Bank harrasses user because he tweeted screenshot of their SSL certificate • Hacker News Board

Re: Bank harrasses user because he tweeted screenshot of their SSL certificate

#71

Post by gumby » Sat, Mar 14, 2015, 5:33 AM UTC

madaxe_again wrote: post #53

simi_ wrote: post #15

Earlier quoted context omitted.

https://twitter.com/ansimionescu/status/576425676036780032 I work in security/privacy/premium snake oil trade. Bank security (and software in general) is _usually_ a joke. The main reason for not fucking with a bank is the same why you wouldn't fuck with casinos, or the mob.

I used to write trading software - had test FIX accounts on live cbot, cme, xetra, Liffe, lme, etc. Decided to see if I could still log in to any of them about a year ago. Still could on half of them. I left that gig a decade ago. Oh, and a few of them have no trade limits or risk management. Boggle.

20+ years I had some security discussions with a major exchange in the USA. In the same building were offices of Goldman Sachs and another bank (Morgan or Merril, don't remember). Anyway there was a single thinnet (10base2 ethernet) that connected them to the exchange. Yep, a quick sniff showed that everyone could see everyone else's traffic.

My contacts were genuinely surprised that this was even possible. But also I was told there would be no contract if I mentioned this to upper management in my report.

There was no contract.

Re: Bank harrasses user because he tweeted screenshot of their SSL certificate

#72

Post by K0nserv » Sat, Mar 14, 2015, 7:23 AM UTC

wodenokoto wrote: post #64

madaxe_again wrote: post #52

You're all talking about the bank's response - but I actually think his employer's reaction was worse. Threatening to fire him for a tweet from a personal account? What Kafkaesque bullshit is this? Frankly, I'd be taking them to a tribunal - and I'm an employer. The idea of pulling that kind of shit on anyone fills me with disgust.

"Some guy who is wrong is threatening to beat me up unless I hit you or you change your tweet" It's not like the employer said "you wrote an unfriendly tweet now you are fired!" The bank was threatening the employer with legal action unless action was taken.

But what kind of case could the bank possibly have against his employer of all people? I would think that any sane judge would dismiss that case as completely ridiculous pretty quickly. His employer is just as much at fault for being spineless and not sticking up for their employee who did nothing wrong as the bank is for harassing him.

Re: Bank harrasses user because he tweeted screenshot of their SSL certificate

#73

Post by madaxe_again » Sat, Mar 14, 2015, 7:48 AM UTC

wodenokoto wrote: post #64

madaxe_again wrote: post #52

You're all talking about the bank's response - but I actually think his employer's reaction was worse. Threatening to fire him for a tweet from a personal account? What Kafkaesque bullshit is this? Frankly, I'd be taking them to a tribunal - and I'm an employer. The idea of pulling that kind of shit on anyone fills me with disgust.

"Some guy who is wrong is threatening to beat me up unless I hit you or you change your tweet" It's not like the employer said "you wrote an unfriendly tweet now you are fired!" The bank was threatening the employer with legal action unless action was taken.

Yeah, and any employee with a shred of self respect would tell the bank to go hang. I've had clients complain about what staff say on social media (not about clients or work!), I just tell them it's none of their or my business, and if they really care, get your lawyers in touch.

Nobody has.

Re: Bank harrasses user because he tweeted screenshot of their SSL certificate

#74

Post by some_furry » Sat, Mar 14, 2015, 10:27 PM UTC

marcosdumay wrote: post #70

schoen wrote: post #20

Earlier quoted context omitted.

TLS uses several algorithms, almost always both asymmetric and symmetric algorithms, in every session. For example, my current connection to HN is TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. And that does mean that our underlying session key is 128 bits, independent of the size of HN's public key (which turns out to be 2048 bits). There is a possible argument that a 128-bit AES key and a 2048-bit RSA key are mismatched, b…

Symmetric encryption does not have the concept of a "private key". A 128 bits private key in TLS can only vary from almost useless (if it's some ECC algorithm) to completely useless (in case it's RSA). Too bad (but understandable) that the article does not give any detail. About a decade ago, 128 bits RSA keys were widely used (but not recommended anymore), I wouldn't be surprised to discover a bank didn't change the…

> Symmetric encryption does not have the concept of a "private key".

In the early days of public key cryptography, the NSA referred to it as "non-private key cryptography".

Even today, people often refer to symmetric vs asymmetric and private vs public interchangeably. (Yes, it can cause confusion and you will probably never see professional cryptographers like Bernstein, Green, Lange, Schwabe, Schneier, or Wilcox-O'hearn refer to it that way.)

https://en.wikipedia.org/wiki/Symmetric-key_algorithm#cite_n...

The author had multiple errors; it isn't beyond the limits of intellectual generosity to assume they meant symmetric key instead of private key.

> A 128 bits private key in TLS can only vary from almost useless (if it's some ECC algorithm) to completely useless (in case it's RSA).

128 bit EdDSA would have about the same security as a 64 bit block cipher, which we would consider broken. So I'm in full agreement there.

128 bit RSA? Totally useless.

128 bit AES? Not a concern. Usually you look at the padding, block mode, and authentication instead.