Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My bank keeps on undermining anti-phishing education

moritz-mander.de

Post reply on HN
Print view View original

251–260 of 267 posts

Re: My bank keeps on undermining anti-phishing education

#251

Post by exabrial »

My Bank (ally) absolutely refuses to do any sort of secure authentication. No TOTP, no U2F key, no Passkey... however, they're unbelievably climbing over the garden gate to tie my account to my phone. Want to log it? yeah lets text you. Want to do anything else? Hey we sent a push notification to your phone. Seriously, fuck my phone. It's the least secure thing I own. Stop acting like its my damned identity.

Oh as a bonus... Hey want to integrate with a third party website? Oh just enter this code that we are literally telling you not to give away to anyone else. Lol.

Re: My bank keeps on undermining anti-phishing education

#252

Post by valenterry »

Neywiny wrote: post #244

I know somebody who tried doing a standard vehicle emissions test (gov't facility) in the area they live in. Bank thought it was suspicious and locked their card. Then they tried sending money from the bank to buy a car (they were just borrowing it before buying from a family member), and the bank thought it was fraud so removed online banking too. No tickets or phone calls helped. Ridiculous. Never once did they cal…

The problem is that banks are too regulated. They get into problems (of different kinds) when it's actually fraud and they don't block the account. And then, customer support is expensive, more than losing a few customers.

Re: My bank keeps on undermining anti-phishing education

#253

Post by Akronymus »

Y_Y wrote: post #144
anonym29 wrote: post #126

Earlier quoted context omitted.

Per Chesterton's Fence, isn't this the right course of action for any individual who is unsure of why the practice was started? https://www.lesswrong.com/w/chesterton-s-fence

I like that fence, but I consider the best course of action to be going and finding out why the thing is done the eay it is, even if it necessitates careful investigation.

I always understood chestertons to be that you should leave the fence there while you are investigating why its there and whether its still needed. Not blind "dont do anything"

Re: My bank keeps on undermining anti-phishing education

#254

Post by albrewer »

meindnoch wrote: post #51
SoftTalker wrote: post #22

Earlier quoted context omitted.

> My bank insists on exactly 6 numbers. Not characters, numbers. When I see this kind of thing I suspect that it's a web app that's simply a proxy for some mainframe screens that were written in the 1990s (or earlier).

I bet it's actually a set of solenoid actuators physically typing into a 90s terminal.

Don't be ridiculous. It's a set of solenoids typing into a punch card machine.

Re: My bank keeps on undermining anti-phishing education

#255

Post by pixl97 »

i80and wrote: post #242
ectospheno wrote: post #156

Earlier quoted context omitted.

PNC pulled that on me all the time. So I closed all my accounts and bank elsewhere. Gave fraud prevention as the sole reason for my exit on forms.

I ended up with a PNC account as a result of a series of bank acquisitions, and they're so badly run it's almost a dark comedy. Branch staff are all perfectly lovely, but they're at the mercy of very funky systems above them.

Banks are filled with stupid levels of bureaucracy internally, but PNC takes that up to 10. Their IT employees seem like dried husks of something that once was human.

Re: My bank keeps on undermining anti-phishing education

#256

Post by [deleted] »

x0x0 wrote: post #115
stantaylor wrote: post #75

Earlier quoted context omitted.

I used to work for a financial services company that had a strong and well-managed security culture. The company got acquired, and afterwards, we kept getting emails from third parties for various things, all supposedly initiated by execs/groups at the parent company. We employees of the acquired company discussed the emails in Slack: we were sure that these emails were legitimate, but acting on them would have broke…

I had to fire the MSP I hired because they needed to install some software on everyone's computer, so they sent a company-wide email, with no clearance from anyone, directing approximately 40 people to open terminal and paste in a string sent in that email. Along with instructions on how to open terminal. The absolute last thing anyone competent does is train employees to receive communications like that in email and…

[deleted]

Re: My bank keeps on undermining anti-phishing education

#257

Post by constantcrying »

Rygian wrote: post #2

For me, the money shot is Chapter 4: the bank needs to be held legally accountable of gross negligence for sending phishing-resembling emails to customers.

How do you hold someone legally accountable for a non-crime with no identifiable victims? Especially for "gross negligence", when the negligence is very clearly minor.

Re: My bank keeps on undermining anti-phishing education

#258

Post by pbhjpbhj »

gwbas1c wrote: post #25

I find there are a lot of people who just don't "get" written communication. Once I got a vaccination, and in order to do it I had to fill out a form where I chose the arm. The form said to circle either "right or left." The word "right" was on the left and "left" was on the right. I pointed this out to the nurse and she laughed, and then realized her error, because she made the form.

This seems like it was correct - the view of the front of the body shows a third-person view. The labels are relative to the subject (first-person).

Or in other words, looking at me, my right arm is on your left.

Re: My bank keeps on undermining anti-phishing education

#259

Post by const_cast »

mejutoco wrote: post #241
const_cast wrote: post #190

Earlier quoted context omitted.

Sure, but I still think this is preferable to sending the password in clear text even over HTTPS. You're trusting the server doesn't do anything with the password and immediately hashes it, but it might not. It might store it, or even if it doesn't, your password will stick around in RAM for an indeterminate amount of time. If the server is compromised in any way, passwords could be exfiltrated. Companies are, someti…

> Sure, but I still think this is preferable to sending the password in clear text even over HTTPS. You're trusting the server doesn't do anything with the password My point is in both cases the server has access to the password. As I mentioned, without salt the server can get the original password (by checking the pre-computed rainbow table of hashes up to n length), so the trust issue is the same. If this is slight…

Well no, because rainbow tables are quite small. You don't have precomputed hashes for all passwords 24 characters and under that contain numbers and symbols.

I mean, even with just letters, you're looking at 620448401733239439360000 hashes required. x 128 / 8 bytes, you're looking at ~ 9000 zettabytes. So, a few order of magnitude larger than the entire internet.

If you have a strong password, it's not comparable. In scenario one the server has the password immediately. In scenario two, it would require the heat death of the universe to precompute the hash to find out the password.

Re: My bank keeps on undermining anti-phishing education

#260

Post by devilbunny »

OkayPhysicist wrote: post #112
microtonal wrote: post #63

Earlier quoted context omitted.

One of my former banks handled this pretty well. They called you and would say something like “there is an issue, but since you should never trust a direct phone call pretending to be your bank, please look up our number on our website and call us”. It’s kinda nice because while doing this, they also educate their customers to never trust such a call and to rely on official information to contact them.

My credit union does the same but with "call the number on the back of your card". I suppose they have a lot of practice getting it right, given that their idea of a suspicious transaction is any transaction out of state.

> any transaction out of state

I am assuming card-present transactions? Because I order things from all over, not just locally.

I do appreciate the fraud protection but authorizing my ATM card for non-US withdrawals is overly specific and extremely annoying and time-consuming. Plans change? Expect to spend 15-20 minutes on the phone to say “yes, I will be in Portugal for one extra day”.

Post reply on HN