Hot answers tagged

54

A scenario such banks might want to protect you from could be this: you visit your banking website and do your banking stuff. after you are finished you log out and then navigate to some other website to look at cat pictures or whatever. you leave your computer with the cat picture website open. Because there is nothing incriminating on your screen, you ...


36

Why security indicators fail vs. phishing There is no action that can be taken that is economically viable. Put another way, it's too effortful to defend against phishing attacks. See 'So long and no thanks for the externalities' for an example on the US economy and information workers. You are correct that checking for URL correctness is error-prone, and ...


27

I was going to suggest that ensuring that the login screen for the online banking system showed the name of the bank in green, in the address bar might work. But then I started wondering if any of the local banks I know about did that properly. It's less encouraging than I'd hoped. For these nine fairly large banks, 6 provide the name of the bank in the ...


26

There's a couple of things going on here: Bankings sites will use cache-control headers to forbid cacheing of the pages. So when you click back the browser has to reload the page from the server. Some parts of the site may have a strict flow of pages, e.g. you enter transaction details, enter your SMS code, view transaction confirmation. These require ...


11

The problem isn't with pasting, it's with copying confidential data. The copy buffer isn't a protected resource and can be accessed fairly freely. That said, account and routing numbers aren't really confidential as you give them out on every check so this idea sounds hair brained. Perhaps they do this to give the impression of security to less informed ...


9

The basic reason is because despite all these issues they don't regularly suffer breaches or theft enough for it to be a market differentiator. Weakened passwords still fend off most online attacks against customer accounts when paired with their system lockouts, multi-factor authentication, and other intrusion controls. Most banking customer passwords ...


8

Do Banks Really Give Out New Expiration Dates? Yes. This is a value-added service usually called something like Account Updater (emphasis mine): Serving as an automated, dedicated, and secure clearinghouse, VAU works by establishing a streamlined process for the electronic exchange of updated account information among participating merchants, ...


8

Microsoft is supporting Windows XP under certain circumstances As this article states the US Navy has re-upped support for their Windows XP footprint for another year as of 2015. Microsoft is supporting the operating system from several aspects under these special agreements. Security Patches Bug Fixes Customer Technical Support Due to the high level ...


7

This isn't as common now, but quite some time ago a lot of websites were just HTML wrappers around classic terminal (IBM 3270 and the like) applications which were being scraped statefully, and this was especially prevalent in legacy industries where the whole idea of a separation between view and model is very, very new. It's possible that a lot of banking ...


7

ATMs normally lie on a isolated network directly to the bank that owns the ATM. This is normally enforced by a VPN-router if theres no leased point-to-point line at the location, where the local end does not allow any traffic outside the VPN, even if malicious software on the ATM deliberately tried, and the remote end's firewall is configured to not allow ...


5

If you want to do home banking on a public network I would always recommend using a VPN. This should protect you against MITM attacks and other funny things that can happen on a public network. There is nothing wrong with using a Windows tablet to connect to your bank. Be sure to install a decent antivirus/malware and install your Windows security updates. ...


5

Well, what they are really supposed to do is look to the most effective physical security measures used in the customary practices of high-security data centers in data processing industries in general, plus implement specific measures & practices that their lawyers tell them are required by the collective body of federal regulations that speak to the ...


5

While there are aspects of truth in what you say, you have to look at the bigger picture and look at where banks have liabilities and risks. Banks look to minimise the risk down to a certain level (eg there is a fraud appetite that is accepted by banks, as to try and reduce it further costs more and more, rapidly becoming unworkable) and many of these ...


5

PayPal is NOT asking for your bank details. It is Trustly that is asking for your bank details. Trustly is a Swedish company. It operates in Sweden, Finland, Poland, and a few other companies. They have an agreements with Paypal to provide options to top up your Paypal account (similar agreements are made with Skrill/Moneybookers). This is not a scam. Now ...


4

A virtual machine can't protect the guest OS from the host (without specialized hardware features to support it). You will not gain any security from running Linux in a VM if Windows gets infected, and if your VM gets infected then that's still the environment you intended to use for security sensitive things that's new insecure. Have you tried live USB ...


4

The green lock indicates that an Extended Validation Certificate is being used. This means that the organisation has gone through some extended checks before the certificate is issued for their domain. You should be right to be suspicious if this suddenly changes to a DV or OV certificate (Domain Validated or Organisation Validated), which are easier to ...


3

I work in the IT system of a banking company, and as such I know a bit about what happens. Here is the sequence of events, as I understand it, when a payment goes through: You send the payment information (BIC, PIN, etc.) to the seller's bank; The seller's bank transmits the payment request to your bank; Your bank receives the payment request, and decides ...


3

If you consider how credit cards are used there is no increased security risk associated with providing the bank employee with the card number and your name and address. For example if you use the card for mail order purchases you will provide the same detail, but also the CVV code and expiry date a greater level of risk...but this is how they are intended ...


3

The website is using SHA1 certificates to provide security. The new Chrome browser is showing it as a weak algorithm, because most of the organizations are already migrated to SHA2 certificates. It is just a warning, it does not mean that it would be a non-secured connection.


3

Any form of hacking involves being able to change the underlying operating system or applications. If an attacker were completely prevented from doing this, then attack is impossible. Operating systems have vulnerabilities. They always have, and they always will. But what if the OS and all applications ran off of a medium physically incapable of being ...


2

Banks have real money losses, a significant amount of this comes from unauthorized access to bank accounts so they have financial incentives to make it harder for users to lose their password by storing it in the browser at their local internet cafe/library/etc.


2

Banks are normally very large, bureaucratic organizations driven by policies written by people that were well meaning, but can't respond very well to changing threats. Are Phishing attacks worse than compromised machines where the password is stolen? I'm not sure, but it's a valid discussion. Saving the password locally is easy to understand, and for ...


2

They prevent it by using access controls to restrict access to who can change data fields and by implementing auditing to monitor authorized changes. As you might expect, a database holding banking information is typically fairly restrictive on who can make changes. They also have transaction logs that may be used to validate account balance changes, where ...


2

Short answer Yes, they can. Long answer If you require PIN to do any transaction, they will have your cards' information, but they can't really do anything about it. Of course this is already bad, and it doesn't improve situation in any level. If it was a credit card that requires you to put zip code only (for example, US credit cards), then they can ...


2

I recommend that you strongly consider paying a third party for the security, because it will probably be the most fiscally responsible solution. If you handle the payment card data yourself, you will be responsible for PCI audits, which can be very expensive. And after the upcoming October 2015 liability shift (assuming you are in the U.S.A.), the weakest ...


2

The password is hashed with bcrypt, and the public and private keys are stored alongside the password hash in the user table. Storing the private key means a compromise of the database would allow attacker to decrypt the bank information. You might as well store the bank information in plain text. Why exactly would the bank information need to be ...


2

As long as you called them, at a phone number on the card or from your bank statement, it sounds standard to me. The hazard would be if someone called you claiming to be a bank employee, or you got the phone number you called from some untrusted source, such as a piece of email or a random snail mail that appeared to be from the bank.


2

If you have very sensitive data, you should keep it somewhere, where there's no direct internet access. In that case, Linux on a virtual machine will do the job(but still, it's not 100% safe in this case). If you need an internet access, I suggest installing plugins like HTTPS Everywhere and uBlock/uMatrix/NoScript in your web browser, to keep the ...



Only top voted, non community-wiki answers of a minimum length are eligible