Hot answers tagged

54

A scenario such banks might want to protect you from could be this: you visit your banking website and do your banking stuff. after you are finished you log out and then navigate to some other website to look at cat pictures or whatever. you leave your computer with the cat picture website open. Because there is nothing incriminating on your screen, you ...


36

Why security indicators fail vs. phishing There is no action that can be taken that is economically viable. Put another way, it's too effortful to defend against phishing attacks. See 'So long and no thanks for the externalities' for an example on the US economy and information workers. You are correct that checking for URL correctness is error-prone, and ...


28

I was going to suggest that ensuring that the login screen for the online banking system showed the name of the bank in green, in the address bar might work. But then I started wondering if any of the local banks I know about did that properly. It's less encouraging than I'd hoped. For these nine fairly large banks, 6 provide the name of the bank in the ...


26

There's a couple of things going on here: Bankings sites will use cache-control headers to forbid cacheing of the pages. So when you click back the browser has to reload the page from the server. Some parts of the site may have a strict flow of pages, e.g. you enter transaction details, enter your SMS code, view transaction confirmation. These require ...


13

It's All About the Security Model We see reference to "Checking for jailbroken/rooted device" in nearly all Mobile Application Security Checklists (e.g OWASP). When comparing it to desktops or web browsers we have to keep in mind that they have different threat models. For example on desktop machines when designing an application we already know that there ...


11

The problem isn't with pasting, it's with copying confidential data. The copy buffer isn't a protected resource and can be accessed fairly freely. That said, account and routing numbers aren't really confidential as you give them out on every check so this idea sounds hair brained. Perhaps they do this to give the impression of security to less informed ...


9

The basic reason is because despite all these issues they don't regularly suffer breaches or theft enough for it to be a market differentiator. Weakened passwords still fend off most online attacks against customer accounts when paired with their system lockouts, multi-factor authentication, and other intrusion controls. Most banking customer passwords ...


8

Do Banks Really Give Out New Expiration Dates? Yes. This is a value-added service usually called something like Account Updater (emphasis mine): Serving as an automated, dedicated, and secure clearinghouse, VAU works by establishing a streamlined process for the electronic exchange of updated account information among participating merchants, ...


8

ATMs normally lie on a isolated network directly to the bank that owns the ATM. This is normally enforced by a VPN-router if theres no leased point-to-point line at the location, where the local end does not allow any traffic outside the VPN, even if malicious software on the ATM deliberately tried, and the remote end's firewall is configured to not allow ...


8

PayPal is NOT asking for your bank details. It is Trustly that is asking for your bank details. Trustly is a Swedish company. It operates in Sweden, Finland, Poland, and a few other companies. They have an agreements with Paypal to provide options to top up your Paypal account (similar agreements are made with Skrill/Moneybookers). This is not a scam. Now ...


7

This isn't as common now, but quite some time ago a lot of websites were just HTML wrappers around classic terminal (IBM 3270 and the like) applications which were being scraped statefully, and this was especially prevalent in legacy industries where the whole idea of a separation between view and model is very, very new. It's possible that a lot of banking ...


7

Microsoft is supporting Windows XP under certain circumstances As this article states the US Navy has re-upped support for their Windows XP footprint for another year as of 2015. Microsoft is supporting the operating system from several aspects under these special agreements. Security Patches Bug Fixes Customer Technical Support Due to the high level ...


5

If you want to do home banking on a public network I would always recommend using a VPN. This should protect you against MITM attacks and other funny things that can happen on a public network. There is nothing wrong with using a Windows tablet to connect to your bank. Be sure to install a decent antivirus/malware and install your Windows security updates. ...


5

Well, what they are really supposed to do is look to the most effective physical security measures used in the customary practices of high-security data centers in data processing industries in general, plus implement specific measures & practices that their lawyers tell them are required by the collective body of federal regulations that speak to the ...


4

The green lock indicates that an Extended Validation Certificate is being used. This means that the organisation has gone through some extended checks before the certificate is issued for their domain. You should be right to be suspicious if this suddenly changes to a DV or OV certificate (Domain Validated or Organisation Validated), which are easier to ...


4

A virtual machine can't protect the guest OS from the host (without specialized hardware features to support it). You will not gain any security from running Linux in a VM if Windows gets infected, and if your VM gets infected then that's still the environment you intended to use for security sensitive things that's new insecure. Have you tried live USB ...


3

If you consider how credit cards are used there is no increased security risk associated with providing the bank employee with the card number and your name and address. For example if you use the card for mail order purchases you will provide the same detail, but also the CVV code and expiry date a greater level of risk...but this is how they are intended ...


3

I work in the IT system of a banking company, and as such I know a bit about what happens. Here is the sequence of events, as I understand it, when a payment goes through: You send the payment information (BIC, PIN, etc.) to the seller's bank; The seller's bank transmits the payment request to your bank; Your bank receives the payment request, and decides ...


3

The website is using SHA1 certificates to provide security. The new Chrome browser is showing it as a weak algorithm, because most of the organizations are already migrated to SHA2 certificates. It is just a warning, it does not mean that it would be a non-secured connection.


3

Any form of hacking involves being able to change the underlying operating system or applications. If an attacker were completely prevented from doing this, then attack is impossible. Operating systems have vulnerabilities. They always have, and they always will. But what if the OS and all applications ran off of a medium physically incapable of being ...


3

Thanks to comments from @Anders (thx!), I'm unsure if the password generator is a shared service or a personal authentication token like digipass or SecureID. Password generator is a shared service In this situation, Alice can only get the signed response H(R,K) by proving to the password generator that she is Alice by presenting her PIN. If Alice knew K, ...


2

I recommend that you strongly consider paying a third party for the security, because it will probably be the most fiscally responsible solution. If you handle the payment card data yourself, you will be responsible for PCI audits, which can be very expensive. And after the upcoming October 2015 liability shift (assuming you are in the U.S.A.), the weakest ...


2

The password is hashed with bcrypt, and the public and private keys are stored alongside the password hash in the user table. Storing the private key means a compromise of the database would allow attacker to decrypt the bank information. You might as well store the bank information in plain text. Why exactly would the bank information need to be ...


2

They prevent it by using access controls to restrict access to who can change data fields and by implementing auditing to monitor authorized changes. As you might expect, a database holding banking information is typically fairly restrictive on who can make changes. They also have transaction logs that may be used to validate account balance changes, where ...


2

Short answer Yes, they can. Long answer If you require PIN to do any transaction, they will have your cards' information, but they can't really do anything about it. Of course this is already bad, and it doesn't improve situation in any level. If it was a credit card that requires you to put zip code only (for example, US credit cards), then they can ...


2

If you have very sensitive data, you should keep it somewhere, where there's no direct internet access. In that case, Linux on a virtual machine will do the job(but still, it's not 100% safe in this case). If you need an internet access, I suggest installing plugins like HTTPS Everywhere and uBlock/uMatrix/NoScript in your web browser, to keep the ...


2

As long as you called them, at a phone number on the card or from your bank statement, it sounds standard to me. The hazard would be if someone called you claiming to be a bank employee, or you got the phone number you called from some untrusted source, such as a piece of email or a random snail mail that appeared to be from the bank.


2

Essentially your question is one of authentication. In this case, it's users authenticating the bank website is actually the bank. I think you're right, and the user is going to have difficulty in authenticating the bank through the URL (many banks have multiple URLs for instance). You're also correct that users aren't terribly sophisticated about URLs, ...


2

3D Secure is a fraud-prevention system: 3-D Secure XML-based protocol designed to be an additional security layer for online credit and debit card transactions. It was originally developed by Arcot Systems, Inc and first deployed by Visa with the intention of improving the security of Internet payments and is offered to customers under the name Verified ...



Only top voted, non community-wiki answers of a minimum length are eligible