Everything You Know About Password-Stealing Is Wrong 195
isoloisti writes "An article by some Microsofties in the latest issue of Computing Now magazine claims we have got passwords all wrong. When money is stolen, consumers are reimbursed for stolen funds and it is money mules, not banks or retail customers, who end up with the loss. Stealing passwords is easy, but getting money out is very hard. Passwords are not the bottleneck in cyber-crime and replacing them with something stronger won't reduce losses. The article concludes that banks have no interest in shifting liability to consumers, and that the switch to financially-motivated cyber-crime is good news, not bad. Article is online at computer.org site (hard-to-read multipage format) or as PDF from Microsoft Research."
The hell it doesn't cost consumers! (Score:5, Informative)
When money is stolen, consumers are reimbursed for stolen funds and it is money mules, not banks or retail customers, who end up with the loss.
I had my identity stolen years ago by a guy who managed to run up a bunch of charges on my bank credit card (still don't know how he got the numbers). And, while the bank did reimburse me for the stolen money, they most certainly DIDN'T reimburse me for over $200 in bounced check charges that came after he cleaned out my account, or the hit that my credit rating took after a bunch of companies reported me as a deadbeat for passing bad checks and missing automated billing deadlines. Yeah, just TRY repairing your credit rating after something like that and tell me that consumers don't take a hit for identity theft.
Re:The hell it doesn't cost consumers! (Score:4, Insightful)
I bet he ran it up way more than 200$.
now if you were a money mule you'd be hit with paying for 4950$ you transferred for some guy in ghana.
Re:The hell it doesn't cost consumers! (Score:5, Informative)
They also don't reimburse the cost retailers have to pay for each fraudulent transaction.
Re:The hell it doesn't cost consumers! (Score:5, Insightful)
Re:The hell it doesn't cost consumers! (Score:5, Insightful)
Not only that, but your reimbursement had to come from somewhere, and it's not the CEO's pocket. It's everyone else's pockets in increased fees.
THIS.
As well as increased insurance costs. The authors of the article are rather dense if they honestly think that the costs of reimbursement are not passed down to consumers.
Re:The hell it doesn't cost consumers! (Score:5, Insightful)
That's exactly what TFA says. Banks like the fear of lost passwords, because they can use that fear to their (profitable) advantage:
"When perceived risk is greater than actual risk it can be protable to absorb the risk and charge for it. Rental car companies are not merely willing, but anxious to accept liability for any damage to the car for $35 a day; various companies aggressively market identity theft protection for $12 a month. Banks enjoy a huge information advantage over consumers: they know how much fraud costs them, while consumers merely hear horror stories of cyber-crime losses. Passing liability to consumers...would seem to be wasting a protable opportunity."
Re: (Score:3, Funny)
That's exactly what TFA says. Banks like the fear of lost passwords, because they can use that fear to their (profitable) advantage:
"When perceived risk is greater than actual risk it can be protable to absorb the risk and charge for it. Rental car companies are not merely willing, but anxious to accept liability for any damage to the car for $35 a day; various companies aggressively market identity theft protection for $12 a month. Banks enjoy a huge information advantage over consumers: they know how much fraud costs them, while consumers merely hear horror stories of cyber-crime losses. Passing liability to consumers...would seem to be wasting a protable opportunity."
Protable? WTF is protable?
How can you possibly introduce a spelling mistake...TWICE...with a cut/paste?
Re: (Score:2, Interesting)
Come now, it doesn't take much brain power to figre out that it's a typo of "profitable." You know, supposedly what separates us from animals and machines is this thng called intelligence which you can use to apply context to a situation and derive the correct meaning of a mistyped word.
What you might not know: he probably copied the quote from the PDF document where 2-letter sequences such as "fi" and "ti" are encoded differently (I believe it's called kerning but I could be wrong) and when you copy/paste
Re: (Score:2, Informative)
You are wrong. It's called ligature. Kerning refers to adapting the spacing of adjacent characters depending on their shape, e.g. moving the letters in "AV" closer together.
Re:The hell it doesn't cost consumers! (Score:5, Informative)
FTA:
"Thus, in the US, individual consumers are largely insulated from the direct financial consequences of credential theft..." (emphasis in original)
"While 'we all pay for cyber-crime' is true in a general sense, it is not the case that individual users face grave financial risk."
They're pretty clear that they are discussing risk of catastrophic loss to a single individual rather than increased shared costs.
Re:The hell it doesn't cost consumers! (Score:4, Interesting)
That's addressed right in the summary. The banks generally manage to get their money back from one of the intermediates used to transfer the money out in the first place. It's those suckers that eat the majority of the loss.
Re:The hell it doesn't cost consumers! (Score:5, Informative)
Yes, you do have to fight those things, because among other reasons, the banks deliberately do choose to keep the bounced check charging people out of the fraud reporting loop, so you have to find somebody to knock the heads together and get the information shared. And even then, your liability is controlled by state law, so that limit is up to them anyway.
Your credit rating, however, you can repair, by disputing those false charges. And if the credit rating company mishandles that, you can get some serious money out of them.
Re:The hell it doesn't cost consumers! (Score:5, Informative)
Clearly, you missed the 60 Minutes report this week about Credit Rating companies and their dispute process (source [cbsnews.com]).
In a nutshell, your dispute is never sent to someone who will approve it, and you basically have to sue them to fix it. Its a multi-year case and you better be well documented.
Re:The hell it doesn't cost consumers! (Score:5, Insightful)
I've disputed several inaccuracies on my credit report, and had most of them removed without further fight.
I'm not saying 60 minutes is full of shit, but ...
60 minutes is in the business of selling scare stories. A little bit of cherry picking goes a long way.
Re: (Score:3)
Re:The hell it doesn't cost consumers! (Score:4, Informative)
From TFA: "This does not mean, however, that password-stealing is a minor problem. The indirect costs of cyber-crime almost certainly dwarf the direct losses by orders of magnitude. While password-stealing victims are spared direct losses, they may spend considerable time and energy resolving the mess."
Re:The hell it doesn't cost consumers! (Score:5, Informative)
Either your bank sucks or you didn't browbeat them enough. They should reverse the bounced-check charges resulting from the stolen money.
You need to dispute the results of identity theft on your credit rating. If the rating agencies refuse to fix it, you can sue the pants off them.
Of course, this is a lot of trouble and it sucks pretty hard. TFA actually agrees with you on this.
Dump the Visa/MC-debit! (Score:4, Interesting)
It sounds like you had a Visa-branded debit card, not a credit card. Visa/MC Debit cards serve no use other than to enrich the bank, the merchant fees are much higher than PIN-debit. And, as you have learned, if a thief gets a hold of your number, your bank account is empty and your bills bouncing while you argue with the bank.
It's far better to get a credit card and simply pay off the bill every month. That way, if it gets emptied, you argue with the bank about THEIR money. (With a Visa/MC Debit, you argue with the bank about YOUR money. Guess which dispute gets more attention?
And yes, the bank should have paid up the bounced check fees... might as well dump this loser of a bank entirely and sign up with a Credit Union.
Re:Dump the Visa/MC-debit! (Score:5, Insightful)
There is another reason for these cards: to avoid the legally-mandated consumer protection that exists for credit cards.
Re: (Score:3)
Visa and mastercard give all kinds of consumer protection benefits just for using the card, though I don't know whether they apply to both debit and credit. For example, my card includes a free extra year of warranty on anything I buy, free insurance on rental cars, guaranteed 30 day money back on anything I buy as well as accidental damage.
I use a credit card though, supposedly their top tier (they call it world mastercard). I quality for it in spite of paying zero interest (and so many people keep insisti
Re: Dump the Visa/MC-debit! (Score:4, Informative)
This is a big reason why I outright refuse to carry a debit card, even to the point of insisting to the bank that they give me a plain old ATM card for my account.
I just feel more comfortable having a buffer between my transactions and my actual accounts, where I have to take active action for so much as a dime to go from one to the other.
And as said above, the fraud argument happens with their money, not mine.
Banking passwords are overrated (Score:5, Interesting)
I have used a fair number of different banks over the past couple decades and seen a lot of different online banking systems. Not once have I seen one where you could actually use the online system to arbitrarily move money outside the account owner's accounts. I have seen some where you can set up bill payments, but that was a chore and would not be useful for trying to pull money out quickly. Most online banking systems intentionally do not even give full account or routing numbers to logged in users, and I've never seen one give out SSN or DOB either.
On the other hand, people keep a lot of personal information on their PCs. If you can get their personal user names and passwords you could get a lot more useful information on them. A lot of users likely have their SSN and DOB in their browser cache somewhere, and almost everyone has their address somewhere in there.
Re:Banking passwords are overrated (Score:5, Informative)
online banking- mine pulls up full images of check faces... which does include routing & account #'s
Re:Banking passwords are overrated (Score:4, Funny)
It puzzles me when I see that people work really hard to come up with difficult passwords for their bank accounts
And do you see people coming up with such passwords often?
Most online banking systems intentionally do not even give full account or routing numbers to logged in users, and I've never seen one give out SSN or DOB either.
Hmm... you're familiar with most banking online systems?
You almost had me convinced to make a super easy bank password. Nice try, identity thief!
Re:Banking passwords are overrated (Score:5, Informative)
I have accounts with First Niagara (they acquired my HSBC account), ING Direct (recently acquired by CapitalOne) and Ally Banks. I frequently move money between them through the web interface - real easy to set up, you just need to be able to log in to both accounts you're transferring between. Furthermore, my girlfriend has an account with Keybank and we transfer money from her account to mine about once a month to cover living expenses (I pay for almost everything up front, she pays me her share monthly). All I needed from her to set it up was her password.
If I get your banking login info, I can probably get a good chunk of your money before you realize it. Fortunately, many banks offer email alerts for transfers over X amount or if another account has been added. However, if you target someone who doesn't check their balance or email more than once or twice a week, you can probably get away with it before they know it's happening.
Re:Banking passwords are overrated (Score:5, Informative)
I have accounts with First Niagara (they acquired my HSBC account), ING Direct (recently acquired by CapitalOne) and Ally Banks. I frequently move money between them through the web interface - real easy to set up, you just need to be able to log in to both accounts you're transferring between. Furthermore, my girlfriend has an account with Keybank and we transfer money from her account to mine about once a month to cover living expenses (I pay for almost everything up front, she pays me her share monthly). All I needed from her to set it up was her password.
If I get your banking login info, I can probably get a good chunk of your money before you realize it. Fortunately, many banks offer email alerts for transfers over X amount or if another account has been added. However, if you target someone who doesn't check their balance or email more than once or twice a week, you can probably get away with it before they know it's happening.
Same here in the UK. With FasterPayments [fasterpayments.org.uk] I can transfer money from a NationWide account to a Braclays or a Coop within minutes. My Brother in Law used this recently when his daughter didn't have enough money to buy a train ticket home from uni, she was in the station, called, he transferred the money and she withdrew it from the CashPoint (ATM) a minute later.
Re: (Score:2)
Re: (Score:3)
With NatWest I have to use a card reader and my PIN to set up a new payee online. Someone who broke into my account could pay my credit card bill or transfer money to my brother but would find it hard to actually gt their hands on my cash.
Its same with Nationwide and Coop. YBS uses a confirmation by phone system, where a an automated call tells you a number that you need to enter on their site.
Re: (Score:2)
We are safer here in the USA. our banks REFUSE to do that. Unless you pay them $50.00 as a fee to do it.
Re:Banking passwords are overrated (Score:4, Funny)
Re: (Score:2)
I just have to put in my username, password and some sort of online PIN or security question for each account. As far as I'm aware, only one of my banks even offers any sort of additional security like you describe.
Re: (Score:2)
It is a pseudo-random number generator devices. In the U.S. , I have seen two financial companies doing it: E*TRADE and Blizzard Entertainment.
Re: (Score:2)
The encryption key fobs you describe are not generally used by consumers as part of their typical banking practices. I don't know if they are even available to most people for that purpose.
But yes, I've seen them used internally within firms that highly value the security of their data/money.
Re: (Score:2)
What if I transferred it to my account and then withdrew it as cash or wired it as soon as it was under my control? I see bank-to-bank transfer as the first step of a chain where the thief first has control over the money.
Re:Banking passwords are overrated (Score:4, Informative)
> Not once have I seen one where you could actually use the online system to arbitrarily move money outside the account owner's accounts.
Huh? Just go to "transfer money", write the account number of the receiver and the amount, and off the money goes.
At least that is how it works here in Denmark. Very handy, too. Is the US still using personal paper checks?
Re: (Score:2)
Some banks, like ING Direct, even allow you to transfer money between two phones if you have their app installed. Steal someone's phone, find they have their passwords saved, install the app on your phone and transfer away.
Re:Banking passwords are overrated (Score:5, Informative)
Huh? Just go to "transfer money", write the account number of the receiver and the amount, and off the money goes.
At least that is how it works here in Denmark. Very handy, too. Is the US still using personal paper checks?
The article is talking about irreversible and untraceable money transfer. If the bank has been given "the account number of the receiver and the amount", it is neither irreversible nor untraceable. When the person defrauded complains to the bank, they reverse the transfer.
Thus, the thief needs a mule, a person with an account that can be used to accept the transferred money and turn it (somehow) into untraceable cash.
Some banks, like ING Direct, even allow you to transfer money between two phones if you have their app installed. Steal someone's phone, find they have their passwords saved, install the app on your phone and transfer away.
Transfer to whom? To steal money by such a transfer you need to make an irreversible transfer to an untraceable account. (If it's not irreversible, they just take the money back; if it's not untraceable, they come after you and put you in jail.) The whole point of the article is that this process, making a transfer that the bank can't reverse and sending the money to an account that the law can't trace, is much more difficult than the process of stealing passwords.
Re: (Score:2)
This would be Step 1 - getting control of the money. Once you have control of the money, then you can worry about moving it to an untraceable, irreversible account or withdrawing it as cash. Step 1 is merely the most difficult to do.
Re: (Score:3)
This would be Step 1 - getting control of the money. Once you have control of the money, then you can worry about moving it to an untraceable, irreversible account or withdrawing it as cash. Step 1 is merely the most difficult to do.
No. you have got it exactly backwards. And that's the main point of the article. Getting control of the money is easy. You steal someone's password and you now have control of the money. Happens millions of times a year.
But then you have to transfer that money somewhere else in such a way that it is not reversable (the bank can't take the money back) and not traceable (they can't identify you and come arrest you). THAT is the hard part.
Re: (Score:2)
and off the money goes.
off the money goes really Fing slowly. There is no technical reason why a credit card payment can't be posted as fast as a charge, for example, in minutes at most. I get an alert when I make a credit card charge and the alerts usually arrive in minutes at most. However, intentionally... probably... my bank's bill pay system takes an absolute minimum of one business day to process a bill pay (sometimes more) and they send email alerts to me both when its set up and on the morning of the actual day of the
Re:Banking passwords are overrated (Score:4, Interesting)
Most financial institutions do batch processing, not real-time processing. Your average bank will do all of the deposits first, around 3pm each business day, and then do all withdrawals. That's the main reason most transactions take a minimum of one business day.
Re: (Score:2)
And when they batch process the withdrawals they are sorted from the largest transactions to the smallest, that way if you overdraw, there are many more individual transactions affected, and thus many more overdraft fees
Imagine if you have $500 in your account, and a $500 check for a car payment went through that day, and earlier in the day you used your debit card all over the place - a $1 drink from Sonic, got some gas, bought a few groceries, etc. If all the small transactions were processed first then
Re: (Score:3)
Re: (Score:2)
Re: (Score:3)
This is how it works in the US too. The poster just hasn't seen or noticed it (I would go with noticed it). But there is a difference between transferring funds and wiring funds. I can do as you describe and it will take a few days for the money to get from one account to the other. If you wire funds it is basically immediate and the money is gone.
Note the there is a difference between "making funds available to an account," and "actually having money in an account." Checks vs wire transfers have different speeds at which funds become available, but the actual "having the money for sure" can take an open ended amount of time (60 days or more, worse case.) So even if $100K is wired into your account, you can spend it, and next week find you owe the bank $100K because the wire transfer was later rejected.
The "funds on hold" time period for checks is th
Re: (Score:2)
Re: (Score:3)
The non-transfers I was talking about are not checks, just electronic transfers between accounts at different banks (but I guess they may be treated that way and pass through the ACH, I am not a banker so Ill trust you if you say it is the same). I really thought when I wired funds they were gone. The last time I closed on a mortgage my bank asked my like 10 times if I was sure the account was correct and if I really wanted to wire 22K to them because it couldn't be reversed.
It can still be reversed, but typically not by you on a whim :) So, they want you to be really sure you are sending the right amount of money to the right counterparty: it makes their job a lot easier.
Thousands of wire transfers are reversed every day: software problems, miskeyed data, obsolete routing info, various post facto triggers (fraud alerts, money-laundering alerts, terrorist alerts, etc.)
Re: (Score:2)
Re: (Score:2, Interesting)
I have used a fair number of different banks over the past couple decades and seen a lot of different online banking systems. Not once have I seen one where you could actually use the online system to arbitrarily move money outside the account owner's accounts. I have seen some where you can set up bill payments, but that was a chore and would not be useful for trying to pull money out quickly.
I was curious, so I checked the services offered by Wells Fargo Bank, NA. Through their online banking system one can:
Transfer Money & Make Payments
Transfer to/from a non-Wells Fargo Account
Add a non-Wells Fargo Account
Send & Receive Money
Transfer to Another Country
Set Up Recurring Transfer
Set Up Re
Re:Banking passwords are overrated (Score:4, Interesting)
I feel quite safe with that.
Re: (Score:2)
Re: (Score:2, Insightful)
It's amazing how different financial infrastructure is between countries. SWIFT (wire transfers) and Visa/MC/Amex are probably the most universal funds transfer systems worldwide.
Interesting side note (I work in the credit card industry), the reasons cited for the U.S. being slow to move to Chip & PIN include: 1) U.S. merchants were on the mag-stripe bandwagon (or simply started accepting cards) sooner and hence have a much larger installed base to convert, 2) U.S. banks moved to 100% fraud protection
Re: (Score:2)
With mine I can transfer money. However, it's protected way beyond a simple password. I need a "random reader": a simple device that accepts my debet card, requires my PIN and gives me back the one-time key to even see my details. When signing a transaction I need to give the PIN, a one-time key from the webpage and the amount of money before the comma (probably to prevent hijacking).
I feel quite safe with that.
When setting up a new payee, my UK bank sends a one-time code to my mobile phone that I need to enter via the web. I sort of feel safe with that.
Re: (Score:2)
It puzzles me when I see that people work really hard to come up with difficult passwords for their bank accounts, but not for their personal accounts on their own computers. They really need to think about what value those passwords have to other people - in particular what could someone else do with those passwords if they had them?
The attack scenarios are very different. Most home PCs do not have any remote access service enabled. So your password is safeguarding your computer from someone who is physically present but has neither the time nor the technical skill to bypass it. That's often, but not always, a very rare occurrence. (If it's a laptop and you were prudent enough to use full-disk encryption, that password is actually being useful.) Your banking password is protecting you from anyone who is (a) on the Internet and (b) disc
Re: (Score:2)
Not password stealing. (Score:2, Interesting)
First of all, it's not theft if you still have your password. Secondly, if you leave your car unlocked with the engine running and go shopping, will the insurance company pay you back for your loss or call gross negligence? There's a difference between having a reasonable password for banking that's not the same one you use everywhere, and between using "hunter2" for every single place you have an account. And finally, I'm pretty sure banks don't reimburse money stolen from shops. Same goes on here. If some
I dunno... how much is a good fake ID? (Score:3)
if you got my bank password... you could use online billpay to mail a check and cash it... if it was under a thousand, my bank wouldn't blink.
so scenario.. I get a good set of identity papers, even just a license together for a lady who works all day
I have, 10 account passwords at different banks and use online billpay to mail out 10 checks for $900 + odd amount checks.
I swipe them from the mailbox of the lady who works all day....
I cash them all on the same day- visiting 10 issuing banks...
burn the ID
yes, I see where that could fall apart in a few spots, but I'm not a professional grifter, a variation of it should be achievable.
Re: (Score:2)
Not worth it [Re:I dunno... how much is a good...] (Score:4, Insightful)
if you got my bank password... you could use online billpay to mail a check and cash it... if it was under a thousand, my bank wouldn't blink.
so scenario.. I get a good set of identity papers, even just a license together for a lady who works all day
Identity papers good enough to fool a bank cost money.
I have, 10 account passwords at different banks and use online billpay to mail out 10 checks for $900 + odd amount checks. I swipe them from the mailbox of the lady who works all day....
I cash them all on the same day- visiting 10 issuing banks...
burn the ID
yes, I see where that could fall apart in a few spots
It sure does. For a profit of $9000 (minus the cost of forged identity papers), you have left your image and paper trail in the security camera of the bank you used to transfer the money, plus ten other banks; plus stealing from the U.S. mail probably over four or five days and hoping that the nosy neighbors weren't watching. You're hoping that none of the ten got their bank statement and noticed the check payment in the three days it takes the check to be mailed. And once the first person complains, the warning about your forged identity is going to go out to all the other banks, and so when you cash check number n, you're hoping that the account holders of checks 1 through n-1 haven't been complained yet. And banks in the US have a three-day hold on availability of funds from checks; so you are going to have to wait and hope not one of ten people noticed the withdrawal.
Suppose it is a 5% probability of getting caught on any one transaction. On the average, you'll make $18,000 before being caught. That is so not worth it.
Or you could just use online bill pay to transfer money to a prepaid credit card.
Except that banks do know that trick and protect against it. It's not hard to put $50 on a prepaid credit card without leaving tracks. Try putting $9000 on a credit card, and they start keeping records of who you are.
New plan... not so good [Re:Not worth it ] (Score:3)
This could be simple if you just get a few druggies to help you out.
Have the checks put in the name of 5 - 10 druggies, using their real names. Make it seem like you have a bunch of freelancers renovating a house or something. Mail it to a neighborhood where the neighbors don't give a fuck.
Have the druggies cash the checks, at places away from their homes/areas they hang out in (i.e. where the bank tellers don't know them). They won't care if their ID and picture is seen in the bank, because they're getting drugs out of the deal.
So, let's see, the druggies cash the checks, and promptly snort the money up their noses ("see, like, we was planning on giving you a cut a the money and everything, uh, cause you was helping us out and all, you know, but my dealer was there and I already owed him ten grand, and plus I really really needed a fix..."), and you get nothing.
Then, when they get picked up (because they did use their own names...), all 5 - 10 of them finger you as part of the plea bargain.
So, your profit is zero, and you have fiv
Re:I dunno... how much is a good fake ID? (Score:4, Informative)
yes, I see where that could fall apart in a few spots, but I'm not a professional grifter, a variation of it should be achievable.
My brother-in-law IS a professional grifter, and he has spent more of his adult life in prison than as a free man. I assure you that the scheme you described will not last for very long at all (in the US).
TFA described exactly why you need some idiot "mule" to act as your middleman, and described exactly why that idiot "mule" is the one that ends up losing all the money (the original victim is always made whole). And TFA described why the real bottleneck in financial fraud is in recruiting idiot "mules" and not stealing passwords.
It stands to reason that making it harder to recruit idiot "mules" would have a far greater benefit than making it hard to compromise banking passwords.
Ummm.... (Score:2)
OK, so say someone steals money from your account.
the thief has made money.
If someone notices the theft I guess you get your money back, at least that is what the article claims.
I guess banks have insurance for this sort of thing, but even if they do they would pay more in insurance payments than they would in actual dollars lost over time; That is how insurance works. So they do lose money, unless they are allowed to make new money when some is stolen. This loss is passed onto you the customer.
Re:Ummm.... (Score:4, Insightful)
because there was talk about moles I'm assuming it's usual that it's moved to some gullible idiots account, who takes a fee and forwards the money(nigeria scam sort of) via untraceable method.
so that guy ends up paying the damages.
Re:Ummm.... (Score:4, Interesting)
I had a friend who unwittingly served as a mule for dirty money to be laundered through his account. He was approached, asked if he'd be willing to deposit some checks, wait a few days, then transfer them (minus a small percentage for himself) to another account. He didn't see a problem with that, and hey, it was easy money! So he agreed.
When the feds came a-knockin', he was lucky all he had to do was pay the money back, rather than go to prison.
Re: (Score:2)
Yes, the cost is passed on to you the customer. The whole point of the exercise is that the cost of actually doing something about it(which will also be passed onto the customer) is orders of magnitude higher than the cost of the fraud. They don't actually have insurance for this, it's just cheaper to write it off than it is to fix it.
I think the article misses the point (Score:5, Insightful)
The gist of TFA is that since the transfer from the person with the compromised password to the mule is reversed it is the mule that loses out, so the password isn't the bottleneck. (evidently the bottleneck is mule-recruitment and back-end fraud detection). This rather misses the point that it is a potential stopping point. If the account cant transfer money to the mule then the mule can't be persuaded to take commission and send the rest on by Western Union.
Maybe I'm cynical, but it seems to me that this analysis is a big "not my problem" statement by Microsoft. The client-end OS and browser security, which Microsoft has a big share of are not the "real problem" - that lies at mule recruitment and backend fraud detection systems, both areas where Microsoft has little investment.
Re:I think the article misses the point (Score:5, Insightful)
Re: (Score:3, Insightful)
I think the article is spot-on. Their point is that anti-fraud resources could be better directed. There is so much hemming and hawing about how insecure passwords are and how they get lost and how they can be cracked when the PW is only the first hoop a would-be thief would have to jump through and a low one at that. The defense has to be the whole system. The article speaks to that briefly:
"If a large lake of credentials is drained by a narrow pipe of mules then reducing the inflow to the lake might have
Re:I think the article misses the point (Score:5, Insightful)
I think what they are getting at is that criminals have access to X passwords and Y mules, where Y is significantly less than X. Lets say they have 10,000 passwords for every mule that they have, and each mule will perform 10 transactions before they are caught out (or catch on, depending). That means you could reduce the number of leaked/grabbed/cracked passwords by 99% and still have the exact same amount of financial crime; and none of those numbers seem all that far outside of the realm of possibility to me.
But that is about overall crime and statistics. You can still lower your risk of being a victim by choosing strong passwords, keeping a clean pc, etc.
too hard (Score:3)
Using their numbers, we would have to introduce security measures that made passwords 1000000% more difficult to obtain, than they currently are, in order to put credentials on par with mules in terms of value. Having N mules available and N+1 passwords available, the amount of crime would be no less than if we had N*10^6 passwords available. They do not mention why we cannot remove the ability for a money owner (mule) to initiate large unrepudiable transactions. They indicated this was usually via weste
Re: (Score:2)
Well essentially every libertarian on Slashdot and a whole mess of criminals would complain that you've made it very difficult to move untraceable cash around(which is sort of the point). To be honest I'm not sure this is a particularly big deal since you can still drive around with a big old briefcase full of cash.
Fundamentally though you'd make life harder for people who don't have access to computers and the modern world. In particular you'd make it difficult for immigrants to send money back to their fa
Re:too hard (Score:4, Interesting)
I so wish for mod points. Western Union/Moneygram are the "Banks" for people without the ability to now meet new Federal Standards for State Issued ID. The paperwork required today in many states just to get a new "Secure ID" are ridiculously bad if you've done anything other than be born in the last 60 or so years, gotten married, receive physical bills & bank statements, and had those items delivered to your physical address (which assumes you can receive mail at your physical address).
So it isn't just "illegal" immigrants using these services, anymore. It's a large segment of the lower end of society that is being forced to utilize these services so they can pay utility bills with cash, money orders, and move money about to relatives. You're actually causing severe harm getting rid of the cash-based services.
Off topic: Lucky me, I've bypassed the "chain of name changes" requirement by having a Passport. My adoption papers don't even exist anymore thanks to a house fire and an flooded court house basement. I'd be so screwed if it weren't for the fact my employer required me to get a passport 3 years ago.
No it's not.... (Score:3)
Another headline that may misslead people. Password stealing is not just a banking problem. Attackers may do a lot of damage to a person without needing to extract the money directly.
The most important lessons for passwords are:
1. One password, one service. Do not re-use passwords.
2. Prefer long to complex passwords.
Using a sentence that is important to you and modfy it per service.
E.g. "may the face be with you" for Facebook or "may the search be with you" for Google.
If the service allows such, you are beyond any rainbow table and those passwords are easy to remember and customize per service.
Re: (Score:2)
Using a sentence that is important to you and modfy it per service. E.g. "may the face be with you" for Facebook or "may the search be with you" for Google.
But then someone only has to get maybe 2 passwords to figure out your system. Then they have access to EVERYTHING.
Re: (Score:2)
There are two typical cases:
1. The attacker got your password at a hacked site.
2. The attacker got your password by being on your PC:
In case 1 he has one password, in case 2 he has all passwords. In both cases the weakness you mentioned is not relevant.
It is a weakness, but a rather small one compared to re-using the same password everywhere.
Also it makes it hard for an attacker to decrypt your stored password. To succeed he has to hack two sites which both store the password in plain text. I think we can i
Re: (Score:2)
When the question is wether to use a single password on multiple sites or writing all the passwords down, i vote for the second option.
Usually such things can be avoided, if the person is taught a password generating algorithm which modifies the password per site.
But writing them down (the safer with tools the better) is a lot better than re-using passwords all the time.
Re: (Score:2)
Microsofties? (Score:2)
Web security is no substitute for Crypto-Auth (Score:2)
So the argument is someone steals my password, steals my money, gives it to a money mule... then I get my money back from the bank, and someone that doesn't cost me in the end? Even disregarding the fact that those costs are going to get passed on to me somehow... The inconvenience of having to deal with identity theft is not always minor (and there's probably collateral damage here as well).
My biggest beef with banking is that I don't, but should, have the ability to send money with end-to-end authorizatio
Re: (Score:3)
Re: (Score:3)
Many transactions can be reversed, and it's especially simple to reverse easy to repudiate transfers.
So yes, all customers of the bank will pay their share for the increased security, fraud detection and the cost associated with reversing repudiated transaction, but the money actually retransferred does not come from the bank or the bank's customers.
Thus, what an account password thief has to do to empty a bank account is to initiate an untraceable a
Re: (Score:2)
Rate limiting factor [Re:Web security is no su...] (Score:2)
So the argument is someone steals my password, steals my money, gives it to a money mule... then I get my money back from the bank, and someone that doesn't cost me in the end?
No.
The argument is that convincing everybody in the U.S. to make their passwords harder to crack won't reduce the number of thefts from bank accounts using stolen passwords, because the rate at which passwords are stolen isn't the factor that controls how many accounts are stolen from.
It's really even worse than that (Score:5, Interesting)
About a year ago, I had my debit card stolen by a bartender, who used it to buy plane tickets for a vacation. Even though I *paid* for the tickets, the airline (*cough* Jet Blue *cough*) refused to give me the name of the passengers listed on the ticket. That in itself stunned me. Then it got worse.
I went through the bank, saying I could ID the person with 99% certainty (since the bartender was talking about not being able to pay for tickets at the bar that night). They of course referred me to the fraud department. The fraud department then of course referred me to File 13. Not one care was given to the matter. When I pushed on the issue, they asked why I cared, my account had been reimbursed. When I said it was the principle of the matter, they laughed and said the bank would simply write-off the loss and everybody wins.
It was then I realized the banks may actually *want* the fraud.
And I now trust my mattress more than any bank these days.
Re:It's really even worse than that (Score:4, Informative)
They don't want the fraud. It's simply more expensive to fix it than it is to lose the money and given that it's only money being lost for the most part(identity theft is a very different sort of issue with much broader consequences), no one gives a flying fuck. Sure there's a principle involved, but in the end is it righteous to spend tens of thousands of dollars chasing down a guy who stole a few hundred? Especially when you had dick all when it came to evidence. You hearing the guy whinging about not being able to afford a plane ticket shouldn't even be enough to get a warrant let alone an arrest and proving that the guy the tickets were bought for is the guy who bought the tickets isn't really all that cut and dry either.
Re: (Score:3, Funny)
Mattresses seem to be the banking instrument of the future:
1: No overdraft fees.
2: No fees on withdrawals.
3: No fees due to having a balance under x amount.
4: Accessible 24/7, not just "banker's hours".
5: No need to worry about a username/password.
6: No ID theft can slurp your balance dry.
7: Assets can only be frozen if your heater fails.
8: Interest rate is about the same as most CDs.
9: Computer glitches won't make the balance disappear.
10: No need to give all your personal info when starting a ne
Re: (Score:3)
11. No protection against physical burglary
12. No protection against devaluation
13. No protection against overnight invalidation of your currency (which can happen under martial law)
14. Paper burns
15. Family replace mattresses without you knowing it, throwing everything
16. Family inside job / theft
Re: (Score:2)
Re: (Score:3)
The police definitely would have been interested. I've had (on at least three separate occasions) flights that I was flying held at the gate at departure time so the cops could board and remove people who purchased their tickets with stolen credit cards.
That's got to be one of the DUMBEST things to buy dishonestly. I mean, purchasing something that guarantees you will be at a certain place at a certain time? Duh?
Everything you know is wrong (Score:2)
Online security for banks is a joke. (Score:5, Informative)
Fidelity. Made me choose all numeric password because alphabets would confuse their old retirees who use phone based transactions. I was shocked and wanted to disable phone based transactions on my account immediately. Was told to take a hike. They can't disable it without disabling on-line access as well. Was forced to continue the account because our company 401K is with these morons. Have not checked recently if it has changed.
ETrade They used to be good. They had the concept of a "trading password" on top of a regular password. Exactly what I wanted. You need to provide the trading password to actually do trade or cash out money or transfer funds. They took it away! I called to complain. They gave me a free RSA dongle. These jokers imagine their customers having an RSA key fob for each account. Cant ditch them. Our company stock purchase plan is with them.
Schwab would give a RSA fob if I asked. But don't know how it works with Quicken. Will upgrade to latest quicken and see if it is supported. Even then I don't fancy dangling around with key fobs.
PNC Bank if you setup an all numeric username it would also serve as your phone banking user id. But you need all numeric password to use it with phones. Thank you PNC! I set up an all numeric username and a alphanumeric password. So phone transactions are not possible. With VOIP and caller-id spoofing phone banking is as vulnerable as on line banking. At least let me cut down one attack surface.
Why cant they give me two level passwords? Why cant they implement a two factor authentication like google does with cell phones? Why cant they send a text message on every transaction so that I would be alerted by any fraudulent activity?
Re: (Score:3)
ETrade They used to be good. They had the concept of a "trading password" on top of a regular password. Exactly what I wanted. You need to provide the trading password to actually do trade or cash out money or transfer funds. They took it away! I called to complain. They gave me a free RSA dongle. These jokers imagine their customers having an RSA key fob for each account. Cant ditch them. Our company stock purchase plan is with them.
So what's the problem with Etrade having a RSA dongle? Seems to me it's way more secure to prevent credential capture, as the account login password is 'new' every minute and they timeout active logins fairly quickly.
No, STEALING, is wrong. (Score:5, Funny)
That's wrong terminology! Passwords are not Stolen!
Look, if you have a car and I steal that car then you don't have a car anymore.
If you have a password, and I get a copy of it, then you still have your password! We can both use the password, IT'S NOT STEALING.
Re: (Score:2)
If you have a password, and I get a copy of it, then you still have your password! We can both use the password, IT'S NOT STEALING.
Haha, I love it!
So I suppose copying passwords should be legal... Just transferring funds and identity theft need to be covered...
Summary: (Score:2)
Banks always benefit from CC fraud (Score:2)
Each fraudulent charge comes with a chargeback fee against the merchant when it is discovered, no matter the amount, and that's profit for the bank and the processing network.
Real problem is lack of notice (Score:2)
Cyber gangs and banking passwords? (Score:2)
Transaction Records (Score:3)
For a while I have thought that with all the data and transaction records, simply stealing money by transfering ought to be very hard.
Sadly many of these so called "mules" are small businessmen who ship goods thinking they got real money. Still a verification system might be able to help even them.
hard to read multi page format (Score:2)
You'd think those guys should know at least something about usability design. But nooooo.