

They really should add "[South Africa]" the title, since my first thought was "Is this Germany or might they mean PostFinance in Switzerland?"... How do you summmon dang, with @dang?

I think burning sage and eye of newt is involved too.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#178

Post by ajdlinux »

heavenlyblue wrote: post #144
_9vzr wrote: post #130

Earlier quoted context omitted.

An A-Z character string written inside random page a book stored at a relative's house is a super easy way to secure a physical backup of your private key. You could even get clever and encrypt the key using some memorable passage of another book. Since the book passage is unknown to anyone else and be selected from a near infinite pool of paragraphs from the entirety of all published books, it would be impossible fo…

You are not adding any more security than that if you simply remembering some random key (which isn’t that hard if you put your mind to it).

Don't forget the I and the A in the CIA triad, which are likely to be improved by keeping things recorded in writing.

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#179

Post by patcon »

lioeters wrote: post #166
erikig wrote: post #135

Earlier quoted context omitted.

I appreciate this. I wasn't familiar with Adi Shamir's secret sharing scheme. I found this video quite helpful in clarifying how it works for cases where only a subset of the participants are required to confirm the secret. https://www.youtube.com/watch?v=iFY5SyY3IMQ

Yesterday there was a Show HN about a purely client-side (?) implementation of Shamir's secret sharing algorithm. https://news.ycombinator.com/item?id=23541949 https://github.com/simonfrey/s4 Additional references from the app's About page. - What is Key Sharding? Shamir’s Secret Sharing Explained (Easy) https://www.youtube-nocookie.com/embed/TQ-DsEZBuQY - Shamir's Secret Sharing - Solution and alternative to Lagrang…

Dark Crystal is another neat POC Shamir Secret Sharing tool, built by some folks involved in SSB[0] and Loomio [1]

https://darkcrystal.pw/

[0]: https://scuttlebutt.nz/ [1]: https://www.loomio.org/

Re: Postbank to replace 12M bank cards after employees steal 'master key'

#180

Post by jacobkg »

erikig wrote: post #135
LeonM wrote: post #100

Insane. Just think of the risk that this 'master key' exposed to the bank's employees. Having access to something as insanely valuable as a bank 'master key' puts the employees at risk of blackmail, extortion, etc. That's why you have HSMs, key ceremonies, Shamir's secret sharing etc. It's not just for trust, it's also for protection of those involved. Unauthorized wire transfers can be undone, or covered by insuranc…

I appreciate this. I wasn't familiar with Adi Shamir's secret sharing scheme. I found this video quite helpful in clarifying how it works for cases where only a subset of the participants are required to confirm the secret. https://www.youtube.com/watch?v=iFY5SyY3IMQ

The original paper on this “How to Share a Secret” by Adi Shamir is incredible. You should absolutely read it.

- The system is proven to be information theoretically secure (not just computationally)

- It uses only high school math

- The paper is only TWO PAGES LONG

I highly recommend printing this out on a single sheet of paper (double sided) and digging in.

https://cs.jhu.edu/~sdoshi/crypto/papers/shamirturing.pdf

Post reply on HN