Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

South Korea’s online security dead end

palant.info

Post reply on HN
Print view View original

51–60 of 144 posts

Re: South Korea’s online security dead end

#51

Post by pessimizer »

userbinator wrote: post #39
r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

For example, the issue of password leakage due to a keylogger installed on a user's PC is considered to be a bank problem, not a user problem. In other words, they're authoritarians at heart. They want complete control over the environment and don't want users to have any personal responsibility.

In non-authoritarian countries like the US, the users are responsible for all of the bank's losses.

Re: South Korea’s online security dead end

#52

Post by nibbleshifter »

10 years ago for work we assessed a similar client side software solution (a "secure browsing" pile of ActiveX and C++) for protecting banking sites users.

Absolute steaming garbage.

Its "anti keylogging" functionality could be bypassed trivially, as could its various screen hijacking tricks designed to defeat some methods used by the banking trojans that were common at the time.

I see that snake oil industry lives on in Korea :/

Very excited to see the results of OP's work (the disclosures).

Re: South Korea’s online security dead end

#53

Post by flotzam »

veeti wrote: post #46
flotzam wrote: post #37

Earlier quoted context omitted.

There's a curious absence of Korean banking apps on this GrapheneOS compatibility list: https://privsec.dev/posts/android/banking-applications-compa... Does it mean none are usable on a modern clean Android? Or is there a total Samsung monoculture? Something else?

No one uses GrapheneOS in Korea?

Could be, but why? Pixels aren't officially available in Korea, but that banking app compatibility list has user reports from 19 other unofficial countries.

Re: South Korea’s online security dead end

#54

Post by mikem170 »

wmf wrote: post #19
gred wrote: post #9

Very interesting read. I'm looking forward to the details in the followups (1/9, 1/23, 3/6). However, I'm surprised that there are no KR banks who build their reputation on their technical acuity and who have eliminated (or avoided) reliance on these types of applications. The markets I'm familiar with tend to have a few banks who have a reputation for good websites, good apps, etc. Or perhaps that bit of context was…

Are there any US banks that are actually secure? AFAIK they're all using SMS 2FA or worse.

Schwab has hardware security tokens for the asking. I have one. Similar to the six digit rsa tokens I used at work (but without the rsa token bug from some years ago). It is my understanding they also support software tokens. I'm a happy customer.

https://www.schwab.com/help/two-factor-authentication

Re: South Korea’s online security dead end

#55

Post by rippercushions »

ronsor wrote: post #47
Roark66 wrote: post #29

Oh boy... Once I saw this: >This starts with a simple fact: some of these applications are written in the C programming language, not even C++. I had to stop reading and come here to see if anyone else got annoyed by it. Seriously? "not even c++" are we still in 1990s?

Linux is written in C. Much of its basic userland is also written in C, including any graphical subsystems such as X11/Wayland.

Writing the critical parts of a OS kernel in C is sensible. Browser extensions, not so much.

As the author notes, they're not just being snobby about languages, the main issue with C from a security POV is the total lack of memory safety and the consequent vulnerability to buffer overflows.

Re: South Korea’s online security dead end

#56

Post by cameronh90 »

r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

In the UK, the bank is also usually responsible for any unauthorised transfer, yet our banks are generally quite digitally enabled.

Some banks solve the transfer authorization issue using an external bit of hardware that you type the transaction details into and it gives you a signature OTP.

Re: South Korea’s online security dead end

#57

Post by int_19h »

Roark66 wrote: post #29

Oh boy... Once I saw this: >This starts with a simple fact: some of these applications are written in the C programming language, not even C++. I had to stop reading and come here to see if anyone else got annoyed by it. Seriously? "not even c++" are we still in 1990s?

Got annoyed by what? Idiomatic C++ is safer than idiomatic C, whether the 90s or today (if anything, the gap is wider today).

Re: South Korea’s online security dead end

#58

Post by yieldcrv »

userbinator wrote: post #39
r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

For example, the issue of password leakage due to a keylogger installed on a user's PC is considered to be a bank problem, not a user problem. In other words, they're authoritarians at heart. They want complete control over the environment and don't want users to have any personal responsibility.

hard to shake that off

Re: South Korea’s online security dead end

#59

Post by MBCook »

kragen wrote: post #35
r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

this is a cautionary tale for people who hope that government regulation will solve the current computer security disaster outside korea you cannot solve problems by giving authority to people who are motivated to solve them, but do not understand what the problem is, so that they can tell the people who do understand the problem what to do anyone who has dealt with pci-dss presumably knows this but that is a much sm…

Isn’t this an issue of mandating the means and not the ends?

If the regulations said banks had to be secure by ‘taking all due care’ and follow ‘best practices’ and such, this wouldn’t be such an issue. That gives room for improvements and for problematic standards to be weeded out over time.

It sounds like the government instead said banks had to be secure by using (for example) SSL 1.0 with a 64-bit key. Because the specified the exact how, that’s what banks did. And when that how was broken the law wasn’t changed, so banks still do the old thing.

And when the old thing (Active-X) stopped working they invented new ways to do the old thing with local proxies. Because the law says they must and are safe if they do.

This is the danger of legislating an exact how. It may be the right thing sometimes, but it can also go sideways.

Post reply on HN