Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

South Korea’s online security dead end

palant.info

Post reply on HN
Print view View original

131–140 of 144 posts

Re: South Korea’s online security dead end

#131

Post by varenc »

palant wrote: post #109
varenc wrote: post #68

I poked around the install page for Citibank's required software and it's pretty fascinating: https://www.citibank.co.kr/CusSecnCnts0100.act?P_name=ASTx Some quick observations: - That page intentionally disables right-click! Just by putting `oncontextmenu="return false"` on the tag. This gives me flashbacks to the late 90s when this technique was used to make it harder for users to copy images or inspect HTML source…

Disclaimer : I’m the author of this article. Did you notice the plain HTTP (no SSL) download URLs for the “security software”? If not, you are missing out!

I didn't! The download URLs on that page all seemed to be HTTPS for me, though my browser might be forcing the HTTPS connection or something. Or it's just the macOS versions. I'd 100% believe there's plain HTTP requests in there somewhere. I was trying to get the JS to serve me the software for other OSes but was struggling since it seems to do more than just a User-Agent check. Fortunately that JS is the totally unobfuscated kind.

btw, love your article! Such an interesting obscure little corner of the world of technology. Hope to read more.

Re: South Korea’s online security dead end

#132

Post by GauntletWizard »

4ggr0 wrote: post #114
PradeetPatel wrote: post #64

Earlier quoted context omitted.

It has been established that large private enterprises in China have connections with the Communist Party of China, aka the government.

> It has been established that large private enterprises in [COUNTRY] have connections with the [POLITICAL SYSTEM] of [COUNTRY], aka the government. Not disagreeing with you and I know that people should be aware of this, but I don't get why this fact is always quoted as if that's a special situation in China. I mean, take the US as an example, you can't tell me that large private enterprises have connections with th…

There's a difference between "Has to follow the US and it's laws", "Has strong connections via technology forums and the revolving door of lobbying" and "Has government-mandated official positions that report to the party"

It's actually pretty low in direct effect - if the government wants the corporation's secrets, or even for a coporation to take actions on it's behalf, there are plenty of both public and private agents within the company that they can use to act or steal or whatever. What's important about it is the act of subservience. The latter is a direct admission that "The corporation serves the state's interests", whereas in the US and other free countries the state serves the people's interests, and the corporation is a group of people with common interest.

This is why Citizen's United is so important a ruling and under constant attack - Because it asserts the primacy of the people to make their interests heard, in opposition to the model where people serve the state.

Re: South Korea’s online security dead end

#133

Post by GauntletWizard »

smsm42 wrote: post #100

> Nowadays, a typical Korean banking website will require five security applications to be installed before you are allowed to log in Note to self: never move to Korea. Or at least never use Korean bank (can you survive on cash and Bitcoin?)

I was just there for two weeks, and while I used my card a lot, I don't think there's anything I couldn't have done with cash. For that matter, I had no problem using my American bank, though obviously if I were being paid in Won that would be less of an option.

Re: South Korea’s online security dead end

#134

Post by WiSaGaN »

physicles wrote: post #128
WiSaGaN wrote: post #95

Earlier quoted context omitted.

Maybe 5 years ago, but now nobody uses web-based online banking any more in China. Most banks have decent mobile apps now, which have much better usability than the web-based ones. The IE situation is irrelevant now.

It doesn't bother you that your phone has the ability to make large, life-altering transactions? Hmm the app for my bank is 2/5 stars and somehow 360MB. I'll avoid it unless I absolutely need it.

Then you probably don't use your phone as 2FA for any "large, life-altering transactions"?

Re: South Korea’s online security dead end

#135

Post by Abishek_Muthian »

r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

Woah, I thought Indian banks blocking right clicks on their website as "security" measure was obsurd.

You mentioned about PC environments, What's up with mobile? Specifically with Android & iOS; Do you have to install rootkits there too for online financial transaction?

Re: South Korea’s online security dead end

#136

Post by 4ggr0 »

GauntletWizard wrote: post #132
4ggr0 wrote: post #114

Earlier quoted context omitted.

> It has been established that large private enterprises in [COUNTRY] have connections with the [POLITICAL SYSTEM] of [COUNTRY], aka the government. Not disagreeing with you and I know that people should be aware of this, but I don't get why this fact is always quoted as if that's a special situation in China. I mean, take the US as an example, you can't tell me that large private enterprises have connections with th…

There's a difference between "Has to follow the US and it's laws", "Has strong connections via technology forums and the revolving door of lobbying" and "Has government-mandated official positions that report to the party" It's actually pretty low in direct effect - if the government wants the corporation's secrets, or even for a coporation to take actions on it's behalf, there are plenty of both public and private a…

> in the US and other free countries the state serves the people's interests, and the corporation is a group of people with common interest.

Does it? I'd argue that in a lot of free, western countries the state does serve the people, but more so the ruling class and those in power. Which can happen to align with the peoples interests, but often does not, in my opinion. Lobbying, advertising and the available funds for campaigns tips the scale heavily to one side. And those in power in the west are? Exactly, the rich people from the private sector.

Citizen's United seems okay, but you can't tell me that what this tries to prevent happens constantly behind closed doors. Of course that doesn't make it less important.

Re: South Korea’s online security dead end

#137

Post by kragen »

likecarter wrote: post #92
kragen wrote: post #82

Earlier quoted context omitted.

judges decide who counts as experts, and doing that correctly requires expertise this is why so many people get convicted on the basis of pseudoscience like lie detector tests and tracy harpster's 911 call analysis https://www.propublica.org/article/911-call-analysis-fbi-pol... it would not be especially difficult to find a professor from a reputable university who would explain that using dynamically typed languages…

That's why both sides get experts. Your reasoning is extremely reductive – I can't tell if you're just trying to win an argument here. You could say people will be misleading about anything. Your doctor, the police, the DMV clerk. At some point, you have to recognize you live in a society, and society is built on some level of trust and fairness.

well, you could say a lot of random irrelevant things like that but you'd probably be better off thinking about what i said

Re: South Korea’s online security dead end

#138

Post by glebd »

joshuaissac wrote: post #63

Large banks in the UK used to promote an application called Trusteer Rapport that secured the connection between the bank's server and the user's computer. It was not mandatory like the Korean apps, just strongly suggested. I can see that some banks still offer it.

https://www.reddit.com/r/sysadmin/comments/4iq2pp/trusteer_r...

Re: South Korea’s online security dead end

#139

Post by Kamq »

palant wrote: post #111
Kamq wrote: post #96

Earlier quoted context omitted.

> the main issue with C from a security POV is the total lack of memory safety and the consequent vulnerability to buffer overflows. Sure, but C++ also has these issues, so the "not even C++" doesn't exactly make sense.

Disclaimer : I am the author of this article. Not really. With C++, you don’t have to use manual memory management. In the typical scenario, C++ objects take care of memory without the developer having to think about it. And you have all kinds of smart pointers for the more complicated scenarios. That doesn’t mean of course that there are no buffer overflows in C++, or use-after-free bugs. There is still plenty of ro…

We have... very different ideas about how capable random devs on a government contract are. Or how feasible it is to prevent the worst possible behavior in a large codebase. That is to say, I tend to assume code managed by a large team on a government project (or a project in any sufficiently large organization) will be the worst possible code that language can produce. And C++ can produce worse code than C (all of the danger of C, but happening implicitly instead of explicitly).

You seem to be taking the best possible code as the default. I will admit that the best possible C++ code is better than the best possible C code.

Re: South Korea’s online security dead end

#140

Post by ponorin »

flotzam wrote: post #37
second_brekkie wrote: post #34

I live in Korea. In my experience pretty much everyone I know uses banking apps which you can do everything through, not online banking through a browser. You would hope that these would be somewhat more secure as this may have required a 're-write' as the article suggested. Though even with mobile apps you sometimes have to install some 3rd party 'anti-virus' software that probably amounts to spyware. But hey you ca…

There's a curious absence of Korean banking apps on this GrapheneOS compatibility list: https://privsec.dev/posts/android/banking-applications-compa... Does it mean none are usable on a modern clean Android? Or is there a total Samsung monoculture? Something else?

I live in Korea and run the latest GrapheneOS on Pixel 6. I have 6 different banking apps (Citi, IBK, Woori, etc.) installed and all of them work flawlessly. I also have a few government apps running and they work as well. There are definitely some apps that don't run on it (Donbaekjeon, Busan's local payment app being one) but overall they work.
Post reply on HN