Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

South Korea’s online security dead end

palant.info

Post reply on HN
Print view View original

101–110 of 144 posts

Re: South Korea’s online security dead end

#101

Post by smsm42 »

mikem170 wrote: post #54
wmf wrote: post #19

Earlier quoted context omitted.

Are there any US banks that are actually secure? AFAIK they're all using SMS 2FA or worse.

Schwab has hardware security tokens for the asking. I have one. Similar to the six digit rsa tokens I used at work (but without the rsa token bug from some years ago). It is my understanding they also support software tokens. I'm a happy customer. https://www.schwab.com/help/two-factor-authentication

Wells Fargo supports these too: https://www.wellsfargo.com/biz/online-banking/securid/

Re: South Korea’s online security dead end

#102

Post by [deleted] »

gruez wrote: post #91
ravel-bar-foo wrote: post #45

Earlier quoted context omitted.

It is worth mentioning that to make a bank transfer in Korea (used to[1]) require 3 factor authentication: the user's website password, the user's PIN, the user's encryption certificate signature/공인인증서, and two randomly selected codes from a paper numbers card (보안카드: https://file2.nocutnews.co.kr/newsroom/image/2013/07/02/2013... ), which users are instructed to never copy or digitize. Of all these solutions, the num…

>Of all these solutions, the numbers card gives me the most peace of mind: even if my machine is fully compromised and all my passwords and certificates stolen, the attacker would likely need very long-term access (or access to the bank's server) to get all 35 numbers from the card I think you're overestimating how much security this provides and missing a very simple workaround: the attacker can simply wait until yo…

[deleted]

Re: South Korea’s online security dead end

#103

Post by Arnavion »

astrange wrote: post #72
Arnavion wrote: post #36

Earlier quoted context omitted.

The credit union I use does have SMS 2FA as an option, but has other options via Entrust. Specifically there's a "soft token" that's a phone app which implements their own brand of not-TOTP, and a "hard token" that's a fob that generates their own brand of not-TOTPs.

What operations does it require the OTPs for? Generally anyone can do an ACH withdrawal from your account and the bank won’t ask you about it until afterwards. This is dealt with by other legal frameworks but you could certainly call it insecure even if they need 4 factors to let you see your account balance.

Just logging in.

Re: South Korea’s online security dead end

#104

Post by pigtailgirl »

r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

-- dont know who you bank with but fyi - shinhan - charles schwab and kakao all work well on os x that who I use! --

Re: South Korea’s online security dead end

#105

Post by roenxi »

likecarter wrote: post #81
kragen wrote: post #69

Earlier quoted context omitted.

that just leaves the courts to decide what the best practices are, and what due care is or isn't, which i think is actually what happened in south korea that would be great if judges were hackers and legislators weren't, but that isn't the current situation

In court, you bring in experts (usually professors from reputable universities) to state best practices. Judges don't act as experts in a trial.

That is also how the legislative process works, and is likely how the Koreans got in to this mess in the first place. Experts at the time identified IE6 and ActiveX as dominating the market and standardised on them^. If the web had converged on IE and ActiveX it wouldn't look as stupid as it does now. Back at the time it was arguably clever, it only looked ill-advised if you were a free-market thinker.

^ The cynic in me cheerfully suggests the experts were probably endorsed by Microsoft, at the time a colossus on the net and world's most successful web browser purveyor. Hard to get better pedigree experts. All recommending that people commit hard to Microsoft technologies.

Re: South Korea’s online security dead end

#106

Post by ravel-bar-foo »

maxgashkov wrote: post #78
kijin wrote: post #74

Earlier quoted context omitted.

I dunno where you got the idea that South Korea still clings to paper-based number cards, but OTP tokens have been in use for the better part of a decade here. Nowadays you don't even need hardware tokens, since it's considered OK to replace them with mobile apps that use TPM to manage keys.

I’ve got the idea from the parent comment obviously. It’s cool that the practice of paper cards is not as widespread as I thought after reading it.

Sorry about that. My bank still provides me with cards. I never asked about a OTP dongle and I don't want to enable mobile banking, so cards it is. But almost everyone in Korea (who isn't paranoid about a single compromised device) is now on mobile banking, rather than website banking.

Re: South Korea’s online security dead end

#107

Post by ravel-bar-foo »

gruez wrote: post #91
ravel-bar-foo wrote: post #45

Earlier quoted context omitted.

It is worth mentioning that to make a bank transfer in Korea (used to[1]) require 3 factor authentication: the user's website password, the user's PIN, the user's encryption certificate signature/공인인증서, and two randomly selected codes from a paper numbers card (보안카드: https://file2.nocutnews.co.kr/newsroom/image/2013/07/02/2013... ), which users are instructed to never copy or digitize. Of all these solutions, the num…

>Of all these solutions, the numbers card gives me the most peace of mind: even if my machine is fully compromised and all my passwords and certificates stolen, the attacker would likely need very long-term access (or access to the bank's server) to get all 35 numbers from the card I think you're overestimating how much security this provides and missing a very simple workaround: the attacker can simply wait until yo…

You're right. The machine remains a big single vulnerability. However, there is a process to catch this: one (used to?) have the option to get a text by SMS following the transfer. This (used to) list the recipient. For whatever reason I haven't gotten a text like this in a few years. Probably my bank disabled it to push people to their mobile app.

Re: South Korea’s online security dead end

#108

Post by palant »

csydas wrote: post #23
palant wrote: post #17

Earlier quoted context omitted.

That’s in fact what I suggest in my blog post. But I am pretty certain that it is far from simple. I’m told that the previous Korean government already tried to tackle this issue and failed. It’s a huge and complicated mess.

My information here may be outdated, but when I was in Seoul for awhile, it wasn't limited to just banking apps, many services had similar requirements for specific plugins, even requiring Internet Explorer 11 and a bunch of plugins for that. I remember trying to get tickets for an event, and it was not possible within MacOS at the time due to the various Windows only requirements. I remember even having to re-downlo…

Yes, I’ve seen references to online gaming that also required these “security applications.” In this case it was likely to aid tracking users and to prevent cheating.

Re: South Korea’s online security dead end

#109

Post by palant »

varenc wrote: post #68

I poked around the install page for Citibank's required software and it's pretty fascinating: https://www.citibank.co.kr/CusSecnCnts0100.act?P_name=ASTx Some quick observations: - That page intentionally disables right-click! Just by putting `oncontextmenu="return false"` on the tag. This gives me flashbacks to the late 90s when this technique was used to make it harder for users to copy images or inspect HTML source…

Disclaimer: I’m the author of this article.

Did you notice the plain HTTP (no SSL) download URLs for the “security software”? If not, you are missing out!

Re: South Korea’s online security dead end

#110

Post by Too »

Kamq wrote: post #96
rippercushions wrote: post #55

Earlier quoted context omitted.

Writing the critical parts of a OS kernel in C is sensible. Browser extensions, not so much. As the author notes, they're not just being snobby about languages, the main issue with C from a security POV is the total lack of memory safety and the consequent vulnerability to buffer overflows.

> the main issue with C from a security POV is the total lack of memory safety and the consequent vulnerability to buffer overflows. Sure, but C++ also has these issues, so the "not even C++" doesn't exactly make sense.

At least c++ has unique_ptr and friends. Standard containers like string, vector and map also reduce the amount of manual fiddling with fundamentals you need to do yourself, greatly reducing the mistake-surface.

But yeah, in the end both of them are very dangerous tools, compared to other alternatives.

Post reply on HN