Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My bank keeps on undermining anti-phishing education

moritz-mander.de

Post reply on HN
Print view View original

241–250 of 267 posts

Re: My bank keeps on undermining anti-phishing education

#241

Post by mejutoco »

const_cast wrote: post #190
mejutoco wrote: post #170

Earlier quoted context omitted.

> It means that the server never actually knows your password If the client is hashing it without a salt the server could simply check a Rainbow table ( https://en.wikipedia.org/wiki/Rainbow_table ) to know which password it is. For short inputs this could be trivial.

Sure, but I still think this is preferable to sending the password in clear text even over HTTPS. You're trusting the server doesn't do anything with the password and immediately hashes it, but it might not. It might store it, or even if it doesn't, your password will stick around in RAM for an indeterminate amount of time. If the server is compromised in any way, passwords could be exfiltrated. Companies are, someti…

> Sure, but I still think this is preferable to sending the password in clear text even over HTTPS. You're trusting the server doesn't do anything with the password

My point is in both cases the server has access to the password. As I mentioned, without salt the server can get the original password (by checking the pre-computed rainbow table of hashes up to n length), so the trust issue is the same.

If this is slightly better (more obfuscated) or the same thing + a false sense of security is debatable, but I could agree.

Re: My bank keeps on undermining anti-phishing education

#242

Post by i80and »

ectospheno wrote: post #156
OkayPhysicist wrote: post #112

Earlier quoted context omitted.

My credit union does the same but with "call the number on the back of your card". I suppose they have a lot of practice getting it right, given that their idea of a suspicious transaction is any transaction out of state.

PNC pulled that on me all the time. So I closed all my accounts and bank elsewhere. Gave fraud prevention as the sole reason for my exit on forms.

I ended up with a PNC account as a result of a series of bank acquisitions, and they're so badly run it's almost a dark comedy.

Branch staff are all perfectly lovely, but they're at the mercy of very funky systems above them.

Re: My bank keeps on undermining anti-phishing education

#243

Post by [deleted] »

neuronflux wrote: post #122
dontTREATonme wrote: post #101

Earlier quoted context omitted.

I recently joined a very old company, with many lifers, I continuously run into this mentality. “I can’t explain it now, but I’m sure there was a good reason for it, so we’re gonna continue doing it this way”

Of course it is typically wise to consider Chesterton's fence.

[deleted]

Re: My bank keeps on undermining anti-phishing education

#244

Post by Neywiny »

I know somebody who tried doing a standard vehicle emissions test (gov't facility) in the area they live in. Bank thought it was suspicious and locked their card. Then they tried sending money from the bank to buy a car (they were just borrowing it before buying from a family member), and the bank thought it was fraud so removed online banking too. No tickets or phone calls helped. Ridiculous. Never once did they call to ask "hey is this fraud?"

Re: My bank keeps on undermining anti-phishing education

#245

Post by lxgr »

j_seigh wrote: post #93

Here's an interesting scheme. Some credit/debit card merchant accounts can arrange to get updated card info if your card expires and/or gets replaced. So if the merchant is a bad actor and doesn't charge your card directly but just tracks your updated card info so it can be used fraudulently elsewhere, you, your bank, and the card company will never know they were the source. And the card is linked to your bank accou…

Banks usually have a mechanism to prevent automatic billing/card data updates for exactly that reason for suspected/confirmed fraudulent used cards, but unfortunately not all of them, and I suspect even for those that do, not all customer service reps know how to do that.

In an ideal world, all merchants would be using tokenization already – then the bank could offer you a UI where you can just kick out the merchants you don't want to have access to your payment credentials anymore before reordering a new card. (If tokens were mandatory, like they are e.g. in India, you wouldn't even need to reorder the card in the first place, but that'll probably never happen in the US – too many legacy systems.)

Re: My bank keeps on undermining anti-phishing education

#246

Post by lxgr »

spiffyk wrote: post #59
jonathantf2 wrote: post #40

> "The SSL certification is from Let’s Encrypt and not from one of the major root CAs" This is NOT a reason to distrust a website.

This absolutely IS a reason to distrust a website claiming to be owned by a bank (or any other institution working with such sensitive assets). To be precise, such a website absolutely needs to have a certificate granted not only on the basis of "yes, I control the machine this domain points to" (which is what Let's Encrypt does), but also based on other, more physical and reliable means.

The only thing other CAs do (after EV certificates stopped being a thing, as a sibling commenter already mentioned) is to take more money from you than Letsencrypt, in exchange for longer validities and historically some other concessions (although the browser forum has been clamping down on that, for good reasons).

In other words, if the bank is following best security practices, they're fine with Letsencrypt; if they don't, they might need somebody else.

Re: My bank keeps on undermining anti-phishing education

#247

Post by lxgr »

jmholla wrote: post #151
jonathantf2 wrote: post #40

> "The SSL certification is from Let’s Encrypt and not from one of the major root CAs" This is NOT a reason to distrust a website.

Followed up with: > While everyone can register for free on Let’s Encrypt, only (or mostly) serious companies pay money to register on DigiCert, GoDaddy, and so on. GoDaddy is not a serious anything. DigiCert perhaps, but GoDaddy has repeatedly shown themselves to be scummy and untrustworthy. That said, I do see the value in having an entity like a bank pay for a stricter cert with identity validation versus leveragi…

> While everyone can register for free on Let’s Encrypt, only (or mostly) serious companies pay money to register on DigiCert, GoDaddy, and so on.

Serious companies donate the money they saved by not buying snake oil to Let's Encrypt.

Re: My bank keeps on undermining anti-phishing education

#248

Post by jonathantf2 »

spiffyk wrote: post #59
jonathantf2 wrote: post #40

> "The SSL certification is from Let’s Encrypt and not from one of the major root CAs" This is NOT a reason to distrust a website.

This absolutely IS a reason to distrust a website claiming to be owned by a bank (or any other institution working with such sensitive assets). To be precise, such a website absolutely needs to have a certificate granted not only on the basis of "yes, I control the machine this domain points to" (which is what Let's Encrypt does), but also based on other, more physical and reliable means.

My bank don't have an EV, they have just a plan Amazon cert.

Re: My bank keeps on undermining anti-phishing education

#249

Post by sneak »

AmEx emails to customers often have marketing/tracking redirects replacing all of the links in the email.

The links to that redirector service are http:

You don’t even need to phish them, AmEx does it for you. All you have to do is rewrite the redirect on the wire.

Re: My bank keeps on undermining anti-phishing education

#250

Post by valenterry »

phendrenad2 wrote: post #26

> So the next idea is to register the domain as a subdomain I think the problem is, someone in the IT department understands the high risk associated with handing out subdomains, so they refuse to do it. So other parts of the company "work around" this by registering their own domain name. I wonder how companies like Google handle this. A subdomain of google.com is probably the most valuable hack target in the world,…

Google handles it in the same shitty way. They send mails that could be phishing mails and use not only google.com but many other weird domains like goo.gl or foobar.google and so on.

Terrible. The times were one could rely on them have long passed.

Post reply on HN