| View previous topic :: View next topic |
| Author |
Message |
Leonardo.b
Guru
Joined: 10 Oct 2020
Posts: 302
|
 Posted: Sat Dec 16, 2023 11:35 am Post subject: Online banking |
 |
|
Almost any online bank requires a smartphone and a proprietary client.
I don't think an Apple or Google smartphone is a secure place to manage moneys.
How do you do? |
|
| Back to top |
|
 |
szatox
Advocate
Joined: 27 Aug 2013
Posts: 3188
|
| Posted: Sat Dec 16, 2023 12:29 pm Post subject: |
|
|
Dunno, my on-line access works just fine in a web browser with a spoofed user agent, and SMS confirmations do not require the phone to be very smart either.
Some other people I know (with a different bank) still use one-time passwords from scratch cards like 20 years ago. However, that bank also charges absurd transaction fees like 20 years ago.
> I don't think an Apple or Google smartphone is a secure place to manage moneys.
Your bank is not a secure place to manage money either. I don't care which bank is it. With AML laws in place your money in a bank is not really your money anymore, since the bank can just refuse to process a transaction or block your access.
Also, if you pay with a card, it's not your money either: it's not you, "the owner", making a payment; its the shop asking for your money and the bank honoring it. This system is just backwards. |
|
| Back to top |
|
|
Leonardo.b
Guru
Joined: 10 Oct 2020
Posts: 302
|
| Posted: Sat Dec 16, 2023 1:35 pm Post subject: |
|
|
I hope we won't evolve to a model similar to China, where payments are performed using messaging app.
Here in Italy cash is the preferred payment method, but European regulation are pushing to incentivate card payments.
I don't know about finance regulations, but I don't know any reliable alternative to banks. |
|
| Back to top |
|
|
Goverp
Advocate
Joined: 07 Mar 2007
Posts: 2023
|
| Posted: Sat Dec 16, 2023 3:23 pm Post subject: |
|
|
A friend of mine who is a security expert reckons the safest place to do online banking is from your bank's app on your smartphone. That's because it won't (or maybe shouldn't) be running Javascript in a web browser, which is what you'd be using on a PC. Also, your phone is probably unlocked by fingerprint, and your bank's app will also use fingerprints. I don't rate unlocking by face in the same league, though if the phone unlocks by face and the app by fingerprint, that probably counts as two-factor authentication in itself.
_________________
Greybeard |
|
| Back to top |
|
|
szatox
Advocate
Joined: 27 Aug 2013
Posts: 3188
|
| Posted: Sat Dec 16, 2023 5:52 pm Post subject: |
|
|
| Quote: | | Also, your phone is probably unlocked by fingerprint, and your bank's app will also use fingerprints. |
Let me quote an article from (apparently) March 31, 2008, a bit over 15 years ago https://www.datamation.com/open-source/the-bad-guys-will-cut-off-your-fingers/
| Quote: | This could be made into a party game–how many holes can you poke in this “security” scheme in 30 seconds? Ready? Start:
1 How hard do they work to verify identity when customers sign up the first time?
2 It’s easy to forge a fingerprint
3 Once it’s compromised, how many more fingers can you grow?
4 What sort of ninjas are storing and protecting the scans?
5 Overworked, underpaid, undertrained retail clerks are just the people you want on the security front lines
6 The bad guys will cut off your fingers |
Yeah... I'd rather use a hardware OTP token instead of fingerprint.
In the meantime, it's easier to compromise a bank's employee than the webinterface. Like that incident last summer, when one dude got slapped with a roughly $0.5mln fine by mistake. And since it was a mistake, there was no paper trail of the fine, and no procedure to cancel it. Good job, bank, good job. |
|
| Back to top |
|
|
Spanik
l33t
Joined: 12 Dec 2003
Posts: 963
Location: Belgium
|
| Posted: Sat Dec 16, 2023 8:38 pm Post subject: |
|
|
| szatox wrote: | | Dunno, my on-line access works just fine in a web browser with a spoofed user agent, and SMS confirmations do not require the phone to be very smart either. |
Same here, web access works fine, don't even have to spoof anything and and a card and a code-reader to set up the connection and confirm transactions. I never let the webbrowser have any passwords that are used for more than a forum, so I certainly doesn't store my cardnumber there. I type in the webpage each and every time.
It is true that I have never seen any bank publish external certification of their online portals or apps. But even then I have far less confidence in contactless payments.
_________________
Expert in non-working solutions |
|
| Back to top |
|
|
Goverp
Advocate
Joined: 07 Mar 2007
Posts: 2023
|
| Posted: Sat Dec 16, 2023 10:17 pm Post subject: |
|
|
| szatox wrote: | ...
| Quote: | This could be made into a party game–how many holes can you poke in this “security” scheme in 30 seconds? Ready? Start:
1 How hard do they work to verify identity when customers sign up the first time?
2 It’s easy to forge a fingerprint
3 Once it’s compromised, how many more fingers can you grow?
4 What sort of ninjas are storing and protecting the scans?
5 Overworked, underpaid, undertrained retail clerks are just the people you want on the security front lines
6 The bad guys will cut off your fingers |
|
FWIW (it's not worth getting into a fight over this):
1. It's your own account. If you're questioning the banks security, fine, but that question applies no matter what authentication method.
2. Is it? I think that statement needs justifying. And if you mention Gummi Bears, see 6 below.
3. How compromised? People selling fingers, like religious relics? Anyway, I have 7 backups, without taking my socks off.
4. AFAIK, the scan is solely stored (or rather, some one-way encryption of certain significant features of the scan) on your phone.
5. Pardon? What has this to do with fingerprints?
6. AFAIK, readers take precautions against fake or dead fingers. The bad guys will also ask you nicely for your password/Yubikey/whatever token you use.
_________________
Greybeard |
|
| Back to top |
|
|
szatox
Advocate
Joined: 27 Aug 2013
Posts: 3188
|
| Posted: Sun Dec 17, 2023 12:47 pm Post subject: |
|
|
> 1
Fair point, I'll give you that one.
> 2. Is it? I think that statement needs justifying.
> 3. How compromised? People selling fingers, like religious relics? Anyway, I have 7 backups, without taking my socks off.
Hand me a glass, please.
I just got 5 of your 7 backups, thank you.
> 4. AFAIK, the scan is solely stored (or rather, some one-way encryption of certain significant features of the scan) on your phone.
Yes, yes, a JPEG is definitely one-way, but it's not encryption, even if you crank the compression up to 11.
For all intents and purposes it is a scan. Discarding the canvas and transforming pixels into a geometric mesh of significant features does not make it "not a scan"; it's just a marketing mumbo-jumbo used to misdirect attention from substance to the brand new form.
> 5. Pardon? What has this to do with fingerprints?
It's biometric data, and to make things worse we tend to leave a trail of those literally everywhere we go.
How can it be exploited? I don't know. In what ways will it be exploitable in 20 years? I don't know either, but I wouldn't assume you'll get an option to un-register yourself from whoever gets access to those things once we figure it out.
> 6. AFAIK, readers take precautions against fake or dead fingers.
You sure? Manufacturers not taking precautions, part 1581: https://youtu.be/q-qN-zC0ylk?t=49
Maybe in some top-security facilities... Maybe.
> The bad guys will also ask you nicely for your password/Yubikey/whatever token you use
At least I get to keep my fingers. A yubikey is much easier to replace than a finger.
Anyway, going back to banking... I heard there is a growing alternative economy around monero. Which is not perfect, because it _requires_ the internet, but if it could actually be used for buying stuff rather than just holding onto your savings until a greater fool appears, it would be an interesting option.
The critical part is that crypto must be decentralized and independent of banks; if CBDC replaces the other payment methods, we're screwed. |
|
| Back to top |
|
|
NeddySeagoon
Administrator
Joined: 05 Jul 2003
Posts: 54421
Location: 56N 3W
|
| Posted: Sun Dec 17, 2023 12:56 pm Post subject: |
|
|
Being an old fart, my fingerprints have faded to the point where my phone won't detect them.
Thats a feature of old fingers.
My bank is pushing the long discredited OTP over SMS or their own smartphone app.
They still support TOTP with a card reader, which is my personal preference.
Trusting a smartphone and/or app is dumb. As yet, there is no real separation between the phone operating system and everything else.
That's on the horizon, so you could soon have Android for the phone and Linux for the useful stuff.
I suspect that some of this 'security' is just window dressing too.
Is your bank going to tell you if millions of accounts were compromised because of a bug in their app?
I suspect that it will be hushed up and they will take the hit.
_________________
Regards,
NeddySeagoon
Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail. |
|
| Back to top |
|
|
pa4wdh
l33t
Joined: 16 Dec 2005
Posts: 815
|
| Posted: Sun Dec 17, 2023 6:38 pm Post subject: Re: Online banking |
|
|
| Leonardo.b wrote: | Almost any online bank requires a smartphone and a proprietary client.
I don't think an Apple or Google smartphone is a secure place to manage moneys.
How do you do? |
I agree with the statement that a smartphone isn't a secure place, that's why i don't  .
Basically there are 3 options:
1) Websites. Most of them feature trackers, even in the personal pages. That's why i don't use them. The other problem is authentication and account setup, for which most banks require an app which is only available for iOS and android.
2) Apps. Often only available for iOS and android and i have neither of them (SailfishOS FTW ). Since those platforms make privacy look like a thing of the past i have no intention to buy one.
3) Paperwork. Yes, some banks still allow you to do whatever you want to do with paper send via snailmail. This is actually what i do because in my opinion the internet is not a safe place for banking.
_________________
The gentoo way of bringing peace to the world:
USE="-war" emerge --newuse @world
My shared code repository: https://code.pa4wdh.nl.eu.org
Music, Free as in Freedom: https://www.jamendo.com |
|
| Back to top |
|
|
Ralphred
Guru
Joined: 31 Dec 2013
Posts: 510
|
| Posted: Sun Dec 17, 2023 6:55 pm Post subject: |
|
|
| szatox wrote: | > 3. How compromised? People selling fingers, like religious relics? Anyway, I have 7 backups, without taking my socks off.
Hand me a glass, please.
I just got 5 of your 7 backups, thank you. |
As someone who has worked with bio-metric security for over 20 years: It's a risk shifting exercise, it moves the risk to the individual away from the "institute", especially in a non-controlled environment (like on a smart phone). With fingerprint readers, unless it does O2 level and pulse detection, don't enrol. The general rule of thumb (no pun intended) is not to let any part of your body have value to anyone other than yourself.
Passive security is always a trade of against usability, so if something gets "easier" to use you have to ask where the risk has been moved to. |
|
| Back to top |
|
|
mrbassie
l33t
Joined: 31 May 2013
Posts: 795
Location: over here
|
| Posted: Mon Dec 18, 2023 6:19 pm Post subject: |
|
|
| Leonardo.b wrote: | | I hope we won't evolve to a model similar to China |
Already have.
_________________
Bus conductors learned to code. |
|
| Back to top |
|
|
Spanik
l33t
Joined: 12 Dec 2003
Posts: 963
Location: Belgium
|
| Posted: Mon Dec 18, 2023 8:04 pm Post subject: |
|
|
| Ralphred wrote: | As someone who has worked with bio-metric security for over 20 years: It's a risk shifting exercise, it moves the risk to the individual away from the "institute", especially in a non-controlled environment (like on a smart phone). With fingerprint readers, unless it does O2 level and pulse detection, don't enrol. The general rule of thumb (no pun intended) is not to let any part of your body have value to anyone other than yourself.
Passive security is always a trade of against usability, so if something gets "easier" to use you have to ask where the risk has been moved to. |
Very well said. They just shift the blame on you because it is YOUR fingerprint so nobody else can have done the transaction. However lousy the rest of the software behind the transaction is. And that is an issue with any bio-metrics. That and the fact you cannot get another one if one is compromised. Add to that that bio-metrics are NOT unique, whatever those experts toting it might want you to believe.
_________________
Expert in non-working solutions |
|
| Back to top |
|
|
sitquietly
Tux's lil' helper
Joined: 23 Oct 2010
Posts: 143
Location: On the Wolf River, Tennessee
|
| Posted: Tue Dec 19, 2023 4:57 am Post subject: Re: Online banking |
|
|
| Leonardo.b wrote: | | Almost any online bank requires a smartphone ... |
I don't even have a smartphone. I use a flip phone (with mechanical buttons!) for telephone calls and do online banking online in my web browser (when I log in the bank warns me that I am using "an unsupported browser"). |
|
| Back to top |
|
|
djdunn
l33t
Joined: 26 Dec 2004
Posts: 810
|
| Posted: Wed Dec 20, 2023 4:28 am Post subject: |
|
|
smartphone or website, the android app is kinda different, but website works all the same and usually has more features
_________________
“Music is a moral law. It gives a soul to the Universe, wings to the mind, flight to the imagination, a charm to sadness, gaiety and life to everything. It is the essence of order, and leads to all that is good and just and beautiful.”
― Plato |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Gentoo Chat
