Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My bank keeps on undermining anti-phishing education

moritz-mander.de

Post reply on HN
Print view View original

151–160 of 267 posts

Re: My bank keeps on undermining anti-phishing education

#151

Post by jmholla »

jonathantf2 wrote: post #40

> "The SSL certification is from Let’s Encrypt and not from one of the major root CAs" This is NOT a reason to distrust a website.

Followed up with:

> While everyone can register for free on Let’s Encrypt, only (or mostly) serious companies pay money to register on DigiCert, GoDaddy, and so on.

GoDaddy is not a serious anything. DigiCert perhaps, but GoDaddy has repeatedly shown themselves to be scummy and untrustworthy.

That said, I do see the value in having an entity like a bank pay for a stricter cert with identity validation versus leveraging Let's Encrypt's free infrastructure which only validates domain/site control.

Re: My bank keeps on undermining anti-phishing education

#152

Post by clbrmbr »

Do what I did: move to a new bank that respects your security. When you close your account, give formal feedback about why you are closing. Outflows of depositors should send a signal.

(i had on issue with PNC in the US where they kept calling and asking for a 2FA code. Totally indistinguishable from phishing. Clearly they lack proper infosec, so I moved to Schwab and have not looked back.)

Re: My bank keeps on undermining anti-phishing education

#153

Post by RandomBacon »

unethical_ban wrote: post #134
kakuri wrote: post #121

Earlier quoted context omitted.

I interviewed for a software engineering position at USAA. After seeing the incompetence of the interviewers none of the nonsense they do surprises me.

I worked in IT ops there for a long time, and since then have seen the inner workings of companies in several different fields. They had by far the most competent cybersecurity group I've witnessed. Things have changed in a decade maybe. But, they still use proprietary TOTP from Symantec which is annoying.

> But, they still use proprietary TOTP from Symantec which is annoying.

They at least used to, but I'm not sure they still do.

(And when they did, I was able to copy the key into a MFA app of my choice.)

But now as an end-user, it's all built in to their own banking app. I don't use the code from the app though, because I just use my personal 4 digit pin (after entering in my unique password from my password manager).

Re: My bank keeps on undermining anti-phishing education

#155

Post by mnw21cam »

ddejohn wrote: post #117
0x5FC3 wrote: post #4

User facing tech and marketing practices at banks are the worst. Every Indian bank login form I've ever had to use is - hostile to password managers. - You cannot copy paste passwords. - Client side password hashing - Stupid requirements like the password cannot have more than 15 characters and even have a whitelist of character sets! (Looking at you HDFC) - And of course, run of the mill spam They are all stuck in t…

> Client side password hashing Forgive my ignorance, but what's wrong with this one?

If the hashing is done on the client and then sent to the server, then the server is effectively just processing as a plaintext password. If an attacker gets hold of the server password database, then they can just connect to the server and pretend to be the client and hand it the hashed password that they read from the database breach.

If you hash the password on the server instead, then if the password database is breached, then an attacker needs to actually reverse the hash[0] and find the original password in order to log in, because that's all that the server will accept.

[0] Note, this should be difficult[1] [1] In crypto, "difficult" should mean "impossible before the end of the universe"

Re: My bank keeps on undermining anti-phishing education

#156

Post by ectospheno »

OkayPhysicist wrote: post #112
microtonal wrote: post #63

Earlier quoted context omitted.

One of my former banks handled this pretty well. They called you and would say something like “there is an issue, but since you should never trust a direct phone call pretending to be your bank, please look up our number on our website and call us”. It’s kinda nice because while doing this, they also educate their customers to never trust such a call and to rely on official information to contact them.

My credit union does the same but with "call the number on the back of your card". I suppose they have a lot of practice getting it right, given that their idea of a suspicious transaction is any transaction out of state.

PNC pulled that on me all the time. So I closed all my accounts and bank elsewhere. Gave fraud prevention as the sole reason for my exit on forms.

Re: My bank keeps on undermining anti-phishing education

#157

Post by mnw21cam »

nmstoker wrote: post #119

A friend told me about a company where the CISO instigated security newsletters aimed at staff to build up their experience on such topics, yet the newsletters were emailed from an external email and contained links to a hosting site that wasn't related to any of the employers regular website domains and like this case would often come across as a phishing attempt, especially when they ran competitions (apparently th…

Every weekly newsletter I get at work is sent from an external spam-sender, containing links to an external hosting site that have a unique ID for tracking clicks. Those links are then munged by Outlook which makes them hard to identify. I searched on the company web site for any confirmation that the external sender or external hosting site were legitimately being used by the company and found none, so I refuse to click on those links. I should also report them as phishing scams really.

Re: My bank keeps on undermining anti-phishing education

#158

Post by mnw21cam »

spiffyk wrote: post #59
jonathantf2 wrote: post #40

> "The SSL certification is from Let’s Encrypt and not from one of the major root CAs" This is NOT a reason to distrust a website.

This absolutely IS a reason to distrust a website claiming to be owned by a bank (or any other institution working with such sensitive assets). To be precise, such a website absolutely needs to have a certificate granted not only on the basis of "yes, I control the machine this domain points to" (which is what Let's Encrypt does), but also based on other, more physical and reliable means.

You're talking about EV certificates. They're dead.[0]

I personally would trust something signed by Lets Encrypt more readily than many other certificate providers. They appear to know what they are doing.

[0] https://www.troyhunt.com/extended-validation-certificates-ar...

Re: My bank keeps on undermining anti-phishing education

#159

Post by hahn-kev »

mnw21cam wrote: post #155
ddejohn wrote: post #117

Earlier quoted context omitted.

> Client side password hashing Forgive my ignorance, but what's wrong with this one?

If the hashing is done on the client and then sent to the server, then the server is effectively just processing as a plaintext password. If an attacker gets hold of the server password database, then they can just connect to the server and pretend to be the client and hand it the hashed password that they read from the database breach. If you hash the password on the server instead, then if the password database is…

No it's not. Did you ever think that you can hash something twice? Hash it once on the client, then hash and salt it server side, like normal. It means that the server never actually knows your password, but that's about all it gives you.

Re: My bank keeps on undermining anti-phishing education

#160

Post by mnw21cam »

massung wrote: post #60

I use USAA for banking. Something they do when they initiate a call to me on the phone is they start by making sure they are talking to me (they don’t ask me to prove it) and making sure I have the app on the my phone or access to a web page. Then they initiate a MFA check within the app. I have to get it and read back a number. Then they ask me for my phone PIN or password. Once that’s done, then we can start talkin…

That is a really bad idea. That's letting anyone who phones you prove to the bank that they are you.

You should only reveal an MFA code to someone that you have called, knowing that it is the right person.

Post reply on HN