Forgot your password?
typodupeerror
Security Businesses Government The Almighty Buck The Courts News

UK Banking Law Blames Customers For Insecure OS 430

Posted by Zonk
from the laws-with-no-cause dept.
twitter writes "If you use an insecure OS in the UK and someone drains your bank account, the banks say it's your fault. The Register reports: 'The Banking Code produced by the British Bankers' Association (BBA), and followed by most banks, makes it clear that banks will not be responsible for losses on online bank accounts if consumers do not have up to date anti-virus, anti-spyware, and firewall software installed on their machines.'" twitter went on to note that the majority of consumer PCs use an operating system with a history of security issues. Should end users be ultimately responsible for the state of their systems?
This discussion has been archived. No new comments can be posted.

UK Banking Law Blames Customers For Insecure OS

Comments Filter:
  • Scare tactics (Score:5, Informative)

    by plover (150551) * on Sunday April 06, 2008 @02:13PM (#22981212) Homepage Journal
    Let's see, just exactly WHO should be responsible for the banks' security? Some random customer who is using them, or a staff of professionals whose entire industry is founded on the protection of money belonging to random customers? Seriously, if the banks were to pull that stunt on me, I'd switch to cash as there's absolutely no reason to use the banks if they're not going to offer me basic safeguards.

    But I think there's an ulterior motive here. As a part of Chip-and-PIN, the UK is testing a brilliant two-factor authentication system this year for cards that will cryptographically render browser, PC, and merchant security moot. It's possible this is being used as a "warning shot" to frighten consumers into picking up the tab for the high cost (approximately $70) of the handheld security module.

    They have the technology to keep it safe now. I think they're just too cheap to fund it themselves. (And I really wish we'd start seeing that kind of security technology available here in America. I'd switch banks and pay the $70 myself in a heartbeat.)

    • Re: (Score:3, Informative)

      by aedan (196243)
      Do you mean the things which look like pocket calculators and your card slides into the top? We have a couple of them already but the bank hasn't asked us to use them yet. They didn't charge for them.
      • Re:Scare tactics (Score:5, Informative)

        by plover (150551) * on Sunday April 06, 2008 @02:53PM (#22981502) Homepage Journal
        Yes, those are the devices.

        What they do is move all the encryption to a "trusted platform" -- the device itself. You enter your card and your PIN into the handheld, and it's their own crypto hardware using their own crypto algorithm to generate a one-time-use PIN for you to enter into the merchant's PIN pad or into a web site.

        This turns your card into a pure identification token, and turns your PIN into a secure authentication token. Without both tokens, the bank refuses to part with your money. You can enter this into a sleazy internet cafe's browser. It doesn't matter if that transaction's data is stolen or not, because the bank won't authorize your one-time PIN for a second transaction.

        What makes these a great solution is not just their security, but that they're backward compatible with current PIN pad technology. The retailers just send your PIN along, they don't care if it's your personal PIN or a generated PIN. The bank takes care of that.

        There's an even more secure variant that ABN-AMRO has deployed for web banking transactions. You enter the amount of the transaction into the handheld along with your PIN. That way, only the amount you authorize will be transferred, and the PIN is useless for any other amount.

        (I'm basing my guess of $70 on the price of similar hardware offered by RSA with their SecurID scheme, but it's just a guess.)

        • Re:Scare tactics (Score:5, Informative)

          by Nursie (632944) on Sunday April 06, 2008 @03:35PM (#22981814)
          Perfect up until this bit - "The retailers just send your PIN along, they don't care if it's your personal PIN or a generated PIN."

          This has never been the case in the UK, we have never had PIN entry at the retailer until the EMV (chip 'n' pin) cards came along, and they work the same way as you suggest - the pin pad and card reader are trusted devices and the PIN never leaves them. They are encrypted, by the card, along with the amount of the transaction (which is displayed to the user, not entered by them) and various other bits of information. The retailer's network never gets your PIN, only the device and the bank's word that it was correct.
          • Re:Scare tactics (Score:5, Informative)

            by Tuoqui (1091447) on Sunday April 06, 2008 @04:06PM (#22982018) Journal
            Unless they use a Paperclip [slashdot.org]
          • by ancientt (569920) <ancientt@yahoo.com> on Sunday April 06, 2008 @11:10PM (#22984898) Homepage Journal

            Not to say the other method isn't better, but it isn't quite that bad. I used to work in the debit processor industry, essentially our computers were the ones that the PIN was sent along to.

            It actually works like this: PIN entry -> Unique encryption in keypad (light sensitive PRAM typically) -> Debit machine processing -> VPN or dial-up direct to processor -> decryption based on id of machine and uniquely assigned encryption keys -> somehow (varying) communicated to bank ->back up the line with approval/denial.

            It is supposed to be using hardware that never stores the encryption keys (triple DES mandated) anywhere that is accessible from the machinery that processes the transaction and they're tamper resistant (not quite proof, but difficult) with the encryption key knowledge being split between (at least) two people. The keys are unknown to the people who handle them until the time of entry and only stored in the end machine and in the processing machine (identified by serial number or machine ID.)

            It is possible for the systems to be compromised in several ways, but paranoid safeguards are in place to make it difficult. Getting card numbers is no terrific feat, as evidenced by all the news stories about exactly that, but mechanically getting PINs usable for debit transactions is tremendously more difficult. That isn't to say it can't be done, but it does raise the barrier much higher than just sending your PIN along.

            On the other side though, the decision on whether to approve or deny a transaction is typically just a matter of an unencrypted 0 or 1 along with the mirror of the transaction. If a transaction is denied, but the machine gets a 1 where it should have received a 0, then the merchant has no immediate indication that the cash or goods weren't paid for. Machines using debug or emulation modes occasionally get into service and approve everyone without even validating the transaction, but as you can imagine that gets pretty prompt attention.

        • Re:Scare tactics (Score:5, Informative)

          by J Isaksson (721660) on Sunday April 06, 2008 @03:38PM (#22981828)
          The problem is this; in the first case the internet cafe browser, hacked, can display what you wanted to do (pay $50 bill to AT&T) and send an entirely different transaction to the bank (move all money on savings account to random account in Jersey) Since the PIN is totally independent of the transaction, the only thing that you authenticate is that it's actually you getting ripped off, not anyone else ;-) Case 2 will limit the amount that gets stolen, but except for that the same weakness applies.
          • Re:Scare tactics (Score:5, Informative)

            by Simon (815) <simon@simo n z o n e . com> on Sunday April 06, 2008 @03:58PM (#22981976) Homepage
            That is a good point which you make. The ABN AMRO have that covered too, for the most part. For most transactions this attack is possible, but there is an extra security precaution which kicks in when you try a transaction above a certain amount (1000 euros? I can't remember, I've only hit it once). When this happens you are also requested to enter the target bank account number and the sum into the device. Basically signing those details of the transaction too.

            I'm generally very impressed with the ABN's solution to this. It actually seems to solution the problem and is not just another case of security theater.

            --
            Simon
        • Re: (Score:3, Informative)

          by Jesus_666 (702802)
          In Germany chip-and-PIN has been one of the two traditional homebanking concepts (the other being PIN-and-TAN [wikipedia.org]) via the HBCI standard (now called FinTS). We distinguish between four classes of card readers:
          • Class 1 readers are just smartcard interface; you enter the PIN via the computer's keyboard. They come at about 30-40 EUR.
          • Class 2 readers are like class 1 plus a keypad. ~70-80 EUR, unless your bank sells you a branded device for less.
          • Class 3 readers are like class 2 plus a display. Upwards of 100 EUR.
    • Re:Scare tactics (Score:5, Informative)

      by CRCulver (715279) <crculver@christopherculver.com> on Sunday April 06, 2008 @02:29PM (#22981316) Homepage

      Seriously, if the banks were to pull that stunt on me, I'd switch to cash as there's absolutely no reason to use the banks if they're not going to offer me basic safeguards.

      At least in Finland (and I imagine probably the other Nordic countries as well), you can use cash for a decreasing amount of payments. Nearly everyone who demands money of you wants you to pay by bank transfer, and if you don't use your free online banking and decide you want to hand cash to a teller, there's a 3 euro fee for the service. Nearly everyone who wants to pay you money will only deposit it directly into your bank account, there are no more cheques. I'm sure this will spread to other EU countries.

      • Re: (Score:3, Interesting)

        by plover (150551) *
        Fortunately for us here in America, someone long ago was smart enough to include the words "THIS NOTE IS LEGAL TENDER FOR ALL DEBTS, PUBLIC AND PRIVATE" on our currency, and I understand it's actually against the law (sorry, no citation) to refuse to accept cash for the full amount.

        Of course, that's been tempered with the anti-money-laundering laws requiring identification for cash transactions exceeding $10 000. But still, if you owe $10, then the debtor must accept a $10 bill as payment in full.

        • Re:Scare tactics (Score:5, Informative)

          by dissy (172727) on Sunday April 06, 2008 @03:16PM (#22981680)

          Fortunately for us here in America, someone long ago was smart enough to include the words "THIS NOTE IS LEGAL TENDER FOR ALL DEBTS, PUBLIC AND PRIVATE" on our currency, and I understand it's actually against the law (sorry, no citation) to refuse to accept cash for the full amount.
          http://www.treas.gov/education/faq/currency/legal-tender.shtml [treas.gov]

          Q) I thought that United States currency was legal tender for all debts. Some businesses or governmental agencies say that they will only accept checks, money orders or credit cards as payment, and others will only accept currency notes in denominations of $20 or smaller. Isn't this illegal?

          A) The pertinent portion of law that applies to your question is the Coinage Act of 1965, specifically Section 31 U.S.C. 5103, entitled "Legal tender," which states: "United States coins and currency (including Federal reserve notes and circulating notes of Federal reserve banks and national banks) are legal tender for all debts, public charges, taxes, and dues."
          This statute means that all United States money as identified above are a valid and legal offer of payment for debts when tendered to a creditor. There is, however, no Federal statute mandating that a private business, a person or an organization must accept currency or coins as for payment for goods and/or services. Private businesses are free to develop their own policies on whether or not to accept cash unless there is a State law which says otherwise. For example, a bus line may prohibit payment of fares in pennies or dollar bills. In addition, movie theaters, convenience stores and gas stations may refuse to accept large denomination currency (usually notes above $20) as a matter of policy.

        • Re:Scare tactics (Score:5, Interesting)

          by The_Wilschon (782534) on Sunday April 06, 2008 @03:23PM (#22981736) Homepage
          There is a subtlety here that you may have missed. Cash is legal tender for all debts. So, if you have already incurred a debt, then your creditor must accept cash as payment. However, most transactions do not involve you incurring a debt. For instance, when you pay to get on the bus, you have not yet incurred a debt, whereas if you eat a meal in a restaurant, then by the time you get the check, you do owe a debt. So, the bus driver may refuse cash; the restaurateur may not.

          Interestingly, according to wikipedia [wikipedia.org], the "legal tender" phrase was added because the government couldn't pay its debts with gold or silver, and nobody wanted paper money instead. The phrase was added to compel them to accept the paper money.
        • Re: (Score:3, Insightful)

          by xaxa (988988)
          In the UK, that only applies for a debt, i.e. if you already owe someone the money then they have to accept legal tender (essentially coins and banknotes, but with some exceptions: a creditor doesn't have to accept more than £2 of £0.01 or £0.02 coins in a transaction, for instance, but they have to accept £1, £2 or £5 coins in any amount).

          Because there's no debt, a shop is not breaking any law by putting up a notice saying "we don't ac
    • Re:Scare tactics (Score:5, Insightful)

      by Wapiti-eater (759089) on Sunday April 06, 2008 @02:33PM (#22981340)
      "About damned time!", I say.

      Banks are held accountable for THEIR systems.

      Users should be accountable for THEIR systems as well.

      Now, if the bank sold, loaned or leased to me a data terminal for accessing THEIR systems - sure, they'd be accountable for it. But since I'm using MY system, that I configured, operate and maintain - how on earth can the BANK be accountable for that?

      For years now, geekly types have been crying about the vulnerability in the "popular products". Since that product held an effective monopoly on the market, consumers happily drank the only 'koo-aid' available.

      Now that these same individuals that have been enjoying 'oblivious immunity' will have to pony up for the failures in their personally owned tools - they'll demand, and get, improvements.

      It's only good for everyone.
      • Re:Scare tactics (Score:5, Insightful)

        by Naughty Bob (1004174) * on Sunday April 06, 2008 @03:01PM (#22981556)

        "About damned time!", I say.

        Banks are held accountable for THEIR systems.
        If a bank only lets you connect via one OS/browser combo, you are effectively co-opted into the software ecosystem as designed by the bank- it's all their system.

        I don't use my bank's internet-based facilities, because they don't support my (more secure) choice of software- bizarre...
        • Re:Scare tactics (Score:4, Insightful)

          by SJS (1851) on Sunday April 06, 2008 @03:17PM (#22981684) Homepage Journal

          If a bank only lets you connect via one OS/browser combo, you are effectively co-opted into the software ecosystem as designed by the bank- it's all their system.

          I agree. I disallow any client-side code to run in my browser, and that makes it difficult or impossible to use many financial websites (not because allowing it would be more secure, but because the developers of the website go out of their way to make it that way).

          Responsibility needs to go hand-in-hand with the power to make a decision; if a bank requires particular combinations of software, or disallows my preferred security policies, then it's their decision, and should be their responsibility. If the bank merely recommends software, but doesn't seek to subvert my security policy, then yes, faults in my security policy are my own damn fault.

        • Re:Scare tactics (Score:4, Insightful)

          by jimicus (737525) on Sunday April 06, 2008 @05:37PM (#22982592)

          If a bank only lets you connect via one OS/browser combo, you are effectively co-opted into the software ecosystem as designed by the bank- it's all their system.
          Very few banks in the UK have IE-only websites, so that's not a particularly big deal.

          What is an issue is the wording - nothing in The Register's article suggests that they've included the magic phrase "where necessary". You could be using an SELinux box tightened beyond belief with no need for anti-spyware or antivirus, but if you get ripped off through a website, their first question is going to be "What antivirus are you running?" and if the answer isn't a well known commercial product, then it's your problem and not theirs.
      • Re: (Score:2, Insightful)

        by buravirgil (137856)
        I suppose your argument lies in the term "access" as when you sign on to the bank's servers, you have "entered" a bank and to what party a responsibility of security is assigned is the literal argument you so damn with time.

        This very question has already been addressed by the Securities and Exchange Commission...
        http://www.nytimes.com/2008/02/15/business/15norris.html?_r=1&oref=slogin
        with a decision with which, I might infer from this quickly modded post, you profanely contend.

        I would pose the question
        • Re: (Score:3, Interesting)

          by jc42 (318812)
          Moreover, given the advantage Gate's OS has maintained for decades and its nearly endemic nature of viral infection...pretty much anybody logging onto a bank's servers has a virus on it and all a bank need do is task the police to recover a computer, find a virus and claim the bank is not at fault.

          Well, now; it seems this situation is ripe for a nice setup. Get an account at a bank such as the Egg mentioned in other messages here, which strongly encourages use of IE and includes Active-X code in its pages.
      • Re:Scare tactics (Score:5, Insightful)

        by v1 (525388) on Sunday April 06, 2008 @03:17PM (#22981688) Homepage Journal
        I'd mod you up but you're at +5 already so I'll just add my 2c to your comments. "About damned time!" Got that straight.

        A coworker got his xbox-live account phished several weeks ago. Although he's having a really hard time getting his account recovered properly, he's fully accepted responsibility for what he did. I showed him an example phishing email I got and how it takes you to chase visa and you look in the url and it's some random IP in russia. He had no idea to pay attention to that, but now he does.

        And he 100% accepts responsibility for his actions. And that's how it should be. But there's not enough of that going around right now, too many people wanting to blame their own lack of education on the world. If you don't understand a system to the point that you are not able to use it responsibly, you shouldn't be using it.

        That's why we have drivers licenses. I've seen the idea jokingly suggested from time to time that you should require a permit to get on the internet. And it's things like this that make me seriously wonder if they have something there. But then it's someone taking the responsibility away from you and accepting the burden themselves. They can be held accountable for giving you a permit if you don't know what you're doing. So you see, these types don't want to accept the responsibility for making sure they are educated, and they don't want to accept the responsibility for what happens to them as a result.

        Can't have it both ways.

        You either have to submit to someone else making sure you are competent, or you have to be willing to accept responsibility for the outcome of your incompetence.
        • Re: (Score:3, Insightful)

          by zotz (3951)
          "Can't have it both ways."

          True, but then neither can the vendors and others. Right?

          When they advertise that their system is so easy, anyone can do it. It is really intuitive. Then they can hardly come back and say that the problem was due to lack of proper training on the part of the users. They just got finished selling the system on the premise that no training was needed.

          And in the case of banks, if they require a particular, OS, browser, other settings to work, they can hardly properly claim that the cu
        • Re:Scare tactics (Score:5, Insightful)

          by penguinbrat (711309) on Sunday April 06, 2008 @07:03PM (#22983266)
          "If you don't understand a system to the point that you are not able to use it responsibly, you shouldn't be using it."

          Do you understand the inner workings of a fuel injected turbo with dual over head cams - or do you have a general idea and just use it assuming safety from the manufacturer?

          Do you understand the inner workings/procedures and protocols that it takes to fly a commercial airliner from LA to NY - or do you have a general idea and just use the transports assuming those that be aren't putting your life at risk for a mere buck?

          Do you understand biology and the inner workings of your OWN BODY - or do you assume and rely on doctors and those in the medical profession to NOT kill you mistakenly for the treatment of a zit?

          "You either have to submit to someone else making sure you are competent, or you have to be willing to accept responsibility for the outcome of your incompetence." - Typical arrogant and assinine comment from the godly geeks among us, when your inflated ego can go an entire day with out relying on ANYTHING that ANY manufacturer claims is perfectly safe and secure to use (regardless if it is or isn't - read M$ and ANY software corp) then, AND ONLY THEN would you have a valid argument to make and have something to back it up. Until then, you need to wake the fuck up and stop expecting everyone else in the world know as much about computers and the internet as you do - because you rely on company-X telling you using such-n-such is perfectly safe, just as much as grandma and little Jane down the street relies on M$ and the billions of other software manufacturers telling them everything is safe to use their products - not to mention teller X and sales boy Y doubling as a pretend security expert that just "knows" it is safe (hint, they are told to say that).

          Arrogance like this is a big part of the problem - Marketing takes crap like this and runs with it, not to mention the legal department - who cares if it is complicated and way to much to comprehend for 90% of the population, the "experts" that do know what they are talking about blame everyone for not knowing what they know, so we'll do the same, they just don't mention the education and knowledge base behind it - but who cares about that?

          EVERYONE SHOULD ALREADY KNOW IT! - and that is the biggest load of arrogant bull shit I've heard in a long time.
          • Re: (Score:3, Insightful)

            by rastos1 (601318)

            Do you understand the inner workings of a fuel injected turbo with dual over head cams - or do you have a general idea and just use it assuming safety from the manufacturer?

            If the "fuel injected turbo with dual over head cams" fail, then I'm not dangerous to others. In worst case I won't be able to start up. However I do understand how breaks work. I know that I have to regularly check the level of breaking liquid. I know that I have to have the front and break lights and blinkers working. I know how they

      • Re:Scare tactics (Score:5, Interesting)

        by TheRaven64 (641858) on Sunday April 06, 2008 @03:24PM (#22981744) Journal
        And what happens if your bank is Egg (now owned by Citi Group) and tell you every time you log in that you should try the Egg Money Manager, which is only available as an ActiveX control? It's frustrating to keep telling users 'disable ActiveX' and have banks tell them to enable it (and use IE), and if they do then I think they ought to accept at least partial responsibility for the user's poor security.
        • Re: (Score:3, Insightful)

          by Shemmie (909181)
          And as a bonus, Egg Money Manager will store all your other bank usernames and passwords, log into the sites for you, and I'm assuming it scrapes the balance information from the HTML, displaying it on the Egg page. Does that sound at all... risky?
        • Re: (Score:3, Insightful)

          by tepples (727027)

          And what happens if your bank is Egg (now owned by Citi Group)
          It depends: Are there banks other than Egg that have ATMs in your town?
          • Re: (Score:3, Informative)

            by jimicus (737525)

            It depends: Are there banks other than Egg that have ATMs in your town?

            Brief explanation of a few things about how UK banking works for our US cousins because there are significant differences:

            1. You get paid into your bank account. Virtually nobody is paid in cash. This isn't something you get to negotiate with your employer - they'll ask for your bank account details when you start working.
            2. Checks (or, in UK spelling, cheques) are rapidly dying. Many retailers no longer accept them. More or less every bank account comes with a debit card.
            3. ATMs owned and operated

    • Re:Scare tactics (Score:5, Interesting)

      by Kristoph (242780) on Sunday April 06, 2008 @02:35PM (#22981362)
      The issue at hand is not the bank's security. It is the security of the consumers account.

      In any case, do you really want the bank to be responsible for the security of your system? Because, honestly, I REALLY DO NOT want the banks 'staff of professionals' ensuring my security by requiring I install some type of custom 'security' software.

      ]{
      • by plover (150551) *
        It's not software at all. It's external hardware that the banks distribute. You enter your PIN into the trusted device, it sends that into your smart card for encryption, and it outputs a one-time-PIN for you to use for one transaction.

        It doesn't matter where you use that PIN -- it's just a set of digits. You can enter it into the PIN pad at the grocery store, into a web site to transfer money, or into a PIN pad at Tony Soprano's bar, and nobody can do anything with it.

        Now, if you use it to send mone

        • Re: (Score:3, Interesting)

          by Kristoph (242780)
          The device you speak of (which I happen to actually use for one of my bank accounts) includes an additional step which is the challenge code.

          You slot in your smart card, enter your pin into the device, followed by the challenge code, and it returns the response code which you must transcribe into the site. It is something that works on the internet but it probably would not work well for commercial transactions because most users would consider it too cumbersome.

          In any case there is a pretty straightforwar
      • Re: (Score:3, Insightful)

        by Reziac (43301) *
        Which also ensures a monoculture and a uniform point of failure when (more likely than if) their custom setup is compromised.

    • Uh you are held responsible if you give your bank card and password to someone too. It is impossible i repeat IMPOSSIBLE for them to secure your computer from people reading your keystrokes. How ARENT you responsible for it?
       
        On the other hand i think banks should offer recovery services. But they should charge for them. AND the money should not be handed out to you. That would be like if i took money out of the bank and fucking lost it. Its not the banks fault in even the slightest.
      • Re: (Score:3, Informative)

        by TheRaven64 (641858)

        It is impossible i repeat IMPOSSIBLE for them to secure your computer from people reading your keystrokes.

        They can't prevent you from installing a malicious keylogger, but they can mitigate it. To log in to my bank's site, I put my card in a reader they provided, hit 'authenticate' and enter my pin. It then gives me an 8 digit number which I enter. This is a hash of my pin (something I know), some data on my card (something I have) and, I believe, some monotonic counter (not sure if it's time based, or if it just generates them in a sequence and they only let you go a few ahead to account for failures). If

      • Re: (Score:3, Informative)

        by smallfries (601545)
        Annoying though it is my bank worked around this awhile ago. Instead of entering my PIN through the keyboard they flash up a java keyboard with randomised key layout on the screen which I have to click with the mouse. It is more annoying than tapping in the code as it takes effort to read the screen and translate my PIN onto it, but it must save quite a few of their customers from keyloggers. If it becomes popular amongst other banks then expect a similar arms race to the one underway between CAPTCHAs and s
    • Re: (Score:3, Insightful)

      by nurb432 (527695)
      Depends on where the leak was.

      Was it on the user's pc? Then i guess its their fault technically. If its in the banks system, then the bank is on the hook.

      Problem is that people really don't/can't understand the systems they are using as they are far too complex and to expect/demand them to keep them 'safe' is ludicrous. ( even "IT pros" cant always do it with the constant barrage of attacks on what is are fundamentally flawed systems )

      However, the same logic goes for a car. Its far to complex for most peopl
    • Re: (Score:3, Insightful)

      by ergo98 (9391)

      I'd switch to cash as there's absolutely no reason to use the banks if they're not going to offer me basic safeguards

      Banks are responsible for their own systems, and that is the full-time focus of those professionals. It is irrational, in my opinion, to expect them to take full culpability for the entire universe of client systems as well. Unless you're willing to accept a dictum that you must you BankOS running on BankHardware over the BankNet if you ever plan on accessing your money.

      They have the technolo

    • Re: (Score:3, Interesting)

      by MyForest (597329)

      How ironic. I just switched from Barclays because they implemented this scheme. Note that Barclays give you everything you need for free.

      You need a user id, password, your card and the PINSentry device to access the site. That's sort of OK when you're at home. It's not great when you leave your card in the reader and don't realize until the next day when you're in the shop. It's not great when you travel and you have a few different accounts setup. Although Mr G [mrg9999.com] overcame that he wouldn't have his card to

  • by UbuntuDupe (970646) * on Sunday April 06, 2008 @02:25PM (#22981298) Journal
    So, to summarize:

    bankers: "You better use a secure OS, or you'll be liable for any fraudulent transactions with your account."
    customers: "Okay. What if we use Firefox on Linux?"
    bankers: "That'll work."
    customers: "Hey, we can't access your site using Firefox!"
    bankers: [British equivalent of "hah! Sucks to be you!"]
  • Holy crap. (Score:2, Insightful)

    by Anonymous Coward
    Look, if an account compromise occurs as a result of a compromise on the bank's side (web server, backend network, etc), it's the bank's fault. If the compromise occurs because the user's login gets sent to some dude in Russia by a keysniffer running on the user's already compromised workstation, it's MOST DEFINITELY the user's fault. This isn't complicated. Wow.
  • this is scary (Score:5, Insightful)

    by suck_burners_rice (1258684) on Sunday April 06, 2008 @02:30PM (#22981318)
    Suppose one is running a hardened version of OpenBSD on some PA-RISC machine. Suppose then that this person's bank account is drained out and that said draining has NOTHING to do with their computer or OS. Suppose it's drained by someone who prints checks with a random bank account number on them and it just so happens to be this OpenBSD user's bank account. Again, the theft has NOTHING to do with their computer, OS, computing practices, or hair color. What will happen? Will the bank file a discovery motion to check if the person has anti-virus software on their hardened machine? What? No anti-virus software? Never mind that there is no virus to check for. This is scary as it gives the bank a way to weasel out of its own responsibilities.
    • by kesuki (321456)
      Well, if they'd just switch to using a hardened Linux configuration possibly on more standard hardware, rather than some obscure RISC chip (even apple stopped using RISC)

      well, they could download anti-virus software, straight from a repository. anti-spyware? switch to firefox http://nixory.sourceforge.net/ [sourceforge.net]

      Linux comes with firewall support built-in but you can get GUI tools to make firewall management more usable. The question is since Linux (even a hardened system) should have an intrusion detection system
      • by Junta (36770)
        Sigh, RISC as a platform strategy is not dead. PA-RISC, yes, it was abandoned in favor of Itanium, but Power, SPARC, MIPS,and ARM continue. Apple is not *the* benchmark of relevant technology, despite what they would like everyone to believe. And if you do need Apple to use something to consider it relevant, look at Apple's ARM platform iPods and iPhone.

        And, more to the point, there is no relevance to security in talking about PA-RISC, or any instruction set at all. Once you hop OS, you no longer readi
    • Re: (Score:3, Insightful)

      by jez9999 (618189)
      Suppose it's drained by someone who prints checks with a random bank account number on them and it just so happens to be this OpenBSD user's bank account.

      Just in case anyone was taking this serviously, this scenario just aint gonna happen.

      To login to my bank account online, I need the online account's ID, my PIN, and my secret word. In addition, I also now need my physical debit card, a card reader, and to enter my PIN in the reader and get back a code to enter for login. Not much chance of someone random
    • by sjwest (948274) on Sunday April 06, 2008 @02:52PM (#22981486)
      client rings up the bank, 'i have been stolen from',
      bank rep asks: whats your operating system:
      client says: mac osx
      rep says: im sorry sir that means your liable for the losses
      client asks: why
      rep says: you dont run norton antivirus, only norton antivirus protected computers are safe. Thank you for banking with us, can i help you with anything else?
      • Re: (Score:3, Interesting)

        by Anne Thwacks (531696)
        Mod parent +5, accurate. This is not funny, this is a typical UK bank.

        Yes I did try to use Barclays on-line banking using Firefox on OpenBSD on Sparc64 hardware, and No it doesnt work.

        In fact Opera on FreeBSD doesnt either, and Opera on WinXP is barely useable.

        In short, Barclays have clearly never tested with anything other than IE on XP.

        But they have issued me with a PINSentry device which looks like a fisher-price toy, but is allegedly secure.

  • by plopez (54068) on Sunday April 06, 2008 @02:30PM (#22981320) Journal
    In the US, a friend of mine (a lawyer) basically described the state of banking laws as "the bank is always right, if the bank is wrong the bank is still right". This was based on 1930's banking laws when the banks went to the gov't looking for a bail out and convinced enough people to severly restrict their liability.

    If there is a lawyer in the house can they confirm this?

    Not sure what the state of the laws are elsewhere, but knowing what a bunch of whining snivelers the banking industry is it's probably the same. The bank is always right and the depositors and the taxpayer pick up the bill.
    • by Nolde Huruska (1034512) on Sunday April 06, 2008 @03:08PM (#22981610) Homepage

      In the US, a friend of mine (a lawyer) basically described the state of banking laws as "the bank is always right, if the bank is wrong the bank is still right". This was based on 1930's banking laws when the banks went to the gov't looking for a bail out and convinced enough people to severly restrict their liability.
      The policy was actually started by Hugh McCulloch who was U.S. Treasury Secretary, serving under three presidents starting with Abraham Lincoln. Before he was Treasury Secretary he was the first Comptroller of the Currency in that position he declared his famous dictum "In case of a dispute, favor the bank." He became revered by bankers and after his death they commemorated him by putting him on the Series 1902 $20 National Bank Note. His policy has remained pretty much in force ever since.
    • by DogDude (805747) on Sunday April 06, 2008 @04:55PM (#22982342) Homepage
      That's part of the reason why anybody with half a brain uses a credit union.
  • by hubert.lepicki (1119397) on Sunday April 06, 2008 @02:30PM (#22981322)
    I just seen on news the same news about our Polish banks. And to be honest, I can't see any way security can be made when used compromised operating systems on client's accounts. Even USB tokens are not enough when someone else than you controls your PC.
  • by Kristoph (242780) on Sunday April 06, 2008 @02:32PM (#22981330)
    Should end users be ultimately responsible for the state of their systems?

    The Microsoft Windows OS is not the property of the consumer using it. It is the property of Microsoft used under a license from Microsoft. If the usage of the OS complies with the license then surely any inadvertent behavior on the part of the OS is the responsibility of the owner (Microsoft) and not the license holder (the end user).

    ]{
    • by MikeURL (890801) on Sunday April 06, 2008 @03:02PM (#22981564) Journal
      Before we jump up on both feet and applaud we should bear in mind how MS would likely deal with this responsibility if it fell on them. For starters, they would implement a trusted computing model that would make DRM and WGA look like FOSS by comparison (probably something along the lines of being a node on a corporate network). They'd likely also shut down support for any software other than their most current offerings.

      "3rd party software?" you ask. Aren't you cute! Well yes it would probably exist but it would all have to be Microsoft Certified and probably just about everything would move to a yearly subscription model.

      I know some will say "well great! That would force people to choose Linux". Maybe. But more likely people would go along with MS and this new "locked down" model. After all, to Joe Sixpack, the computer is essentially a Black Box and he isn't likely to say "yeah, screw MS, I'm taking ALL the risk on myself and run Linux."
    • by McDutchie (151611)

      The Microsoft Windows OS is not the property of the consumer using it. It is the property of Microsoft used under a license from Microsoft. If the usage of the OS complies with the license then surely any inadvertent behavior on the part of the OS is the responsibility of the owner (Microsoft) and not the license holder (the end user).

      What would that mean for Free and Open Source software, which is just as well the property of its respective authors and used under license?

  • My two cents (Score:4, Interesting)

    by Antony-Kyre (807195) on Sunday April 06, 2008 @02:33PM (#22981342)
    1. How do they know whether or not one's computer had an AV, anti-spyware, and firewall software installed at the time it was supposedly compromised? (Privacy issue.)

    2. Bank customers do have some responsibility in security. Analogy: A homeowner has no locks, leaves door unlocked all day long, then tries getting his or her insurance company to pay out when he or she is ripped off.

    3. AV, anti-spyware, and firewall. All three must be done? I think most people are familiar with the AV and firewalls, but how many know about anti-spyware software? (I believe Lavasoft's AdAware is one program.) What they should do is say that the person must make a reasonable attempt at securing their computer. (This could include having a separate computer used solely for banking, and nothing else.)

    4. A thought just crossed my mind. Will they deny a claim if someone just happens to have an unsecured computer, even if the computer never was used for banking?
    • by jonbryce (703250)
      Windows Defender (formerly Giant Antispyware) is pretty popular, as it is from Microsoft, and it is free.

      Most of the AV programs these days check for spyware as well.
  • by mboverload (657893) on Sunday April 06, 2008 @02:34PM (#22981348) Journal
    I'm pretty freaking tired of all this "advice" that you need this protection for Windows machines.

    Why should I have a firewall? I have a NAT router (hardware firewall).
    Why should I have antispyware? I know what I'm downloading.
    Why should I have antivirus?
    - I don't download cracks. When I DO need to use a crack I upload it to virustotal and then run it in a virtual machine.
    - I run IE7 and Firefox. Although neither are perfectly secure I don't make it a habit to go to Russian warez sites.

    Dear god, SOMEONE explain to me why any reasonable user should need this resource-hogging crap?
    • by jonbryce (703250) on Sunday April 06, 2008 @02:50PM (#22981472) Homepage
      Someone finds a security hole in IE7 or Firefox. At the same time, they find a security hole in IIS or Apache. Using both these holes, they attack some well known and trusted site, maybe a newspaper, and use it to do drive-by attacks on visitors.

      Yes, this does happen.
      • by Lennie (16154)
        Or they just pay an ad-network 50 bucks and invect thousands od networks that way.
        • by Lennie (16154)
          Just to be clear, in that case you still need the browser-security-bug, but no server-bugs.
    • by jez9999 (618189)
      Fair enough, so if you don't need it, you won't be needing to make a claim to the bank for your stolen money back, presumably.
    • by eclectic4 (665330)
      "SOMEONE explain to me why any reasonable user should need this resource-hogging crap?"

      Because you seem to not realize the difference between "reasonable" and "average user". They are completely different I'm afraid... to be reasonable is one thing, to be a gullible newbie (90% of the computer using base) is another. Why do the intelligent /. readers/posters still not realize that they are not a representative of the average user? Oh wait...
    • the very fact that you are not running anti-virus/spyware on your MS box, AND are asking how you can get infected, says that you have absolutely no clue about this.

      It is as the saying goes, it is not who you screwed, but who that person screwed or shot up with. This is just like HIV. When you KNOW the other party and KNOW that they are not screwing around, then you do not need a condom. But otherwise, you do. This is the same

      If you connect to a site that is running an older version of a web site, they c
  • Should end users be ultimately responsible for the state of their systems?

    Yes and no, really. The bank should have safeguards to protect against fraud (e.g. my bank has halted a purchase and phoned me because it was a reasonable sized computer purchase that I didn't normally make) but at the same time then if the user has been phished/keylogged because they haven't been paying attention and taking the correct precautions then why should the banks shell out?

    It's a bit like expecting you car insurance to co

  • I'm glad someone's finally doing this. People can't keep using the internet and keep being ignorant of computer/internet technology at the same time. Wise up or GTFO. You can't have your cake and eat it too.

    That being said, insecure OS or not, if the user will download and install any random program, they're going to "get hacked" no matter the OS they're running.

  • This is bull. (Score:3, Insightful)

    by Jane Q. Public (1010737) on Sunday April 06, 2008 @02:37PM (#22981382)
    Someone who obtains a bank account number via spyware is ethically (and should be legally) no different than someone who obtains a credit card number by picking someone's pocket.

    People can be be so negligent that they are practically asking for their wallet to be stolen... in which case they should share some of the responsibility for the theft. But the criminal is still guilty of a crime.

    Banks can also be negligent, by not keeping tabs on account activity, or not taking several other measures that can reduce theft and fraud. If they do not do those things, then they should share some responsibility, too.

    I see nothing new here, unless the banks are trying to weasel out of their share.
    • Re:This is bull. (Score:5, Insightful)

      by Anne Thwacks (531696) on Sunday April 06, 2008 @05:57PM (#22982794)
      Someone who obtains a bank account number via spyware is ethically (and should be legally) no different than someone who obtains a credit card number by picking someone's pocket.

      next you will be suggesting that the US gvernment should arrest the people doing the phishing, or the companies selling stuff through spam.

      This will never happen - they are far to busy figthing the war on drugs and the war on terror to actually olve real life problems.

      Spam could be stopped overnight if the US owned credit card companies (ie all credit card companies) were threatened with the same sanctions for processing payments for spam-promoted products that thwere threatened for internet gambling.

      The "follow the money" approach ahs been proven to work, and lack of applying it is wholely due to lack of interest by the UK and US governments.

  • But... (Score:4, Informative)

    by blind biker (1066130) on Sunday April 06, 2008 @02:38PM (#22981388) Journal
    even if a user's computer has a keylogger installed, the bad guys would only be able to steal the access code, not the password of the user - because the passwords are from a list and are unique for each session. At least that's how they do it in all banks in Finland. Once the user is logged on, to start a new (parallel) session, a new password would be requited, even if the bad guys would manage to steal the one-time password just when the user is logged on.
  • No "sensible" person leaves their cheque book open, with 25 presigned cheques ... because the bank could hardly be held responsible if someone stole that chequebook and emptied your account.

    No "sensible" person leaves their car wide open, with the engine running ... because no insurer would ever pay out for the theft of that car.

    So why is it okay to leave your PC "wide open" and the banks have to pick up the tab ?

    Your security is your own personal responsibility ... this culture of "what the hell,
  • if i had a substantial sum of money to keep in to a checking or savings account (many thousands or millions) i would insist that no electronic transfers of cash are allowed on my accounts from any PC no matter what OS & web browser is used or i go elsewhere, this sounds like a good way for corrupt bank managers to wipe people's accounts clean = "hmm, you must have been using an insecure OS" (makes a good excuse)...
  • I seriously doubt many juries, comprised of fellow bank customers, would agree after someone files a lawsuit against those banks who say it's the customer's fault.
  • does this mean that their TV ads, etc, are going to have to stop showing people doing on line banking ?
  • The blame lies with everyone involved: (1) The banks who do not strive to achieve adequate protection against fraud or identity theft because there is a point at which the amount of effort needed to further reduce the risk exceeds the financial benefit to do so. (2) Law enforcement and government, whose primary concern is punishment, employ an antiquated bureaucracy that is ill-suited to correct issues arising from identity theft, and are too reliant on numbers, databases, and records when taking action.
  • by EdIII (1114411) * on Sunday April 06, 2008 @02:54PM (#22981504)
    I wholeheartedly agree. It's only logical. Banks are responsible for the security within their own networks and their web servers which are on the edges. That is Just Fine.

    I (The Bank Customer) am 100% responsible for the security of my own systems that I use to access the banking website. How could I POSSIBLY expect the bank to be liable for rootkits, malware, spyware, etc. I can't. That's just not reasonable.

    The only thing I can think of that might go either way would be DNS type hacks since that would depend on how it was done and just exactly what point in the communication it was affecting.

    Now with that being said.........

    It would be the BANKS'S RESPONSIBILITY to TELL the consumer THE BAD NEWS. I can't wait. That's a "shitstorm" waiting to happen.

    So basically, the vast majority of PC's are hopelessly insecure. We could talk forever about Microsoft this and Microsoft that, and "what about Safari?", blah blah blah blah. The situation is still the same. The Bank Customer's computer is just not secure enough in most cases and it could only be a matter of time before you are the "lucky" one and get nailed. Kind of like a lottery, except you get bent over.

    In the end the only thing that will happen is that people will stop using online banking. I know plenty of people now that outright refuse to use it for the perceived security risks NOW. If the bank's outright say that they will not be responsible for the security on your computer, that will only make the situation worse (for them).

    I'm pretty good at securing my systems, but even I know it would only take one determined person to get me. If the bank will not at least insure my losses, I can't take the risk of online banking. That simple.

    If this really does go down, that will be a pretty big statement about PC security in general. Regardless of who is responsible, if a bank says it will no longer trust the end user's security that is a bad omen for the rest of e-commerce. What about the credit card companies? How will they react to the bank's position?
  • by LordOfYourPants (145342) on Sunday April 06, 2008 @02:56PM (#22981514)
    This may sound facetious, but is any system really secure from keylogging?

    I dual boot Ubuntu and Windows. If I type:

    sudo apt-get install lokkit (as an example, not an accusation) how do I know I'm not getting a free keysniffer as an added bonus?

    I run windows with a firewall, have a firewalled router with minimal ports forwarded, use ad-aware/the windows spyware program/spybot search and destroy as well as AVG. How do I know that none of these pieces of software are, in themselves, spyware/keylogging software? How do I know that my browser hasn't been attacked by some 0-day hack embedded in an ad banner despite rigorous/consistent upgrading of both of my OSes?

    Are people really diligent to that point that every time they're about to do their banking, they close all active programs, update and run their suites of virus scanners and anti-spyware software, and *then* do their banking once the all-clear is given by all programs?

    Honestly, I just see it as a game of probabilities. *Most likely* I don't have a key logger installed on my system, and *most likely* my banking experience is going to be a sane one, but if the shit ever hits the fan, I'm willing to bet that there are people hired to specifically poke holes in my system and say "Linux is an unapproved OS. We can't cover your banking losses."

    I look forward to a better solution.
    • Re: (Score:3, Insightful)

      by WindBourne (631190)
      sudo apt-get install lokkit (as an example, not an accusation) how do I know I'm not getting a free keysniffer as an added bonus? Unless you personally check the code yourself, AND know what to look for, then no, you do not really know (even then, you may make a mistake). But based on past history, I would trust k?ubuntu over MS.
  • This is crap (Score:5, Informative)

    by Mwongozi (176765) <(gro.revolgdivad) (ta) (eerhthsals)> on Sunday April 06, 2008 @02:57PM (#22981520) Homepage

    My old bank [barclays.com] closed my online banking account without warning, and without bothering to tell me they had. I called them and they said it was because "I had a virus". This, despite the fact that I run a secure operating system [apple.com] (with no known viruses) and have an up-to-date virus scanner [sophos.com]. Couldn't they just suspend my account until I "fixed" the problem? No, I had to open a whole new one.

    I did. At another bank [firstdirect.com].

  • There's many, many companies out there running important financial machines on a certain large software vendor's OS without proper group policies or even passwords. Still! Whole networks with unpatched NT machines with blank superuser passwords. These companies will be struggling to become Sarbanes-Oxley compliant for years to come.
  • by Copley (726927) on Sunday April 06, 2008 @03:00PM (#22981552)
    ... from physical cheque books and credit cards. If I leave my wallet in a place where cards, etc. might be stolen, I'm responsible for any loses that occur - shouldn't the same be true if I leave my electronic 'wallet' open? I really think that, within limits, people need to be held responsible for their actions/inactions - too much 'I never realised/knew/expected/thought that might happen' in the world. The banks should have similar guidelines to those used for stolen physical banking paraphernalia - if you suspect your PC might have been compromised, report it to the bank within a given time fame and they thereafter accept responsibility for subsequent losses.
  • by Whuffo (1043790) on Sunday April 06, 2008 @03:33PM (#22981810) Homepage Journal
    Banks are responsible for the safety / security of the assets entrusted to their care. They protect those assets by erecting barriers and using authentication to insure that only the person who the asset belongs to can access it.

    So just exactly who decided to put customer information / account access on the internet where security problems are widespread and well known? Those so-called professionals at the banks must have known that this would lead to problems - and did it anyway.

    Pointing at insecure computers, spyware, malware, etc as being the problem is ingenious. This is simply an attempt by the bank to move some of its expenses onto its customers.

    Remember - none of these internet security / fraud problems would exist if the bank hadn't put the customer accounts online. They knew this was likely to happen and now this bad idea is starting to affect their bottom line. Rather than take responsibility for their mistake, they're abusing the legal system to move the losses onto their customers.

    Gotta love those banking corporations...

  • by meowsqueak (599208) on Sunday April 06, 2008 @03:45PM (#22981878)
    it proved so unpopular that banks were effectively forced to reduce their hard-line stance:

    http://www.consumer.org.nz/newsitem.asp?docid=5114&category=News&topic=Internet%20banking%20rule%20back-track [consumer.org.nz]

    • Re: (Score:3, Interesting)

      by pigwin32 (614710)
      I think it was more the stance that was at issue and not that the code of practice was actually being enforced. Kiwi banks are far more concerned that an incidence of fraud might damage their reputation and put customers off using what is a cheap and effective channel. Consequently they will tend to pay out any losses in order to keep below the media radar. Banks could quickly solve this problem by introducing secure challenge response tokens but the cost would be enormous and many users would struggle with
  • Fsck the Bankers (Score:3, Insightful)

    by Detritus (11846) on Sunday April 06, 2008 @03:49PM (#22981914) Homepage
    Aren't these the same bastards who had a police constable arrested and convicted of attempting to obtain money by deception after he inquired about unauthorized withdrawals from his account?

    http://catless.ncl.ac.uk/risks/18.25.html#subj5 [ncl.ac.uk]

    Why fix your own systems when you can blame the customer?

  • by Chris Snook (872473) on Sunday April 06, 2008 @04:03PM (#22982006)
    "If you act without reasonable care, and this causes losses, you may be responsible for them."

    In other words, if your authentication info gets stolen by a virus that's in the wild, and would have been blocked by up-to-date antivirus software, you're responsible for what happens as a result.

    This does not appear to be intended to make the customer's software a scapegoat, just to hold people responsible for failure to take reasonable steps to protect their accounts. It is still very much in the bank's interest to improve account security measures, as most losses will not be clearly attributable to a cause that would allow this provision to be invoked.
  • by Doc Ruby (173196) on Sunday April 06, 2008 @04:47PM (#22982286) Homepage Journal
    Of course the bank shouldn't be responsible for losses incurred that are because the customer's own access device had a problem the customer should have known to fix. If the customer's device was vulnerable, but not actually compromised, of course the bank is liable if the bank's system caused the loss. Even if the customer's device was vulnerable and compromised, if that compromise didn't cause or contribute to the loss, of course the customer is not liable, if the loss was entirely the bank's fault.

    If the loss was incurred by a bad guy exploiting an open vulnerability in the customer's access device, then the liability should be exactly the same as if the bad guy had entered the customer's home and stolen the key to their vault at the bank. If the door was locked, the customer is not liable at all, and the burglar is fully liable.

    If the "door" was not locked, then the local laws, wherever the burglar did whatever they did to subvert the customer's device, will determine whether the burglar has any less liability for picking an easy target. The laws local to the customer's "unlocked door" will determine whether the customer has any more liability.

    This is all a matter of obvious principles of liability for one's actions, and long-settled law governing that liability. Of course the bank is liable for losses it caused, even if just through negligently failing to protect its own systems. Now, of course the bank is going to try to weasel out of that liability, if it can: banks don't care about principles or laws, just the money they can make or lose. But if I leave my credit card at a restaurant, and then some burglar breaks into my safe deposit box while the bank security guard sleeps, of course the bank is liable, and not me, and not the waitress who was trying to charge a new TV to my account at the time - even if she's responsible for the TV charge, completely independently.
  • by jskline (301574) on Monday April 07, 2008 @07:22AM (#22986982) Homepage
    If Barklay sets up this stuff and adheres to it, and I as a possible customer have an account there by which I physically pay my bills by cheque, but never by using any of the online services, and in fact never even initialize any of the access online, and someone accesses my account and rips me for all my funds, am I still responsible??

    I think that deserves a look don't you? Language after all; is still legal and how you phrase your "terms of service" is how you either are forced to replenish the customers funds, or you get off Scott-Free and not face any repercussions.

    Just a thought...

When all else fails, read the instructions.

Working...