Slashdot Mirror

If you can trust a CA-signed certificate for https://addons.mozilla.org/ why not one for https://citibank.com/ or https://mail.google.com?

Ultimately, if all the browsers start supporting notaries directly and ship with a list of major trusted notaries this won't be a problem. But bootstrapping a trust network to replace a presumably untrusted PKI while using that same PKI to validate the code you're using to replace it... It's sort of unfounded.

Like this: https://www.citibank.com/us/cards/vanpromo/cmc_pop/index2.htm
or http://www.bankofamerica.com/privacy/index.cfm?template=learn_about_shopsafe
etc...

Such a system already exists. It was developed by an irish company called Orbiscom which was recently bought-out by Mastercard.
It's got different names - disposable credit cards, one-time use credit cards, Controlled Payment Numbers, etc. Bank of America call's theirs ShopSafe, Citibank calls theirs Virtual Account Numbers. I believe PayPal and Discover have their programs too -- all based on Orbiscom's technology.

It works pretty much exactly the way you described - you log into your account, generate a new CC# with a maximum limit and expiration date that you specify. Then the first merchant account that posts a charge to the number becomes the only merchant account that post any more charges to that number. So even if the number does get stolen, it isn't any good to the thieves. Other than those limitations, for all intents and purposes, it is just a regular credit card. Most merchants can't even tell the difference.

I've been using ShopSafe for well over a decade now and have never had a fraudulent charge. The only problems I've had have been when the merchant is sloppy and double-charges with the intent of cancelling the first charge - Parts-express.com is the only merchant that I know which does that for all of their transactions and fixing it was simple enough - I just double the max limit on the CC#.

Not the AC either, but Citibank offers such a service. I've used it a few times for those random one-off purchases, especially from stores I will probably never do business with again.

Though, it's probably not very useful for subscription-type services or places you do business with regularly. (Unless you really want to generate a new CC number for each order.) I guess the previous poster's suggestion of having a low-limit card would be helpful in that case, something I plan to look into for myself.

Most banks let you make deposits by mail.

Citibank, Citicard virtual account numbers.

Bank of America ShopSafe

I've incurred overdraft fees based on merchant error a number of times, and every bank I have ever had has done everything they can to screw their customers out of as much money as possible. EA expecting banks to refund overdraft fees is like asking EA to ... I don't know ... behave like a company that cares about its customers.

http://en.wikipedia.org/wiki/Wire_transfer

http://www.bankofamerica.com/deposits/checksave/index.cfm?template=lc_faq_wire

https://www.wellsfargo.com/investing/styles/wt/com_fees/fees

https://online.citibank.com/JRS/portal/template.do?ID=MoneyXfrCompare

This is just to name a few.

Citibank, Bank of America, Discover and Paypal all offer disposable card numbers. American Express used to, but apparently stopped around 2004.

Wrong. Your HTTP headers don't end up on your Twitter "blog" (or whatever it's called), they end up on the attacker's.

And as for banks not having a public messaging feature, is Citibank big enough for you?
https://banking.citibank.com/JoinOurOnlineForum/UserGuide.aspx

But once again, do note that the page where the user's credentials end up doesn't need to be public; it just has to be accessible by the attacker.

The chance of this actually occurring is highly remote, to say the least. The technique of racing ahead of a potential 2-factor authentication is compelling in theory, but of little practical use

Some food for thought:

After you have successfully installed a Trojan into a victims computer you could:
- Log for a predefined time, the web usage, filtering specific sites of interest (like online banking logon pages)
- Extract time/date patterns of such information to predict the next time the victim will hit the interest page.
- Create a trigger that enables real time logging of the http traffic when the victim is login in. You can use VNC-like screen capturing for real-tiem monitoring.
- Ask the victim for TANs while impersonating the web page.
- Use those TANs along with other obtained information to gain unauthorized access to the victim's account.

That simply isn't true in the general sense of "banking relationships", the Patriot Act only requires that the institution confirms your identity and checks you against a blacklist. Many US banks will open checking & savings accounts for non-residents, although getting something like a credit card would be harder (and may be impossible, but I doubt it). I did it myself a few years ago, and I know a number of non-US residents living outside the US with perfectly legal US based accounts. You will need to do some paperwork to prove your identity if you don't already have a relationship with the institution, but a US mailing address/SSN etc is not required.

This site lists some of them, for example Citi who offer savings, checking, brokerage and Amex cards.

You're not the average user. Most people on Slashdot aren't the average user.

But what you are saying is that browser should just accept the invalid certificate and submit the data anyway.

I didn't say that anywhere. Please do not put words in my mouth.

What I am saying is that a lot of users don't have an expectation of privacy. They only notice problems. When there aren't warning dialogs popping up, they don't think about security. I'm saying that the entire paradigm is flawed because of this. Instead of SSL being the exception, it should be the rule, and deviation from the rule should be pointed out to the user every single time.

But even then, it probably wouldn't be enough. People have to have their crazy cursors and their dancing baby desktops.

You seem to have written your entire post with the assumption that I was agreeing or disagreeing with any of the posts directly above me. Not everyone automatically shares or rejects the opinions of the posts to which they reply. I simply thought it might spawn interesting discussion to point out that users may fall for MITM if they never even see a lock up in the corner of their browser window.

Want some evidence? People fall for phishing. I work for an ISP which has monitored phishing in the past, and quite simply, people will reply to the e-mails with their passwords and visit the webpages entering in their credentials. Every major phishing event has included people doing this. What makes you think that these same people will suddenly be security-aware when someone is intercepting their connections to mybank.com over port 80?

Take a major banking website:
http://www.citibank.com/us/index.htm
(I found this page by simply typing citibank.com into my browser.)

What happens when you go to that site? You go there, you click on "log me in" or whatever, and then it switches to SSL. Think the user is going to notice if it doesn't switch to SSL? Probably not. So one could MITM this site pretty easily and harvest logins. SSL never even comes into play. All of the "self-signed certs are no worse" or "ca-signed certs are way better" arguments don't even matter, now.

The banking sector is probably one of the slowest in terms of uptake of new crypto technologies. A huge number are still using 3DES or RC4 for symmetric to protect customers transactions. If you don't believe me, check out Citibank's Online Banking with "highly modern" RC4. I've seen 40-bit encryption on current express-pay keytags at a certain coffee chain which is almost trivial to crack with little cost by today's computers. In too many cases, it's the same old HSMs accelerating crypto transactions in servers as were in the last decade.

Granted, 3DES is actually not truly that bad in terms of its 112-bit effective security compared to AES-128 (though it's not the weak point when you use 80-bit effective RSA1024). However, just because ANSI X9 has started including modern technologies like ECC and AES or other technologies like quantum crypto are promising, you can bet that the banking industry will be one of the last groups to take up more modern crypto technology. Heck, even the NSA is mandating Suite B with ECC and AES by 2010 for government security! It's one of the few government agencies to actually act faster than the private sector.

Finally, I wonder if the original poster could show the relevant ANSI X9 aka banking security standard which calls out quantum crypto. I don't think I've seen one, and the banking industry typically lives and dies by X9.

Ignorance bliss, isn't it?

No, I'm secure in the knowledge of reality.

But show us what field in the cert includes the ip address for the fqdn listed the cn field? It doesn't exist! Again, how do you ensure the ip address the dns server resolved for www.citibank.com is really the ip address CitiBank.

DNS doesn't matter to SSL. At all. Think. Lets say that your spoofed DNS for www.citibank.com reports 2.2.2.2, which is your phishing site. So, I type https://www.citibank.com/ into my browser. What happens? My browser does a nslookup for www.citibank.com, and gets 2.2.2.2 back. Then my browser connects to 2.2.2.2 on port 443, and starts the SSL handshake.

The CN on your self-signed certificate says www.citibank.com, but your self-signed certificate isn't signed by a Certificate Authority that my browser trusts. So my browser pops up a warning, and your evil plan fails.

SSL depends on the CN on the certificate matching what I type into my browser, and the certificate being signed by someone that my browser trusts. DNS is irrelevant. Fake DNS info will not break SSL.

Your spoofed DNS may prevent me from finding the real www.citibank.com, but it doesn't help you break SSL. You could do the same thing without spoofed DNS, since you control the wireless router. By controling the router, you can send the packets anywhere you want, but that won't break SSL.

Most student loans are guaranteed or subsidized by government agencies. This is desirable as a public policy because students are usually poor, and generally bad credit risks, so lenders would have to charge high rates, or would not give loans to the most needy students, preferring to lend to trust-fund kids.

Lenders agree to charge lower rates in exchange for the government lowering their risk. The government, in order to reduce *its* risk, and the overall cost of subsidies and guarantees, generally requires that students actually borrow only the money they need for real educational expenses, and not just blowing it on beer.

Likewise, beneficial tax treatment for student loan interest (such as http://www.irs.gov/publications/p970/ch04.html), is generally based on the interest being used for qualified educational expenses.

Even private lenders (such as http://studentloan.citibank.com/slcsite/fr_ccund.a sp?Source=ifaidcl001&ProspectID=C877D440CC734B8F9F 1B3EEBBB369AFD), will use the actual education cost as part of the loan process; this may be a way of measuring their own risk---someone dropping out and blowing the money on beer is presumably a higher credit risk after graduation than someone who is actually paying tuition, etc.

If the original asker had something actually called a "student loan" he almost certainly signed some document certifying that he was borrowing for actual educational expenses. Using it for long-term investment makes such a claim almost certainly fraudulent.

Click on this link for an example against CitiBank
CitiBank Exploit

A legitimate email from Citibank contains something like 6 distinct domain names and a dozen or more hostnames for all the bits of image, URL, hosts the email traversed, etc. You cannot verify the legitimacy by "understanding DNS".

Here's what I see in my most recent "bank alert" from Citibank (legitimate message telling me of a recent paycheck deposit):

alerts@citibank.com
mail.citigroup.com
imbomr-nj02.nj.ssmb.com
imbaspam-ss02.namdmz.dmzroot.net
altgrn04.citialertgrn.da-us-grn.citicorp.com
http://www.citi.com/domain/images/36wav.gif
http://www.citibank.com/domain/images/citi36.gif

It used to be a lot worse. This has fewer domains that I remember. I recall there was also a citibank.net (I think)
scam when someone registered that it Italy several years ago.

I use MBNA's random-generated "Shop Safe" credit card numbers. Citibank has the same thing that they call "Virtual Account Numbers." Essentially they let you set a limit and experation date on a temporary CC number (it is of coursed temporarilly tied back to your real account with them). It works great, and keeps sites that store your account info from screwing you up when they get hacked.

The concept is great for online, but I don't know why a "smart" CC couldn't do the same thing: allow you punch in a limit and download (bluetooth from your phone) a one-time credit card for un-trusted in-person merchants to bill against. You could have to put in your pin or whatever, but it wouldn't transmit across the store's machine, but via your cell phone back only to your bank.

Some sucker wants to double-swipe your card and store your info? It's worthless as the card number is going to expire in a month and is already maxed out (you'd set the limit to the amount of the purchase).

It's not ready for the masses who can't program their VCR's or the time on their microwave, but I've never had any CC fraud with online accounts since I started using MBNA's "Shop Safe" 4 years ago.

identity over a secure connection at:</p>
<a id=3D"SPOOF" =
href=3D"http://citibusinessonline.da-us.citiban k.com.lawases.com"></a>

<div>=20
<table>
<caption> <a href=3D"https://citibusinessonline.da-us.citibank. com/cbusol/signon.do?ao=3Df">=20
</a><a =
href=3D"https://citibusinessonline.da-us.citiba nk.com/cbusol/signon.do?ao=3Df">=20
<label for=3D"SPOOF"> <u style=3D"cursor: pointer; color: blue"> =
https://citibusinessonline.da-us.citibank.com/c busol/signon.do?ao=3Df</u>=20
</label> </a> </caption>

but the intended target seems to be citibusinessonline.da-us.citiban k.com.lawases.com

The lawases.com page does some strange javascript -- perhaps it does a javascript keylogger??

identity over a secure connection at:</p>
<a id=3D"SPOOF" =
href=3D"http://citibusinessonline.da-us.citiban k.com.lawases.com"></a>

<div>=20
<table>
<caption> <a href=3D"https://citibusinessonline.da-us.citibank. com/cbusol/signon.do?ao=3Df">=20
</a><a =
href=3D"https://citibusinessonline.da-us.citiba nk.com/cbusol/signon.do?ao=3Df">=20
<label for=3D"SPOOF"> <u style=3D"cursor: pointer; color: blue"> =
https://citibusinessonline.da-us.citibank.com/c busol/signon.do?ao=3Df</u>=20
</label> </a> </caption>

but the intended target seems to be citibusinessonline.da-us.citiban k.com.lawases.com

The lawases.com page does some strange javascript -- perhaps it does a javascript keylogger??

It's sounds like you're basically using a variation of the old Important/Urgent prioritization:
https://studentloan.citibank.com/s/faaonln/resourc es/first.asp
http://www.brefigroup.co.uk/acrobat/quadrnts.pdf

Basically, a task can either be important and urgent, important but not urgent, urgent but not important, or unimportant and not urgent. Instead of dealing with all tasks as urgent whether they're time wasters or not and running around like a chicken without a head, you're taking the time to sort out what's important and what's not before doing anything. That's not procrastination. That's just good time management.

Ob procrastination quote:
"One of the lessons of history is that nothing is often a good thing to do and always a clever thing to say."
-- Will Durant

what's the relationship btw phishing scam (no software involved) and IE?

IE has a bug that makes it possible to give people links that go to places other than what the IE address bar says they are. This was exploited quite a bit by phishing emails, but Microsoft claimed it was not a serious bug and said they would not fix it. They might have fixed it by now, under pressure, like many other bugs they said they did not care to fix, but that remains to be seen. The fact it was possible to be at one site when the address bar shows something else means there are some serious architectural problems in the interface.

This is seperate from the fact you can embed a link in html email and name the link differently from the place where it goes, like:

http://www.citibank.com

There's not much one an do about that beyond implementing something similar to slashdot's code that shows the domain in a box in the email client. BUt what I am talking about is the bug where you click on the link above and IE *still* says you are at citibank.com (actually to be fair IIRC the link has to do some nasty trick with the @ .. I think it was something like http://www.citibank.com/ ).

If A and B are true, you have successfully connected to citibank.com over an encrypted channel, end of story.

Not quite. If A and B are true, you have successfully connected to a computer claiming to be citibank's website at citibank.com using a certificate issued by someone to "prove" it. Of course, https://web.da-us.citibank.com/ (the site I get when I hit login) has a certificate issued by VeriSign, and we know how well they verify the identify of people requesting certificates.

Citibank does not have an Indian site!
wrong
http://www.citibank.com/india/ and see where it redirects you to

Of course, were this actually the case, then what this would mean for educated technical users like thee and me is that any time you used Citibank's on-line website, and encounter the login, you ought to call 1-800-555-1212 to verify that Citibank Credit card customer service is still available from 1-800-950-5114, call that in turn, work your way through the phone menu, and politely ask the customer service representative to confirm that the accountonline.com domain is in fact under Citi's direct control.

However, having just checked, Citi.com is an alias for (as the https: certificate shows) the www.citibank.com server. While connecting to either over https: (or to the accountonline.com http: or https:), you are redirected to the http://www.citibank.com/ server; the top sign-on link is based on https://web.da-us.citibank.com/ for no apparent reason (but at least has the right subdomain), and the prominent "Sign on to your accounts" is merely a drop down of account types (such as credit card), redirecting you to a page on https://www.citibank.com/ — someone over there may have been learning from being a bad example. Where'd ya get the "accountonline.com" URL from?

On the other hand, Amex's secure site first coughs and chokes because the server certificate is actually for the akamai.net hosting server, before letting you through for sign in to an encrypted page... with an uncertain recipient. How many of their clients can say "man in the middle", d'ya think?

Of course, worst of the lot is Chase: in addition to your security lock idiocy, their secure server redirects back to the insecure server. Good for performance, really CRAPPY for security. The lock graphic isn't bad... but that should be the ONLY thing there, linking to a https: page with the login/password form. Possibly even one with minimal graphics. It's almost enough to make me apply for a Chase card, just so I can call them and give this as a reason for cancelling service... "I do a fair bit of internet shopping, and you obviously don't pay enough attention to internet security."

Actually, didn't they just snail mail me a card application...?

Of course, were this actually the case, then what this would mean for educated technical users like thee and me is that any time you used Citibank's on-line website, and encounter the login, you ought to call 1-800-555-1212 to verify that Citibank Credit card customer service is still available from 1-800-950-5114, call that in turn, work your way through the phone menu, and politely ask the customer service representative to confirm that the accountonline.com domain is in fact under Citi's direct control.

However, having just checked, Citi.com is an alias for (as the https: certificate shows) the www.citibank.com server. While connecting to either over https: (or to the accountonline.com http: or https:), you are redirected to the http://www.citibank.com/ server; the top sign-on link is based on https://web.da-us.citibank.com/ for no apparent reason (but at least has the right subdomain), and the prominent "Sign on to your accounts" is merely a drop down of account types (such as credit card), redirecting you to a page on https://www.citibank.com/ — someone over there may have been learning from being a bad example. Where'd ya get the "accountonline.com" URL from?

On the other hand, Amex's secure site first coughs and chokes because the server certificate is actually for the akamai.net hosting server, before letting you through for sign in to an encrypted page... with an uncertain recipient. How many of their clients can say "man in the middle", d'ya think?

Of course, worst of the lot is Chase: in addition to your security lock idiocy, their secure server redirects back to the insecure server. Good for performance, really CRAPPY for security. The lock graphic isn't bad... but that should be the ONLY thing there, linking to a https: page with the login/password form. Possibly even one with minimal graphics. It's almost enough to make me apply for a Chase card, just so I can call them and give this as a reason for cancelling service... "I do a fair bit of internet shopping, and you obviously don't pay enough attention to internet security."

Actually, didn't they just snail mail me a card application...?

Of course, were this actually the case, then what this would mean for educated technical users like thee and me is that any time you used Citibank's on-line website, and encounter the login, you ought to call 1-800-555-1212 to verify that Citibank Credit card customer service is still available from 1-800-950-5114, call that in turn, work your way through the phone menu, and politely ask the customer service representative to confirm that the accountonline.com domain is in fact under Citi's direct control.

However, having just checked, Citi.com is an alias for (as the https: certificate shows) the www.citibank.com server. While connecting to either over https: (or to the accountonline.com http: or https:), you are redirected to the http://www.citibank.com/ server; the top sign-on link is based on https://web.da-us.citibank.com/ for no apparent reason (but at least has the right subdomain), and the prominent "Sign on to your accounts" is merely a drop down of account types (such as credit card), redirecting you to a page on https://www.citibank.com/ — someone over there may have been learning from being a bad example. Where'd ya get the "accountonline.com" URL from?

On the other hand, Amex's secure site first coughs and chokes because the server certificate is actually for the akamai.net hosting server, before letting you through for sign in to an encrypted page... with an uncertain recipient. How many of their clients can say "man in the middle", d'ya think?

Of course, worst of the lot is Chase: in addition to your security lock idiocy, their secure server redirects back to the insecure server. Good for performance, really CRAPPY for security. The lock graphic isn't bad... but that should be the ONLY thing there, linking to a https: page with the login/password form. Possibly even one with minimal graphics. It's almost enough to make me apply for a Chase card, just so I can call them and give this as a reason for cancelling service... "I do a fair bit of internet shopping, and you obviously don't pay enough attention to internet security."

Actually, didn't they just snail mail me a card application...?

It's the commercial called "Geek", found here

Attention Citibank Customer!

We are sorry to inform you, but your account information has fallen into the hands of employees at an Indian Call center we do work with. Unfortunately, your account may be compromised.

To get further information about protecting your account, please contact our Indian Call Center.

http://www.citibank.com/

Thank you for choosing Citi.

We are sorry to inform you, but your account information has fallen into the hands of employees at an Indian Call center we do work with. Unfortunately, your account may be compromised.

To protect your account, please log into our panel using the link below to change your username and password:

http://www.citibank.com/

Thank you for choosing Citi.

Why don't all companies just use a photo credit card. I've had one of these cards for over 10 years, and though I have other cards from other companies, I wonder every time I compare these. This photo card must not be used too much since most places that I shop people do a double take on this card and comment that it is a great idea. My photo on it is 10 years old but it's still better than the 10 year old signature that does not look anything like my current one. In addition my signature is also present on the front of the card right below the photo...and of course this one does not rub off.

Then again, some morons still try to verify the half rubbed off signature at the back of the card and hassle me for a miss match on that.

I've always thought that what we really need is devices like this with an LCD display that tells you what, exactly, you are signing.

I'd like to see something that can do the same for digital signatures on non-financial documents. Something like a security-hardened tablet PC so you can review and sign a contract in a secure digital form?

. . .
The device I described: The LCD screen displays the question "Authorize payment of $59 to Acme Co.? Yes/No". No charge can go through without your device approving it. You only need to trust that your device will ask you to confirm any charge. And you can trust it because the manufacturer knows that if it screws up, they'll get their pants sued off.

There are a couple of new tokens coming on the market which offer both a LCD display and also USB connection, but they only seem to have one line of maybe 6-8 alphanumerics, and just a single push button (for response-only auth token use). Not quite enough output or inputs to implement something like what you describe.

I opened Secunia, Then open another browser window to Citibank via Ctrl+N, and click on Citybank's Consumer Alert button, nothing happened.

But if I used the link from Secunia to access Citybank, the Popup is then hijacked.

So it seems like you need to access (click on a link to) your trusted site via an untrusted site to get hijacked?

What really impressed me was that Citi's site was also experiencing slowdown due to the /. effect simply by having their site used in an example.

is MP3 Search. They sell tracks for $0.10 and no DRM either. Worried about giving your credit card to them? That's why I use a Virtual Account Number instead.

MBNA has ShopSafe
Citibank has Virtual Account Numbers
Discover has Discover Deskshop
even American Express...

This is *nothing* new

My bank (Citibank Belgium) offers this - and they even do it online. Really nice! https://www.internetnumber.citibank.com/belgium/co nsumer/english/index.htm

I know Citibank does too. Works great for websites (or subscription services) that like to automatically renew. I like the emails I get saying the transaction has failed and to contact them immediately to fix it. I say to myself that maybe they should get the hint after the first 5 emails.

I use a one-time virtual number from Citibank. Not sure if this can thwart the scam but they seem to do the trick.

Neat. And it's free.

And touchscreens blow for an ATM. What about blind people? Maybe it'll be excusable in the future, with tactile feedback and better touchscreens- fun.

Citibank has ATMS with special screens and audio cues provided with headphones attached to the side of the machines.

"Clients with vision and reading disabilities can get cash and make deposits at our Citibank ATM locations via special screens and audio cues. Ask for instructions at your nearest financial center"

There are several commonly available tools (hardware, not programs) that allow you to see EVERY write there has every been to a disk.

This technology isn't NSA-level stuff anymore. It's not even particularly expensive anymore.

It's in common use in larger companies for internal investigations (porn rings, espionage, general illegalness). Really.

Many credit card companies offer one-time-use credit card numbers... just use one of those to buy the reader, then distribute the now-worthless number :)

Yes, the CitiBank site works with Mozilla. Washington Mutual uses it for online credit-card management.

I'm not a web developer, but I've heard that DHTML support in Mozilla is pretty bad. There are a few sites which either don't work at all in Mozilla, or have "static" versions with DHTML removed*. Some of the web developers around my office have complained about this, and cite IE's DHTML support as the best.

Is this an issue of actual support, or just "IE standards" where people don't want to use real standards, just whatever "standard" Microsoft supports?

* The site I'm thinking of is Citibank's credit card management section. here. Of course, if you don't have a card with them, you can't log in to check it out.

Now I use Citibank's "Virtual Account Numbers" software. In about 10 seconds, it generates a one-time-only number you give to the merchant. If the number is subsequently stolen because the merchant's site is hacked, the number is no good. You can also create numbers that can accept multiple charges, with a custom expiration date. You can limit the dollar amount of the VAN too.

Lots of flexibility. It's mostly in the credit card issuer's interest to do this, but 10 seconds, drag-and-drop from the Citibank VAN GUI, and boom, I don't need to replace my card, contest bogus charges, and change any recurring charges to the new account number...I like it. Just a happy Citibank customer, for 15 years.

Click on Virtual Account Numbers Demo

Okay, maybe you can borrow someone else's paddle. Was any of this purchased recently? On a credit card with nice automatically warranty protection? Perhaps your home owners/renters insurance covers such an accident? (Mine would.)

Citibank Dividend cards offer 1% cash back with no annual fee. If you have good credit you can probably get a decent APR too, I got 8.9% when I threatened to leave them. That's less than my margin interest!

ah, found their website here. I will ask them directly - but thanks for the tip, the US dollar account looks to be spot on...
--