 |
|
|
|
|
|
| |
| |
|
|
|
|
| |
| |
|
|
I always thought having executable code downloaded to your UI was a bad
idea. I wonder how long it will be before the general public figures out
you need ACLs with programs as principles as well as people.
http://news.cnet.com/8301-27080_3-10363836-245.html?tag=newsLeadStoriesArea.1
--
Darren New, San Diego CA, USA (PST)
I ordered stamps from Zazzle that read "Place Stamp Here".
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Darren New wrote:
> I always thought having executable code downloaded to your UI was a bad
> idea. I wonder how long it will be before the general public figures
> out you need ACLs with programs as principles as well as people.
There was a reference in the article (linked in OP) to a known exploit
in IE, FF, and Opera. While MS has needed a smack on the head for its
ongoing love affair with unsafe features, the people who make FF and
Opera need a double-smack. Their alleged superior security is a large
part of the reason that people use them.
Regards,
John
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
John VanSickle wrote:
> Their alleged superior security is a large
> part of the reason that people use them.
Given the article talks about getting executables by email, I suspect it's
either hooking the IP stack or installing a local proxy server to rewrite
code on the fly. I don't imagine it's actually breaking into the browser as
such.
That said, having executable code in your UI specification is still a bad idea.
--
Darren New, San Diego CA, USA (PST)
I ordered stamps from Zazzle that read "Place Stamp Here".
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
John VanSickle <evi### [at] hotmail com> wrote:
> There was a reference in the article (linked in OP) to a known exploit
> in IE, FF, and Opera. While MS has needed a smack on the head for its
> ongoing love affair with unsafe features, the people who make FF and
> Opera need a double-smack. Their alleged superior security is a large
> part of the reason that people use them.
Just because the article says that you are vulnerable to the exploit even
if you are using Firefox or Opera, that doesn't mean that it's the browser
itself which has been compromised. It may be the OS which has been
compromised.
Just as an example, if a trojan installs a keylogger in the system which
sends private information to someone, including eg. things you write in
secure webforms with Firefox, does that mean that it's Firefox which has
been compromised?
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
> I always thought having executable code downloaded to your UI was a bad
> idea. I wonder how long it will be before the general public figures out
> you need ACLs with programs as principles as well as people.
>
>
> http://news.cnet.com/8301-27080_3-10363836-245.html?tag=newsLeadStoriesArea.1
I don't see how that would work for most German banks, as before a
transaction is made you need to enter a special code from a use-once list
that is provided from your bank. AFAIK there isn't a way to automatically
generate that number, the user would have to be prompted for it, which would
arouse suspicion as they're only used for transferring money. Maybe there
are one or two banks that don't have this system, but I've never heard of
that.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott wrote:
> I don't see how that would work for most German banks, as before a
> transaction is made you need to enter a special code from a use-once
> list that is provided from your bank.
German banks are smarter. The banks here were supposed to (by recent law)
send out those fobs with the one-time digits on them. Instead they opted for
a second password. No! Two-factor authentication doesn't mean two passwords.
--
Darren New, San Diego CA, USA (PST)
I ordered stamps from Zazzle that read "Place Stamp Here".
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Darren New wrote:
> German banks are smarter. The banks here were supposed to (by recent
> law) send out those fobs with the one-time digits on them. Instead they
> opted for a second password. No! Two-factor authentication doesn't mean
> two passwords.
Epic fail.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Invisible wrote:
> Darren New wrote:
>
>> German banks are smarter. The banks here were supposed to (by recent
>> law) send out those fobs with the one-time digits on them. Instead
>> they opted for a second password. No! Two-factor authentication
>> doesn't mean two passwords.
>
> Epic fail.
Just a business decision. The banks are responsible for the money here. (I
understand in Europe that if someone steals your bank card or credit card,
you actually have to pay off the charges?) It was cheaper to pay off the
losses than to send out fobs to everyone.
--
Darren New, San Diego CA, USA (PST)
I ordered stamps from Zazzle that read "Place Stamp Here".
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> I don't see how that would work for most German banks, as before a
>> transaction is made you need to enter a special code from a use-once list
>> that is provided from your bank.
>
> German banks are smarter. The banks here were supposed to (by recent law)
> send out those fobs with the one-time digits on them.
I have a small gizmo for my UK bank, I put my normal ATM card into it, then
type in a code provided by the website, then get given back a code that I
enter into the website to authorise the transfer.
Both that system and the German system are a little inconvenient, because
you always need to have something extra with you to make a transfer. Still
better than the inconvenience of not being able to buy anything because
someone has stolen all your money :-)
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott wrote:
> because you always need to have something extra with you to make a
> transfer.
That is precisely why it's called "two-factor authentication." The problem
with having only a password is that you don't know when it has been stolen.
Hence the whole "change your password every 2 weeks" kind of thing.
--
Darren New, San Diego CA, USA (PST)
I ordered stamps from Zazzle that read "Place Stamp Here".
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott <sco### [at] scottcom> wrote:
> I don't see how that would work for most German banks, as before a
> transaction is made you need to enter a special code from a use-once list
> that is provided from your bank.
Here not only that, but even if you used the online bank at a public
computer (you shouldn't, of course, but if) and even if for whatever reason
you forget to log out, the next user could see your bank details (how much
money you have, etc) but he wouldn't be able to transfer any money anywhere
without the code card.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
> (I understand in Europe that if someone steals your bank card or credit
> card, you actually have to pay off the charges?)
Never heard of that, it's happened to me a few times and I just phoned them
up and told them it wasn't me. Each time they just cancelled the amount and
sent me a new card. Credit card companies especially make plenty of money
by charging people ridiculous interest rates if they don't pay off the
balance, they can more than cover what they lose...
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
> Here not only that, but even if you used the online bank at a public
> computer (you shouldn't, of course, but if) and even if for whatever
> reason
> you forget to log out, the next user could see your bank details (how much
> money you have, etc) but he wouldn't be able to transfer any money
> anywhere
> without the code card.
Hehe, in Germany you can then just go to amanzon.de (or most other German
websites) and use their bank account info to buy stuff. It's unbelievable
to me how that is possible, but it seems not many people abuse this system.
Also once you have given your bank details to a 3rd party to take money from
your account (eg a mobile phone contract) it is then impossible (AFAIK) to
prevent them taking money (eg if you cancelled the contract). In the UK at
least you have to first authorise such agreements, and can cancel them at
any time at the click of a button, which makes it impossible for them to
take the money.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott wrote:
>> (I understand in Europe that if someone steals your bank card or
>> credit card, you actually have to pay off the charges?)
>
> Never heard of that,
OK. I've heard it, so either things have changed or it's different in
different countries.
--
Darren New, San Diego CA, USA (PST)
I ordered stamps from Zazzle that read "Place Stamp Here".
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott wrote:
> Also once you have given your bank details to a 3rd
> party to take money from your account (eg a mobile phone contract) it is
> then impossible (AFAIK) to prevent them taking money (eg if you
> cancelled the contract).
I think that's what I was talking about. People are very protective of their
bank details, where in the US, you need to authorize the withdraw in writing.
--
Darren New, San Diego CA, USA (PST)
I ordered stamps from Zazzle that read "Place Stamp Here".
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Darren New <dne### [at] sanrrcom> wrote:
> I think that's what I was talking about. People are very protective of their
> bank details, where in the US, you need to authorize the withdraw in writing.
I don't really understand why giving your bank details to someone would
be in any way dangerous. It's not like they could withdraw money by simply
knowing your account number.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Warp wrote:
> It's not like they could withdraw money by simply
> knowing your account number.
Well, here people are worried about identity theft. (I.e., the ability to
illegally withdraw money without your permission.) I understand that in some
countries the onus is on you to prove the withdraw was illegal.
I.e., in the USA, with a credit card, you have the choice of not paying the
bill until the bank proves you really authorized that transfer. With a debit
card, the money is gone and spent, and it's up to the individual to prove to
the bank that the transfer was *not* authorized, which is a much harder
thing to do, of course. (Hence why I don't own a debit card. :-)
My info may be either out of date or restricted to a small subset of
countries in Europe, or both.
--
Darren New, San Diego CA, USA (PST)
I ordered stamps from Zazzle that read "Place Stamp Here".
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On 5-10-2009 18:06, Warp wrote:
> scott <sco### [at] scottcom> wrote:
>> I don't see how that would work for most German banks, as before a
>> transaction is made you need to enter a special code from a use-once list
>> that is provided from your bank.
>
> Here not only that, but even if you used the online bank at a public
> computer (you shouldn't, of course, but if) and even if for whatever reason
> you forget to log out, the next user could see your bank details (how much
> money you have, etc) but he wouldn't be able to transfer any money anywhere
> without the code card.
>
For comparison: if I make a payment over the internet my bank sends me
an SMS with a 5 digit number to enter. Not logging off is dumb but they
won't be able to transfer money. One of the complications is when you
don't have access to your mobile phone. Then you can not pay a certain
type of bills (at least it is much more difficult and at least involves
changing security settings. I have never need to do that).
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
andrel wrote:
> For comparison: if I make a payment over the internet my bank sends me
> an SMS with a 5 digit number to enter.
Yeah. Here they're relying on the phone company as their authentication
provider. I think both google and facebook allow that too, but that's to
cut down on spam, or some such.
--
Darren New, San Diego CA, USA (PST)
I ordered stamps from Zazzle that read "Place Stamp Here".
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On 6-10-2009 0:10, Darren New wrote:
> andrel wrote:
>> For comparison: if I make a payment over the internet my bank sends me
>> an SMS with a 5 digit number to enter.
>
> Yeah. Here they're relying on the phone company as their authentication
> provider.
Same sort of procedure?
> I think both google and facebook allow that too, but that's
> to cut down on spam, or some such.
How does that work?
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
andrel wrote:
> Same sort of procedure?
They're trusting the phone company to be harder to pervert than your
password. They're trusting that an SMS sent to you is more likely to go to
you than the bad guy breaking in.
>> I think both google and facebook allow that too, but that's to cut
>> down on spam, or some such.
>
> How does that work?
It's been a while, but I think it involves not having to enter a captcha
once you do this once with your cell phone. I.e., you've proven you're a
person (because obviously they're not going to let 300 accounts use the same
cell phone number), so you don't have to reconfirm that this account is a
real person.
--
Darren New, San Diego CA, USA (PST)
I ordered stamps from Zazzle that read "Place Stamp Here".
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On 6-10-2009 0:20, Darren New wrote:
> andrel wrote:
>> Same sort of procedure?
>
> They're trusting the phone company to be harder to pervert than your
> password. They're trusting that an SMS sent to you is more likely to go
> to you than the bad guy breaking in.
Or at least that a bad guy needs to steal your phone *and* to hack your
account. Doing both in a short timespan is significantly less likely
than one of them.
>
>>> I think both google and facebook allow that too, but that's to cut
>>> down on spam, or some such.
>>
>> How does that work?
>
> It's been a while, but I think it involves not having to enter a captcha
> once you do this once with your cell phone. I.e., you've proven you're a
> person (because obviously they're not going to let 300 accounts use the
> same cell phone number), so you don't have to reconfirm that this
> account is a real person.
Makes sense.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
> I don't really understand why giving your bank details to someone would
> be in any way dangerous. It's not like they could withdraw money by simply
> knowing your account number.
In Germany you can buy stuff with just that info on most websites - see
attached screenshot of the amazon.de payment page. The three boxes I
highlighted are to enter your account number, bank code and account name.
Post a reply to this message
Attachments:
Download 'amazon de payment.png' (89 KB)
Preview of image 'amazon de payment.png'
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott <sco### [at] scottcom> wrote:
> [-- text/plain, encoding 7bit, charset: Windows-1252, 9 lines --]
> > I don't really understand why giving your bank details to someone would
> > be in any way dangerous. It's not like they could withdraw money by simply
> > knowing your account number.
> In Germany you can buy stuff with just that info on most websites - see
> attached screenshot of the amazon.de payment page. The three boxes I
> highlighted are to enter your account number, bank code and account name.
How can any bank in the world accept a transfer which a third-party is
requesting, who only has the account number? That sounds absolutely crazy.
People could simply try random account numbers to see if they get lucky.
I understand why that's a necessity with credit cards, but not directly
with bank accounts.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
> How can any bank in the world accept a transfer which a third-party is
> requesting, who only has the account number? That sounds absolutely crazy.
> People could simply try random account numbers to see if they get lucky.
Presumably you need the account name, number and bank code to all match
though, it would be almost impossible to guess those unless you got the data
somehow. But still it seems crazy to me, it's not exactly hard to get such
information.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"scott" <sco### [at] scottcom> wrote:
> > How can any bank in the world accept a transfer which a third-party is
> > requesting, who only has the account number? That sounds absolutely crazy.
> > People could simply try random account numbers to see if they get lucky.
>
> Presumably you need the account name, number and bank code to all match
> though, it would be almost impossible to guess those unless you got the data
> somehow. But still it seems crazy to me, it's not exactly hard to get such
> information.
Well, it's not really that bad. If you find an illegal transaction of this type
on your account you can easily cancel it within I think it's two weeks.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> Presumably you need the account name, number and bank code to all match
>> though, it would be almost impossible to guess those unless you got the
>> data
>> somehow. But still it seems crazy to me, it's not exactly hard to get
>> such
>> information.
>
> Well, it's not really that bad. If you find an illegal transaction of this
> type
> on your account you can easily cancel it within I think it's two weeks.
Only two weeks? I never knew it was that short, I will have to make sure I
check my online banking more regularly in future!
Anyway, do you know who picks up the cost for this - is it the bank or the
website?
But still, I'm surprised more criminals don't totally abuse this system
enough for it to get changed.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
