Slashdot Mirror

← Back to Stories (view on slashdot.org)

Schneier: Make Banks Responsible for Phishers

Posted by CmdrTaco on from the now-there's-an-idea dept.

abgillette writes "Writing for Wired News, security guru Bruce Schneier says that the only way to stop phishers and identity thieves is to make financial institutions solely responsible: "Push the responsibility -- all of it -- for identity theft onto the financial institutions, and phishing will go away. This fraud will go away not because people will suddenly get smart and quit responding to phishing e-mails, because California has new criminal penalties for phishing, or because ISPs will recognize and delete the e-mails. It will go away because the information a criminal can get from a phishing attack won't be enough for him to commit fraud -- because the companies won't stand for all those losses.""

2 of 429 comments (clear)

  1. Chase, Citibank & Amex are big problems. by slashkitty · · Score: 5, Interesting
    Every time there is a banking security article, I start pointing to Chase bank and Amex, both of which use pitiful security practices on their sites. The most important one of all, is to teach the user to always login from a secure site, and one with the bank name.

    Chase - has a login on their insecure site http://www.chase.com/, and puts a "lock" image on the page. This does not teach users where the proper lock is and dumbs down security.

    Amex - does the same thing that Chase does on americanexpress.com.

    CitiBank - Another bad problem, weird domain names. While Citibank uses citi.com and citibank.com, they put their credit card login on "accountonline.com"... Users have gotten used to weird domain names, and just trust the site when they see the logo. They use another domain name when linking from emails!

    --
    -- these are only opinions and they might not be mine.
  2. Try the ING Direct site by nightsweat · · Score: 5, Interesting

    Try the ING Direct site - best over the web security ever. You need your account number, some ever changing specific fraction of your social security #, zip code, or other identifier, and a set of letters that corresponds to a pin that are entered by clicking a icture of a number pad with a mouse. If "s" is assigned to "3" this time, it won't be the next time you're on.

    It's a minor pain in the butt to get to your account, but definitely more secure.

    --

    the major advances in civilization are processes which all but wreck the societies in which they occur - A.N. White