Questions tagged [financial]
The financial tag has no usage guidance.
51 questions
2
votes
0
answers
572
views
I linked an account with Plaid. If I change my username and password, will that mostly protect me in the event of a breach?
This is very similar to this question from 5 years ago, but I didn't see a clear answer: Is Plaid safe if I change the password after deposit?
I've linked an account with Plaid. That account is 2FA ...
3
votes
1
answer
435
views
Why banks require such a low password entropy for web/app access?
Many banks I have worked with require between 4-6 characters passwords. Some even force to use only digits.
Such a poor password is protecting your financial information, because MFA is usually not ...
user15194
1
vote
4
answers
454
views
How does an organization completely delete records?
As given here: Permanently delete a record it is not fully possible to remove data completely.
Then what do financial institutions do? Institutions that store authenticating delicate details? Even if ...
0
votes
3
answers
163
views
What security concerns are there regarding website users inputting personal financial data without putting in personally identifying data?
I am a web developer, but I have only a rudimentary grasp of security, e.g., be careful to sanitize inputs, store as little user data as possible, encrypt passwords, keep up with security issues of ...
- 103
1
vote
0
answers
116
views
How to get on a list of sites that handle financial information? [closed]
Until about a year ago, I was working for one of the big tech giants. During my time there, I noticed that the IT department would do a MITM attack on any website that employees access. i.e. if you ...
- 2,068
1
vote
1
answer
281
views
How can I securely generate secret-sharing/multisig keys on a p2p network?
I am trying to create a peer-to-peer escrow system. I need to encrypt the private key of a wallet with a 2-of-3 secret-sharing function - the buyer, seller, and arbitrator will each have have one key.
...
- 11
0
votes
0
answers
174
views
Can phone apps edit my clipboard?
This is a question similar to this one but it is all about editing the clipboard contents.
Can phone apps read my clipboard?
Is this actually a case on latest API of Android an iOS? I mean ...
- 1
-1
votes
1
answer
141
views
Fundamentals of securing a web app? [closed]
I am trying to build an app that deals with finance, specifically crypto-currency. What are the fundamentals (preferably in point form, but I'd appreciate explanations too) of securing such an app ...
- 133
2
votes
1
answer
1k
views
How many digits of my credit card number may be revealed on the merchant copy of the receipt (Europe)?
The other day I was in a bakery in France and by accident, I obtained the receipt that was intended for the merchant – I did not get the customer copy. I saw that my FULL credit card number was ...
- 23
1
vote
1
answer
271
views
Encrypting data as a middleman
I'm working on a financial app that uses Plaid to provide financial data and updates as users spend money.
As of right now, I'm using Hashicopr's Vault to encrypt the transaction/bank account data, ...
- 45
2
votes
1
answer
270
views
Is re-prompting a user for credentials an effective measure to prove a user's identify
I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
- 153
2
votes
4
answers
737
views
Do you need to hire a professional in order to be pci compliant?
i run an organic food store, and after a conference call with my credit card service (card connect), do i really have to hire a PCI certified professional once a year in order to be pci compliant? If ...
- 149
0
votes
1
answer
216
views
Is this strategy end 2 end encryption and secure?
I'm passing sensitive financial data to a payment processor online via cloud functions and would like your expert opinions, please.
The workflow is as follows:
A customer indicates they want to ...
- 103
2
votes
2
answers
194
views
Can email be secured by the receiver only, without action by the sender?
An established financial institution just directed me to email them a document with sensitive information. When I questioned the security, the CS rep and manager both tried to assure me that, "...
- 123
28
votes
1
answer
7k
views
Are credit-card security codes theoretically insecure (if not entirely broken) already?
I was reading the Wikipedia article on Card security codes (CSC, CVD, CVV, CVC, V-code, SPC, CID, CV2, CVN2, CAcronym2, etc) and a certain assertion caught my eye (emphasis mine):
The CSC for each ...
- 1,738
3
votes
1
answer
2k
views
Storing basic financial data
I'm working on a project similar-ish to a budgeting app like mint or ynab. I'll be using the Plaid api, which abstracts away account/routing numbers, etc. Thus, what I'll have access to, and be trying ...
- 45
1
vote
0
answers
113
views
How to protect critical financial information in Web Apps and Web Services? (examples, common approaches) [closed]
Let's imagine a web service that allows to create wallets, deposit money and cryptocurrencies, perform money and cryptocurrency exchange and withdraw money.
The critical information here is:
"sign ...
- 111
1
vote
1
answer
116
views
Is there an advantage to request the same information if authentication fails?
Financial websites (banks, credit reporting agencies, etc.) often use two stages when authenticating you:
Identifier (account number, email, etc.)
Two characters from a memorable word
I've noticed ...
- 787
1
vote
0
answers
99
views
Is there any financial rating of electronic trading platforms?
There are too many different online stores and paid services in the Internet! Some are big and popular, other aren't.
I search for some universal financial rating of electronic trading platforms or, ...
- 71
1
vote
1
answer
2k
views
Security reason that Card Security Codes (CVV/CVC) are usually on the back of a card? [closed]
My friend recently got an Amazon Credit Card. Interestingly, all the information could be found on the back of the card including name, expiration, number, and CVV. Here's an image I found of the ...
- 1,404
1
vote
2
answers
532
views
Is there a point to obfuscating form field values?
Our company provides omnichannel (web, mobile, etc.) solutions for the banking industry.
One of our customers is pushing for obfuscating or encrypting the contents of the form fields (client-side, on ...
2
votes
0
answers
168
views
Compliance/ FCA regulations
First of all, please accept my apology for being ingnorant to compliance/FCA regulations as I have been digging out everywhere to get the answer of a very specific question:
SCENARIO
I am planning ...
- 21
0
votes
1
answer
1k
views
Under GDPR, is one user borrowing another's logged-in session for financial transactions illegal?
Our organization has historically been very lax with Data Protection and compliance, and we have a number of POS sales positions serving the public and taking payments; both Cash, Chip and Pin and ...
1
vote
2
answers
852
views
My bank's homepage is on http. No SSL. Isn't it trivially easy to MITM+change links & get login credentials?
The homepages of several banks are available over http. Some have search engines linked to http.
This, it seems to me, makes their users trivially vulnerable to MITM attacks if they visit the bank ...
- 131
3
votes
2
answers
360
views
Security of the Indian AadhaarPay fingerprint based payment system?
India recently launched a payment system where merchants install an app on an Android phone, and connects a fingerprint reader it.
Clients provide their Aadhaar number (like a national identity ...
anon
7
votes
2
answers
927
views
Couldn't credit/debit cards easily be made more secure?
As a person who is going to get my first credit or debit card, I began researching a bit about security of them and a couple of questions came up about why the system is designed the way it is.
I ...
- 291
47
votes
9
answers
8k
views
How should high net worth individuals secure their financial accounts?
I try to follow account security best-practices (strong random passwords, password manager, multi-factor authentication, etc.) but I still find myself worried about potential compromises to my ...
- 725
0
votes
1
answer
114
views
Responding to a coordinated attack against financial transaction systems [closed]
Imagine a coordinated attack by a large and motivated hacking group, that results in a nation-level compromise of the financial systems we take for granted: credit card payments, accounts at the top ...
- 2,015
5
votes
1
answer
16k
views
I emailed someone a picture of a check I wrote for them. What now?
On a whim, I emailed the intended recipient of a check I wrote a picture of that filled-in check to indicate I was about to mail it out. The full front of the check, with amount, my signature, account ...
- 287
3
votes
0
answers
809
views
SQL security - ACID transactions and locking to prevent financial fraud (timing attack?) [closed]
I am trying to prevent something similar to this from happening:
http://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/
Basically the financial exchange was using non-ACID ...
- 96
2
votes
2
answers
988
views
Is HTTPS required when there's no sensitive data in the site
I'm currently building a B2B e-commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form ...
- 29
5
votes
1
answer
6k
views
What is an ITGC Audit?
I don't get the purpose of such an audit especially given the way it is conducted. We have a 3rd party auditor who I won't name, but let's just say they probably audit the majority of the publicly ...
- 153
0
votes
2
answers
274
views
Finance with the multitude of "Secure Browsers" [closed]
[Thanks for the great answers! But it was put on hold so I've edited my question to be a lot less opinion-based. Based on the answers already given, though, I am getting the sense that booting off a ...
- 157
0
votes
1
answer
430
views
Google Accounts login - is it good enough for financial services?
I am wondering - is using Google Accounts login (in a setup similar to this) secure enough for financial services (you can assume that if someone logs into your account, your money gets stolen)?
On ...
- 365
48
votes
5
answers
27k
views
How does a website instantly know if a certain credit card number is wrong?
I was renewing my Internet subscription through the online portal of my ISP. What struck me was when I was entering my credit card details, I entered the type of my credit card (MasterCard, Visa, AA, ...
- 779
16
votes
2
answers
2k
views
Can bankers' rounding be exploited to maliciously increase balances?
Everyone knows about the sure thing retirement strategy that is the Superman 3 exploit, but is there a way to exploit bankers' rounding to grab some of the less than half pennies "floating around out ...
- 303
12
votes
5
answers
3k
views
Why should I have secure passwords for sites that I pay bills on?
What's the worst that can happen, the hackers will pay my bills for me?
Assume that this isn't a malicious hacker out to disconnect my electricity. What kind of concerns are there for my finances, ...
- 287
1
vote
2
answers
1k
views
Why does the finance industry uses 2TDEA instead of 3TDEA?
Why does the finance industry uses 2TDEA instead of 3TDEA?
Is there any historical reason or technical limitations like the support by HSMs used in the industry?
The paper referred to here says simply ...
- 473
3
votes
1
answer
2k
views
Why recommend "letters, numbers, and special characters" in a User ID?
Why do some sites recommend "letters, numbers, and special characters" in a username or User ID?
When creating a User ID at the www.discovercard.com website,
the "User ID Strength" indicator meter ...
- 2,750
2
votes
3
answers
438
views
Information Security and Financial Risks
Recently, we've been asked by Audit Dpt. to have financial risks controls in our ERP (fraud-like incidents).
Our question is if this request is covered by the scope of Information Security Dept?
If so,...
- 21
12
votes
1
answer
16k
views
Why is it considered safe for services like Mint to store bank password?
My understanding is that, typically websites are recommended to store only hashes of passwords using one-way cryptographic hash function. This way, there is no way to retrieve the passwords even when ...
- 231
-2
votes
3
answers
400
views
How would authentication when depositing, and withdrawing money from a fund, differ?
I have to do a presentation on developing an authentication plan for a financial services application used to manage an investment portfolio. I have to develop use scenarios for the 2 functions (...
- 535
0
votes
1
answer
9k
views
Is it possible that the same VISA debit card numbers could be issued to different people by different banks? [closed]
I'm wondering if is it possible that the same VISA debit card numbers could ever be issued to different people by different banks or companies?
1
vote
1
answer
191
views
Do normal SMS risks apply to DigiCel mobile banking? What mitigations are likely in place?
In this interview with Bill Gates and Bill Clinton, they discuss their work with Digicel, who I assume is this company, to enable mobile banking with normal KYC protections.
This site is full of ...
- 51.1k
5
votes
1
answer
4k
views
Is TLS 1.0 sufficiently secure for a bank?
I disabled SSL2 and SSL3 in my Firefox browser, version 24. I only enabled TLS 1.1 and 1.2. Unfortunately when I went to my bank's website, I found that it didn't work until I re-enabled TLS 1.0.
...
- 51
-1
votes
1
answer
316
views
How much can you trust a (banking) site after it spams you? [closed]
How much can you trust a company that send you spam ?
Many people, after registering with Moneybookers(Skrill) started to receive spam that included their real name (as inputted in Moneybookers ...
- 2,069
5
votes
2
answers
139
views
What security controls should be in place for online updates of user's correspondance address?
Addresses are one of the key pieces of security information for an account. They're used for authentication, determine where statements go, and changing an address on an account provide enough ...
- 101
-1
votes
1
answer
310
views
Is .bank owned by banking industry or not? [closed]
According to https://idc-insights-community.com/financial/financial-services-technology/the-four-letter-word-that-could-change-the-busines
Banking Industry was lobbying for .bank
But as I read this
...
- 1,403
2
votes
1
answer
269
views
Why does Paypal send TWO verification payments not just ONE?
The process would be easier if there was only one payment, but there must be some security or financial reason for Paypal to send you two random payments
Inge Kuijper
2
votes
2
answers
4k
views
Keeping valuable algorithms secret
Given a securities trading algorithm that is very effective and thereby very valuable, how do you keep it secret and protect it from theft or copying? What techniques or architecture is the best?
The ...
- 913