Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I accidentally loaned all my money to the US government

beanlog.vercel.app

Post reply on HN
Print view View original

301–310 of 512 posts

Re: I accidentally loaned all my money to the US government

#301

Post by onlyrealcuzzo »

cortesoft wrote: post #270
Jenk wrote: post #76

Earlier quoted context omitted.

There is a strange human phenomenon, particularly visible online. Some folk see a title like that and it triggers a "How can I blame the author?" urge within before they even open the link.

This happens whenever something bad happens to someone else, be it a car accident or a major illness or being the victim of a crime. People want to think it wouldn’t happen to them, so they go through all the reasons they would have been able to avoid the situation so that they don’t have to fear it happening to them. People really don’t want to admit to themselves that there are a lot of things outside our control t…

That's mostly because people in good circumstances are usually reluctant to attribute much of it to luck.

It's so much more fun to pretend that everything good that's happened to you, you earned and deserved, rather than a lot of it just being random noise that compounded in the fortunate direction.

Re: I accidentally loaned all my money to the US government

#302

Post by omaranto »

I was (pleasantly) surprised to see that the analogous website for Mexico, where you buy government-issued bonds called Cetes, is significantly less confusing to use. That is not at all what I expect when comparing government websites between my native Mexico and the US! (Paying taxes is another example of something with much, much better UI/UX in Mexico, but there probably are not many other examples.)

Also, the refunds for Cetes when you go over the limit take a few days, not 8 to 10 weeks.

Re: I accidentally loaned all my money to the US government

#303

Post by jcrawfordor »

Someone1234 wrote: post #183
jefftk wrote: post #62

> They require you to enter your password by clicking on a virtual keyboard. This pseudo-security measure actually only slows down humans, not bots, because you can still edit the value of the text field using Javascript. I don't think this is generally worth it as a security measure, but the goal is not to protect against automation. Instead, custom on-screen keyboards are attempts to thwart keyloggers.

> Instead, custom on-screen keyboards are attempts to thwart keyloggers. Commercial malware doesn't work this way. The term "keylogger" is a misnomer. "Keylogging" without context provides an unintelligible stream of garbage that might have well be from a random number generator. Most malware that I've seen either directly target the browser or the operating system, but in both cases they're looking for an unencrypte…

There's a surprising amount of malware out there that still actually captures keyboard input and nothing else. It's easier and more reliable to implement, especially in a malware context, and is usually plenty enough to extract what the operator wants (usually usernames and passwords for online banking). When additional context is collected it's often in the form of window titles. A lot of tools now gather screenshots and even better on-click screenshots, which defeat this type of on-screen keyboard device and is the main reason it's fallen out of use.

And yes, there is malware that collects unencrypted traffic, but that is _appreciably_ more complex to design and implement than simple keylogging. There's also malware which pulls credentials directly out of the web browser memory, although improved protections on cross-process memory access are making this much harder to do on real operating systems. Both of these are better methods, but they are harder and operating systems are intentionally implementing measure to defeat them. For mostly historic reasons straightforward keylogging remains easy and reliable on modern computers.

Re: I accidentally loaned all my money to the US government

#305

Post by jcrawfordor »

jrimbault wrote: post #88
jefftk wrote: post #62

> They require you to enter your password by clicking on a virtual keyboard. This pseudo-security measure actually only slows down humans, not bots, because you can still edit the value of the text field using Javascript. I don't think this is generally worth it as a security measure, but the goal is not to protect against automation. Instead, custom on-screen keyboards are attempts to thwart keyloggers.

But if there's a keylogger installed, why would the same keylogger not take regular screenshots ?

there are indeed keyloggers that do this, but it wasn't common in the early 2000s when most of these on-screen keyboard setups were implemented.

Re: I accidentally loaned all my money to the US government

#306

Post by mindslight »

Someone1234 wrote: post #183
jefftk wrote: post #62

> They require you to enter your password by clicking on a virtual keyboard. This pseudo-security measure actually only slows down humans, not bots, because you can still edit the value of the text field using Javascript. I don't think this is generally worth it as a security measure, but the goal is not to protect against automation. Instead, custom on-screen keyboards are attempts to thwart keyloggers.

> Instead, custom on-screen keyboards are attempts to thwart keyloggers. Commercial malware doesn't work this way. The term "keylogger" is a misnomer. "Keylogging" without context provides an unintelligible stream of garbage that might have well be from a random number generator. Most malware that I've seen either directly target the browser or the operating system, but in both cases they're looking for an unencrypte…

Thank you for the general explanation of the state of the art, which makes a lot of sense if one thinks about it.

But it doesn't really refute the kind of snapshot-in-time voodoo that government websites tend to build out and then never change because if doing so were to cause a problem, then someone could get blamed. I've never seen such a UI contraption in the "private" sector of banking. Not that they don't have their own obtuse slow moving corporate bullshit like snake oil "2FA" with varying requirements, it's just less bad.

FWIW related to this topic does anyone know the details of how the IRS website just decides to spit out "Permission Denied" when trying to obtain an EIN? I think it's an Akamai? message, probably due to some user surveillance garbage, but haven't investigated further. Even coming from my own naive residential IP with surveillance-friendly Chromium I still got it. I figured I'd wait a few days and try again, but same thing. It worked fine from a vanilla iPhone on the cell connection, but unfortunately I ended up doing that too late and missed the window to lock in April's rate.

Re: I accidentally loaned all my money to the US government

#307

Post by throwoutway »

xkbarkar wrote: post #69

I thought this was funny. Weird comments in the thread about how he/she should have known better. Author is not making a complaint to demand internet outrage. There is no inflammatory justice warrior content here. Sheesh! Author admits they screwed up, decided to share the screwup, and who hasnt been trough that exact dunder blunder? Fun short read 8/10.

I agree. The ending paragraph was truly funny writing with subtle self-deprecation that I appreciate. I laughed out loud for the first time this weekend

Re: I accidentally loaned all my money to the US government

#308

Post by jaimehrubiks »

I've been in the US for 4 years and it seems like the government is just like a computer that you cannot talk to or get issues fixed somehow. It's like, if something goes wrong you're fucked. If USPS loses your documents or even your car's title, or your immigration approval notice, you're fucked, you might need to wait 2 months, or 6, or 8, and nobody cares, nobody will help you. There's no one that can help you.

At least that's how I feel here.

Re: I accidentally loaned all my money to the US government

#309

Post by hanoz »

tzs wrote: post #165
hanoz wrote: post #9

Er, what? Surely he's got the wrong end of the stick and they'll be refunding the excess $25 of his second purchase, (and now the entire $9975 of his superfluous third).

It's not obvious. In general if you attempt to purchase a certain amount or quantity of some item and for some reason it is only possible for them to sell you a smaller amount of that item, with some items a smaller amount will be acceptable to you and with some items a smaller amount is not acceptable. If the first case delivering the smaller amount and refunding the overpayment would be what the customer would want…

It's entirely obvious which is the desired option if the refund time is 10 weeks and the application is for, in the author's words, "free money".

Re: I accidentally loaned all my money to the US government

#310

Post by Tijdreiziger »

jefftk wrote: post #200
Someone1234 wrote: post #183

Earlier quoted context omitted.

> Instead, custom on-screen keyboards are attempts to thwart keyloggers. Commercial malware doesn't work this way. The term "keylogger" is a misnomer. "Keylogging" without context provides an unintelligible stream of garbage that might have well be from a random number generator. Most malware that I've seen either directly target the browser or the operating system, but in both cases they're looking for an unencrypte…

Are you saying you wouldn't be concerned if you found one of these on your computer? https://www.keelog.com/

Wait -- so that website sells keyloggers and, uh, Commodore 64 power supplies? Talk about diversification!
Post reply on HN