Hot answers tagged

53

A scenario such banks might want to protect you from could be this: you visit your banking website and do your banking stuff. after you are finished you log out and then navigate to some other website to look at cat pictures or whatever. you leave your computer with the cat picture website open. Because there is nothing incriminating on your screen, you ...


35

Why security indicators fail vs. phishing There is no action that can be taken that is economically viable. Put another way, it's too effortful to defend against phishing attacks. See 'So long and no thanks for the externalities' for an example on the US economy and information workers. You are correct that checking for URL correctness is error-prone, and ...


34

The most likely reason is that the backend only supports case-insensitive passwords. To quote OWASP: Occasionally, we find systems where passwords aren't case sensitive, frequently due to legacy system issues like old mainframes that didn't have case sensitive passwords. The chances of this happening are much higher with stodgy old institutions ...


25

There's a couple of things going on here: Bankings sites will use cache-control headers to forbid cacheing of the pages. So when you click back the browser has to reload the page from the server. Some parts of the site may have a strict flow of pages, e.g. you enter transaction details, enter your SMS code, view transaction confirmation. These require ...


25

I was going to suggest that ensuring that the login screen for the online banking system showed the name of the bank in green, in the address bar might work. But then I started wondering if any of the local banks I know about did that properly. It's less encouraging than I'd hoped. For these nine fairly large banks, 6 provide the name of the bank in the ...


15

Typically, it is a choice between usability and security. Users have a surprising amount of trouble with capitals in password so capitalizing password before hashing them makes it easier on the user. Of course, that also decreases the maximum entropy of a password of a given length. To compensate, you should use longer passwords... If you're lot limited to ...


11

The problem isn't with pasting, it's with copying confidential data. The copy buffer isn't a protected resource and can be accessed fairly freely. That said, account and routing numbers aren't really confidential as you give them out on every check so this idea sounds hair brained. Perhaps they do this to give the impression of security to less informed ...


9

The basic reason is because despite all these issues they don't regularly suffer breaches or theft enough for it to be a market differentiator. Weakened passwords still fend off most online attacks against customer accounts when paired with their system lockouts, multi-factor authentication, and other intrusion controls. Most banking customer passwords ...


8

Do Banks Really Give Out New Expiration Dates? Yes. This is a value-added service usually called something like Account Updater (emphasis mine): Serving as an automated, dedicated, and secure clearinghouse, VAU works by establishing a streamlined process for the electronic exchange of updated account information among participating merchants, ...


7

This isn't as common now, but quite some time ago a lot of websites were just HTML wrappers around classic terminal (IBM 3270 and the like) applications which were being scraped statefully, and this was especially prevalent in legacy industries where the whole idea of a separation between view and model is very, very new. It's possible that a lot of banking ...


6

One of the reasons that banks often have case insensitivity in their passwords is because of phone banking: banks existed FAR before the internet existed, even before telephones were a thing. So once telephones became widespread, many major banks allowed people to to banking stuff via the telephone. it makes sense: all you need is two account numbers and a ...


6

I do not see an increased risk of attack due to being an ISO certified organization. ANSI (The governing standards body) does not release ISO certified organizations business names. There are organizations that offer you the ability to look up an ISO 27001 certified organization but those organizations have elected to register voluntarily. I would ...


5

Well, what they are really supposed to do is look to the most effective physical security measures used in the customary practices of high-security data centers in data processing industries in general, plus implement specific measures & practices that their lawyers tell them are required by the collective body of federal regulations that speak to the ...


5

While there are aspects of truth in what you say, you have to look at the bigger picture and look at where banks have liabilities and risks. Banks look to minimise the risk down to a certain level (eg there is a fraud appetite that is accepted by banks, as to try and reduce it further costs more and more, rapidly becoming unworkable) and many of these ...


4

The green lock indicates that an Extended Validation Certificate is being used. This means that the organisation has gone through some extended checks before the certificate is issued for their domain. You should be right to be suspicious if this suddenly changes to a DV or OV certificate (Domain Validated or Organisation Validated), which are easier to ...


4

If you want to do home banking on a public network I would always recommend using a VPN. This should protect you against MITM attacks and other funny things that can happen on a public network. There is nothing wrong with using a Windows tablet to connect to your bank. Be sure to install a decent antivirus/malware and install your Windows security updates. ...


3

I work in the IT system of a banking company, and as such I know a bit about what happens. Here is the sequence of events, as I understand it, when a payment goes through: You send the payment information (BIC, PIN, etc.) to the seller's bank; The seller's bank transmits the payment request to your bank; Your bank receives the payment request, and decides ...


3

The website is using SHA1 certificates to provide security. The new Chrome browser is showing it as a weak algorithm, because most of the organizations are already migrated to SHA2 certificates. It is just a warning, it does not mean that it would be a non-secured connection.


3

Currently, the only way to protect against ACH are detective controls which should be in place at the business and the bank. Most fraud gets detected after accounts get reconciled or after a customer complains that his account was used without authorization. In case of a bank, if a company only uses it for payroll payments and those payments occur once a ...


3

A virtual machine can't protect the guest OS from the host (without specialized hardware features to support it). You will not gain any security from running Linux in a VM if Windows gets infected, and if your VM gets infected then that's still the environment you intended to use for security sensitive things that's new insecure. Have you tried live USB ...


2

If you read their privacy statement it more or less says you give them full access to your bank account and the rights to your full banking transaction history if you use the service. Personally I find this unacceptable. Further more it is totally unnecessary for them to access your account and to process a payment. What I have done in the past is simply ...


2

Banks have real money losses, a significant amount of this comes from unauthorized access to bank accounts so they have financial incentives to make it harder for users to lose their password by storing it in the browser at their local internet cafe/library/etc.


2

Banks are normally very large, bureaucratic organizations driven by policies written by people that were well meaning, but can't respond very well to changing threats. Are Phishing attacks worse than compromised machines where the password is stolen? I'm not sure, but it's a valid discussion. Saving the password locally is easy to understand, and for ...


2

They prevent it by using access controls to restrict access to who can change data fields and by implementing auditing to monitor authorized changes. As you might expect, a database holding banking information is typically fairly restrictive on who can make changes. They also have transaction logs that may be used to validate account balance changes, where ...


2

Short answer Yes, they can. Long answer If you require PIN to do any transaction, they will have your cards' information, but they can't really do anything about it. Of course this is already bad, and it doesn't improve situation in any level. If it was a credit card that requires you to put zip code only (for example, US credit cards), then they can ...


2

I recommend that you strongly consider paying a third party for the security, because it will probably be the most fiscally responsible solution. If you handle the payment card data yourself, you will be responsible for PCI audits, which can be very expensive. And after the upcoming October 2015 liability shift (assuming you are in the U.S.A.), the weakest ...


2

The password is hashed with bcrypt, and the public and private keys are stored alongside the password hash in the user table. Storing the private key means a compromise of the database would allow attacker to decrypt the bank information. You might as well store the bank information in plain text. Why exactly would the bank information need to be ...


2

If you consider how credit cards are used there is no increased security risk associated with providing the bank employee with the card number and your name and address. For example if you use the card for mail order purchases you will provide the same detail, but also the CVV code and expiry date a greater level of risk...but this is how they are intended ...



Only top voted, non community-wiki answers of a minimum length are eligible