Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

South Korea’s online security dead end

palant.info

Post reply on HN
Print view View original

91–100 of 144 posts

Re: South Korea’s online security dead end

#91

Post by gruez »

ravel-bar-foo wrote: post #45
r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

It is worth mentioning that to make a bank transfer in Korea (used to[1]) require 3 factor authentication: the user's website password, the user's PIN, the user's encryption certificate signature/공인인증서, and two randomly selected codes from a paper numbers card (보안카드: https://file2.nocutnews.co.kr/newsroom/image/2013/07/02/2013... ), which users are instructed to never copy or digitize. Of all these solutions, the num…

>Of all these solutions, the numbers card gives me the most peace of mind: even if my machine is fully compromised and all my passwords and certificates stolen, the attacker would likely need very long-term access (or access to the bank's server) to get all 35 numbers from the card

I think you're overestimating how much security this provides and missing a very simple workaround: the attacker can simply wait until you preform a transfer, and then replace the intended recipient detail with theirs. For instance, if alice was sending funds to bob, and the attacker controls the machine, they can simply replace the recipient to malory, while still displaying bob to the user.

Re: South Korea’s online security dead end

#92

Post by likecarter »

kragen wrote: post #82
likecarter wrote: post #81

Earlier quoted context omitted.

In court, you bring in experts (usually professors from reputable universities) to state best practices. Judges don't act as experts in a trial.

judges decide who counts as experts, and doing that correctly requires expertise this is why so many people get convicted on the basis of pseudoscience like lie detector tests and tracy harpster's 911 call analysis https://www.propublica.org/article/911-call-analysis-fbi-pol... it would not be especially difficult to find a professor from a reputable university who would explain that using dynamically typed languages…

That's why both sides get experts.

Your reasoning is extremely reductive – I can't tell if you're just trying to win an argument here. You could say people will be misleading about anything. Your doctor, the police, the DMV clerk. At some point, you have to recognize you live in a society, and society is built on some level of trust and fairness.

Re: South Korea’s online security dead end

#93

Post by kragen »

likecarter wrote: post #92
kragen wrote: post #82

Earlier quoted context omitted.

judges decide who counts as experts, and doing that correctly requires expertise this is why so many people get convicted on the basis of pseudoscience like lie detector tests and tracy harpster's 911 call analysis https://www.propublica.org/article/911-call-analysis-fbi-pol... it would not be especially difficult to find a professor from a reputable university who would explain that using dynamically typed languages…

That's why both sides get experts. Your reasoning is extremely reductive – I can't tell if you're just trying to win an argument here. You could say people will be misleading about anything. Your doctor, the police, the DMV clerk. At some point, you have to recognize you live in a society, and society is built on some level of trust and fairness.

[flagged]

Re: South Korea’s online security dead end

#94

Post by curling_grad »

varenc wrote: post #68

I poked around the install page for Citibank's required software and it's pretty fascinating: https://www.citibank.co.kr/CusSecnCnts0100.act?P_name=ASTx Some quick observations: - That page intentionally disables right-click! Just by putting `oncontextmenu="return false"` on the tag. This gives me flashbacks to the late 90s when this technique was used to make it harder for users to copy images or inspect HTML source…

Disabling right click is kind of a Korean web tradition. Almost every dated websites (including personal blogs) have done that.

Re: South Korea’s online security dead end

#95

Post by WiSaGaN »

physicles wrote: post #11

This mirrors the situation in China, likely for similar reasons. To this day, I can only do online banking with Internet Explorer 11. When logging in, of course the password field doesn't permit pasting. I have a couple ActiveX controls and certs installed, but I've forgotten which ones so I'll just have to keep that old laptop around. The one bright spot is that large transactions do require a USB dongle. At least o…

Maybe 5 years ago, but now nobody uses web-based online banking any more in China. Most banks have decent mobile apps now, which have much better usability than the web-based ones. The IE situation is irrelevant now.

Re: South Korea’s online security dead end

#96

Post by Kamq »

rippercushions wrote: post #55
ronsor wrote: post #47

Earlier quoted context omitted.

Linux is written in C. Much of its basic userland is also written in C, including any graphical subsystems such as X11/Wayland.

Writing the critical parts of a OS kernel in C is sensible. Browser extensions, not so much. As the author notes, they're not just being snobby about languages, the main issue with C from a security POV is the total lack of memory safety and the consequent vulnerability to buffer overflows.

> the main issue with C from a security POV is the total lack of memory safety and the consequent vulnerability to buffer overflows.

Sure, but C++ also has these issues, so the "not even C++" doesn't exactly make sense.

Re: South Korea’s online security dead end

#97

Post by beebmam »

kragen wrote: post #35
r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

this is a cautionary tale for people who hope that government regulation will solve the current computer security disaster outside korea you cannot solve problems by giving authority to people who are motivated to solve them, but do not understand what the problem is, so that they can tell the people who do understand the problem what to do anyone who has dealt with pci-dss presumably knows this but that is a much sm…

Isn't that exactly the position that tech executives are in?

Re: South Korea’s online security dead end

#98

Post by est »

PradeetPatel wrote: post #64
thorncorona wrote: post #48

Earlier quoted context omitted.

AliPay is 3rd party?

It has been established that large private enterprises in China have connections with the Communist Party of China, aka the government.

Spoiler alert: all major Chinese banks are controlled by CCP anyway. They don't even need a "browser plugin" if they really want to expose you.

Re: South Korea’s online security dead end

#99

Post by ZekeSulastin »

mikem170 wrote: post #54
wmf wrote: post #19

Earlier quoted context omitted.

Are there any US banks that are actually secure? AFAIK they're all using SMS 2FA or worse.

Schwab has hardware security tokens for the asking. I have one. Similar to the six digit rsa tokens I used at work (but without the rsa token bug from some years ago). It is my understanding they also support software tokens. I'm a happy customer. https://www.schwab.com/help/two-factor-authentication

They do support software tokens - I use that method - but it’s a bit of a pain[1] if you want to use a TOTP program other than Symantec :(

1: https://news.ycombinator.com/item?id=28231146

Re: South Korea’s online security dead end

#100

Post by smsm42 »

> Nowadays, a typical Korean banking website will require five security applications to be installed before you are allowed to log in

Note to self: never move to Korea. Or at least never use Korean bank (can you survive on cash and Bitcoin?)

Post reply on HN