Korean Banks Forced to Compensate Hacking Victims

An anonymous reader writes "A brief story over on Finextra reveals that the Korean government is introducing new legislation that will force banks to compensate customers who have been victimized by identity theft even if the banks are not directly responsible. This action obviously will not stem identity theft but the hope is that this will push banks into security improvements that will make identity theft much harder."

Comments

All too brief...

[TripMaster Monkey]

From TFS:

A brief story over on Finextra...

'Brief' is right...'skimpy' is the adjective that comes to my mind.

A much more detailed report on this story can be found at The Korea Times.

Reading through the above referenced story, two things pop out at me:

• The investment to build a safe e-banking environment may result in astronomical increases in systems costs given the insecure nature of the electronic commerce infrastructure.
  
• The biggest challenge to the banking sector would be how to make home PCs secure. Hackers are increasingly preying on the home PCs, the most susceptible online link of all. Many bank customers tap in from home, often on a computer with little or no security software.

Given these two paragraphs, this looks like I'm going to be paying higher systems costs because others can't be bothered to practice responsible computing (when this initiative moves out of Korea into the rest of the world, that is...).

Re:All too brief...

[Dr. Cody]

The solution is as easy as random number generators. I've seen them used for logons to Motorola corporate networks since around 1995 and for internet banking for at least five years. It is quite difficult to find internet banking here in Sweden, for instance, which doesn't issue a small random number generator keychain-sized thingie.

Re:All too brief...

[TripMaster Monkey]

Sounds like you're talking about RSA's SecurID products.

These things are expensive to purchase and deploy. Who's gonna foot that bill? Just the users who can't get the hang of responsible computing....or all of us?

Besides, SecureID does have its flaws...no panacea here.

Re:All too brief...

[darthium]

1.-Wouldn't making a policy of not granting this kind of insurance to people unable to demonstrate security meassures implemented on the PC systems they will use for access the bank network... do the trick? 2.-Wouldn't also be interesting to ask people doing online banking to register the terminals (Disk Serial number and whatever identification possible) and IP addresses, and the cost of that paperwork should be charged as an 'electronic theft insurance fee', and that it would be possible for people who are sure to make their terminals secure, not to pay such insurance, and avoid paying the fees?

Re:All too brief...

[runcible]

RNGs ( which are not RNGs but rather little keygen dongle type items ) don't address the class of issues that would result from -- say -- accessing your bank's site from an 0wned box...the 0wner can hijack an existing, authenticated connection.

Or for that matter a phishing site that passes through the authentication info that you type in, including the number from your dongle...which now that I think about it, is the more likely scenario.

The answer will never really be in authenticating the *person*, that crap can always be spoofed or stolen.

Re:All too brief...

[inoffensif]

To the parent, thanks for the Herald link.

There are many factors which are prompting this in SK. I am not a native but I have been residing in South Korea for 2 years.

-This place is the mecca of broadband internet access. I mean anywhere and everywhere in the country, everyone is connected at speeds that would humble first world nations. Not that SK isn't first world, economically they are, socially it's another story...
-Everyone and their mother, uncle, step-sister uses IE explorer. Most Korean sites are designed for IE and don't work with any other browser.
-The networks are dirty, before I had a physical firewall, ZoneAlarm was registering 1000+ intrusion attempts a day on my system.

Put your average mom and pop who don't know any better, in an online banking situation in this environment, and you are asking for disaster.

It will probably set a precedent for many online banking SOPs in the west.

For those idiot western media brainwashed idiots who don't know a thing about Korea, get a clue, nobody gives a damn about eating dogs or even hears about North Korea more than once a month here, just listen to your dear leader dog tell you who to attack next.

re: all too brief...

[ed.han]

south korea also has (or at least did) laws on the books making it a crime to bounce a check. this is a reaction to KEB's stupid response to the matter. if KEB realized that a smaller payout then to their customers wouldn't require infrastructure changes globally to their operations, they would never have put all south korean banking into this position.

ed

Re:All too brief...

[Anonymous Coward]

I'm sure that the banks will attempt to use this to absolve themselves of responsibility to recompense customers who've been defrauded. All they'll have to do is insist that it's "your fault" and away they go...

Mike
http://www.quicktrivia.com/

Re:All too brief...

[Storm]

I agree with the poster. What incentive is it to behave responsibly when people know that the government is going to bail them out? I mean, look at it. My bank says they will never send me alerts through email or have me go to a website and update my information...But I got one in my email, and I just want to make sure its not for real. Now the bank is on the hook for it, leading to higher costs all around...

Most phishing sites have nothing to do with the original institution, other than nipping off enough content and visuals to make their bogus site look legit. Should the original institution be held liable for customers' bad behavior? I don't believe so. In addition, it could lead to a whole new type of low-level crime perpetrated by individuals who wish to punish or attack a particular institution, and do so by clicking on the phishing links.

The other thing is that having done auditing on bank IT infrastructures for a living, they are, for the most part, more secure than you might imagine. No security is perfect, however, banks are fairly good...A lot better than the government. So we should not reward bad behavior. Thats part of what has gotten our society in trouble. People have apparently forgotten that many lessons are best learned (and more importantly retained) the hard way, and that making the problem go away is not the best way to keep a person from making the same mistake more than once. If someone clicks on a phishing link and gets totally screwed, then you can pretty much bet that they won't do it again. OTOH, if you put the consequences on the banks, then what incentive does that provide the end user not to fall for it?

--Storm

Re:All too brief...

[Sangbin]

Amen brother. Just a rant, but to shed some light on the current computing environment in SK, SK gov checks the speed of the internet connection ramdomly and requires full refund to all the customers if it isn't as fast as advertised.
Yes, gov stepping into corporate arena is a bad thing, but it seems to be keeping their Starcraft players happy enough.

Re:All too brief...

[muzzmac]

LOL! Nice 10 year old flaw.

There are better ways to pick on SecurID than that.

The reality is it changes the mix for the banks just enough to be useful. Not cheap though.

Re:All too brief...

[Anonymous Coward]

LOL! Nice 10 year old flaw.

There are better ways to pick on SecurID than that.

That's the second link you get if you Google SecurID. It's titled "SecurID Weaknesses." He probably didn't even click on it, less read it and evaluate its relevance to a discussion in the the year 2005. That's Spank/\/\aster /\/\onkey for you. ^_^

Re:All too brief...

[StikyPad]

Given these two paragraphs, this looks like I'm going to be paying higher systems costs because others can't be bothered to practice responsible computing (when this initiative moves out of Korea into the rest of the world, that is...).

Well, you're making two rather large assumptions, firstly that the precident will spread, and second that this would be a bad thing for your bottom line. But many large banks already cover identity theft, and that money comes from somewhere (hint: you). If the net result is that banks become more secure (through 1 time pads, user chosen images embedded in the bank's page, or a plethera of other viable options), and that in turn lowers fraud, then you actually stand to gain. Of course, whether or not that savings is passed on to the customer is a seperate question entirely.

I would further submit that if you're couldn't be bothered to find a bank with security that's more than merely "adequate," then a) you're already supporting poor business practices, and b) you don't particularly care about your money to begin with.

Re:All too brief...

[Detritus]

They don't have to be expensive. They should be very cheap if manufactured in large quantities. I can buy a solar LCD calculator for $1 at Wally World.

Re:All too brief...

[drinkypoo]

Just a rant, but to shed some light on the current computing environment in SK, SK gov checks the speed of the internet connection ramdomly and requires full refund to all the customers if it isn't as fast as advertised.

This is also why SBC only sells DSL to 14,500 feet regardless of how good your copper is. At least, that's the case in California. They used to sell to 17,000 feet but then the FCC started fining the shit out of them if their DSL was slow. So, existing customers got to stick around, but anyone new has to be within the shorter distance. (At my last place of residence, I was in between the two numbers.)

Re:All too brief...

[Anonymous Coward]

10 year old "flaw"? You realise it wasn't even owned by RSA at that time, and has since gone through at least three major revisions.

That's a pretty big stretch.

If cost is a concern, maybe you should look at Vasco products.

Re:All too brief...

[Anonymous Coward]

You come up with shoot-from-the-hip BS faster than a politician in a spelling bee. The sad thing is that it sounds good to all the mods except the ones who know there's no "e" in potato.

Re:All too brief...

[Anonymous Coward]

"Yes, gov stepping into corporate arena is a bad thing, "

Why is that a bad thing? So long as the government doesn't profit or passes law that favours corporations over the proletariat then why is it a bad thing?

And where will the money come from?

[nharmon]

Does anyone here really think the banks are going to pay this money out from their bottom line? They'll recover it from those customers who do protect their identity through increased fees and interest.

Re:And where will the money come from?

[Jesus IS the Devil]

You are falling for the business spin on things. If fees increase so will volume of transactions, and thus their bottom line. Banks that are able to overcome this hurdle will grab a huge chunk of market share through low prices all the while keeping good security.

The fault here lies with two parties, the bank for not doing enough, and end users for not caring enough about security. I feel that end users should still be partially responsible for their actions. I mean, there are people out there that, despite repeated warnings, will keep getting themselves hacked and scammed. I think most of us know people like that. And really, the only remedy for them is to yank out their computers and never let them go online again.

It's one thing to make banks more responsible for security breaches, but it's another to force them to be completely at fault, when there are so many points of entry for a crook. From the internet router from the ISP, to the user's home line, to his computer, to his keyboard, to the telephone, etc.

Re:And where will the money come from?

[bfields]

Does anyone here really think the banks are going to pay this money out from their bottom line? They'll recover it from those customers who do protect their identity through increased fees and interest.

The whole "identity theft" terminology is screwed up; it's not your "identity" you're protecting--you're still you after someone else manages to clear out your checking account. What the "identity thief" has done is to fool the bank's authentication system into thinking their transactions were authorized by you. You do have some control over whether this happens, by your choice of password, choice of when to type it in, etc. But the decisions with the greatest affect on the security of that authentication system are completely in the bank's hands: e.g. the decision to authenticate you by asking you to enter a password into a form on a web page.

The decision to make banks responsible for losses isn't because of a preference for consumers over banks--as you point out, expenses may be passed on to customers either way--it's because the best way to make the banking system more secure is to make sure that the entities with the most power to fix the system are the ones that see the incentives to fix it.

This is the same reason we limit consumer's liability for credit card losses--it's the credit card company that's in the best position to detect and prevent fraud, and if we pass on the cost to them then we enable them to weigh the costs of fraud against the costs of improved security infrastructure, something that's impossible for an individual consumer to do.

Re:And where will the money come from?

[mumblestheclown]

The fault here lies with two parties, the bank for not doing enough, and end users for not caring enough about security.

Would it be too gratuitous to mention that at least some percntage of the fault lies with the unethical idiots actually doing the theft?

Re:And where will the money come from?

[richg74]

What the "identity thief" has done is to fool the bank's authentication system into thinking their transactions were authorized by you.

That's exactly right. "Identity theft" is a very misleading label -- what we're talking about is good old-fashioned fraudulent transactions. The implementation is different, and facilitated by technology -- especially stupidly-used technology -- but the crime isn't that different in essence from a forged check.

In that light, we should remember that the bank is 100 percent liable for paying a forged check, and has been for a long time. Yet banks have figured out how to cope with that, and the system seems to work.

Re:And where will the money come from?

[Anonymous Coward]

Yup, just another example of the government sticking its nose where it doesn't belong. Good intentions--granted--but the end result will be higher banking prices (and perhaps better security) for the consumer.

The free market is an amazing thing if the State leaves it alone. Goods and services which are desired (i.e. demand) by consumers will be offered (i.e. supply) by some business, some place.

Don't like the security your bank offers? Go to the next one. Can't find one that meets your desires? Then what you desire must not be a big issue for the average consumer.

Re:And where will the money come from?

[Nahor]

The whole "identity theft" terminology is screwed up; it's not your "identity" you're protecting--you're still you after someone else manages to clear out your checking account

Yes, it's really "identity infringement". The "thieves" are only making copies of you.
Those bastards, you makes a backup of yourself on your computer just in case, and before you know it, you're on every peer-2-peer networks.

Re:And where will the money come from?

[AK Marc]

The free market is an amazing thing if the State leaves it alone. Goods and services which are desired (i.e. demand) by consumers will be offered (i.e. supply) by some business, some place.

The "free market" solution to this is a bunch of people getting together for a class action against the banks. Prove that letting people fraudently take your money and open accounts in your name with lax security is negligent, then hold them responsible for the actual loss, the secondary losses (the trouble with the credit reports and all the time wasted) and punitive damages.

Of course, the only winner here are the theives and the lawyers (or is that redundant). It takes longer to get fixed, the people lose money and the banks lose money. Eventually, things get fixed, when if the government recognized that the current system is not using due diligence and passed laws recognising that, the fix will come sooner and the thieves and lawyers will net less, and the banks and customers will lose less.

Or, to put it in the terms that seem to piss off so many people here:
The Free Market (tm) is not always most efficient.

Re:And where will the money come from?

[Anonymous Coward]

Does that mean you want to eat our President?

Re:And where will the money come from?

[dekemoose]

"...If fees increase so will volume of transactions..."

???

I'm sorry, I missed the leap of logic which allowed you to make this statement. Tytpically speaking as the cost of a given thing increases the likelihood that someone will do that particular thing decreases, all else being equal. Care to enlighten me?

Re:And where will the money come from?

[AndersOSU]

I prefer to think of it as identity piracy. Arrgh.

Re:And where will the money come from?

[Rich0]

But the decisions with the greatest affect on the security of that authentication system are completely in the bank's hands: e.g. the decision to authenticate you by asking you to enter a password into a form on a web page.

Or better yet - the decision to authenticate purchasers by having merchants ask users for a 16-digit number which is transmitted in the clear to the merchant and later relayed to the bank. Credit card numbers are a system that should have abandoned ages ago. Imagine an email system where you send people mail by tying in an address, and read your mail by visiting a website and typing in your own address - and no password. Or, as is now becoming more common, you read mail by entering your address and a PIN, and send others mail by entering their address and their PIN.

Merchants should never be given master account authentication credentials. They should be given signed message digests, or one-time authentication codes, or something along these lines, which are tied to the transaction date and amount. Even if credit card companies just put secureID readouts on their cards it would MASSIVELY cut fraud. Imagine what would happen if they actually used certificates and digital signatures, with the card private key retained in a secured ROM protected by PIN-pad on the card itself!

The costs of a digital ID system with good PKI could be recoped in only a few months from the savings due to reduced identity theft. In fact, the government would be a natural choice of a body to administer such a system.

Re:And where will the money come from?

[AviLazar]

Make no doubt, banks love online banking. It means you are not walking into a branch. It means less paper processing so the lockbox department is less worked (which means less paid since most transaction processors are paid per the transaction). Branches have overhead, and lots of it. Even rolling out an expensive security system is WHOLLY worth it to the banks because they will be able to attract more online bankers and this, in the end, will save them money.

Think ATM machines....these things were UBER expensive to roll out back in the early 80s. Now they are pure cash cows, and any bank that wants to call itself competative will have ATM machines. It is a defacto standard. BTW, the average transaction cost (for the banks) on an ATM machine is 4 cents (total, for both banks). And here (in Philadelphia) you cannot really find ATM machines less then 1.25 - and the ones near me (center city) range from 1.75-2.75.

Re:And where will the money come from?

[Jesus IS the Devil]

Ooops I completely left that part out.

Re:And where will the money come from?

[guitaristx]

Heavens, NO! That would mean that we would actually have to assign responsibility for wrongdoing to the actual people in the wrong. This would create an unneccesary schism in society between the "good people" and "bad people". Therefore, we should consider the identity theives' parental skills to be the ultimate perpetrator here, and create a government program to help spread good parenting skills to parents of potential identitiy thieves.

Re:And where will the money come from?

[Trolling4Columbine]

Theft? What theft?

'Round these parts, 'theft' requires the pilfering of a physical object.

I believe the word you're looking for is "fraud".

Re:And where will the money come from?

[bfields]

Merchants should never be given master account authentication credentials. They should be given signed message digests, or one-time authentication codes, or something along these lines, which are tied to the transaction date and amount. Even if credit card companies just put secureID readouts on their cards it would MASSIVELY cut fraud.

I would have thought so too, but the credit card companies (ast least in the US) seem to have been happy enough just paying the price of fraud for a long time now....

Also it seems fair to assume that most consumer PC's can be hacked. If that's the case, then you need more than just a little token with a private key on it--the token needs its own display so it can, for example, display the transactions it's authorizing instead of relying on the PC's compromised display.

Re:And where will the money come from?

[hobbit]

BTW, the average transaction cost (for the banks) on an ATM machine is 4 cents (total, for both banks). And here (in Philadelphia) you cannot really find ATM machines less then 1.25 - and the ones near me (center city) range from 1.75-2.75.

Sounds like a class action lawsuit in the making.

Re:And where will the money come from?

[AviLazar]

Sounds like a class action lawsuit in the making.

Why?

Re:And where will the money come from?

[Rich0]

Couldn't agree more. I'd put both a modem with speaker/mic on it, RF interface, and USB connection. Transaction sent over phone/air/cable to box, box displays amount, vendor, and date, user enters PIN on device keypad for confirmation. Credentials never leave box - just the signed hash and certificate. PIN never goes anywhere but the box. All authorizations have a serial number, so no replay attacks. Box would use small LCD display. Such a system should be hackproof in concept - as long as the IO code is heavily audited - the communications protocol would be very simple and would use fixed-length fields - so no crazy parsing errors possible (ie no need for the box to run an OS and XML parser/webserver/java/javascript/etc). Code updates to the box would be via direct modem update with signed code from the vendor. The modem would work by simply holding the device up to the phone (low baud) - good for phone transactions, and small firmware updates. I guess you could also allow updates via PC, but keep them signed - it is probably best to just get it right the first time and allow tradeins if they need updates.

Re:And where will the money come from?

[hobbit]

Because I can't really see any other explanation for those profits than price-fixing.

Re:And where will the money come from?

[AviLazar]

Because I can't really see any other explanation for those profits than price-fixing.

It's not really price fixing. They just keep raising the prices, but due to competition they have to keep them relatively the same...and I mean relative....if one bank charges 1.75, and across the street they charge 2.50 --- that is a big difference.

Banks ATM fees are determined by region (poorer areas are cheaper then more affluent areas).

Also, profits do not determine if companies are price-fixing - there is no law saying a company cannot make insane profits on a product. As I always say, the consumer has the right to noy buy it.

Re:And where will the money come from?

[Clod9]

> the credit card companies (at least in the US) seem to have been happy enough just paying the price of fraud

And this is because the credit card companies make money coming and going. They make vast sums from merchants, by charging a few percent of the purchase price when you buy something. That's how some card companies can give you 1% back on purchases -- if they're skimming 3% off the top, and returning 1% to you, they're still skimming 2%. Fraud is just a cost of doing business to them, and as the fraud costs go up, so does the merchant charge -- and the end cost to you. I don't think it will ever be in their best interest to fix the fraud problem, until people find other ways to transact business and stop using their services.

I think making the banks pay the cost of fraud will have the same problem. It won't fix the root issue, it will just raise prices for everyone. I hope I'm wrong, but I've been watching this unfold for a decade and don't have much hope.

Re:And where will the money come from?

[bfields]

And this is because the credit card companies make money coming and going. They make vast sums from merchants, by charging a few percent of the purchase price when you buy something.

Sure. But that doesn't prevent them from wanting to make even more money if they could.

So if they could save X in fraud by spending Y<X on security infrastructure, you'd think they would. Beats me.

Re:And where will the money come from?

[Fulcrum of Evil]

Would it be too gratuitous to mention that at least some percntage of the fault lies with the unethical idiots actually doing the theft?

No, it isn't their fault that it was easy, it was their fault that they did it.

No big deal

[Red Flayer]

FTA: "Under the new legislation customers will still be required to implement safety measures and won't be compensated for losses incurred from online scams if they are careless with card details, PINS and passwords." (emphasis mine)

There's 50% of it right there.

I'm not trolling here, I have a question:

Does using Windows constitute being careless? How about using unpatched Windows? How about using Windows without malware scanners installed?

Re:No big deal

[Ark42]

Does using Windows constitute being careless? How about using unpatched Windows? How about using Windows without malware scanners installed?

No.
Yes.
No.

Re:No big deal

[htrp]

An argument can be made either way. If you use any kind of electronic commerce, it is less secure than being at a bank in person.
I don't think a bank will hold you responsible for a hardware keylogger on the back of the computer you're working on etc.
But I am thinking more along the lines of giving passwords out in phishing e-mails, writing your passwords down, putting your pin in permanent marker on the back of the card.
As for Windows? I doubt it.

Re:No big deal

[MC68000]

Hmmm. Though your question is tongue-in-cheek, it raises the point, how do you define careless? Expect lots of litigation along these lines. This is a trial lawyers dream law. Notwithstanding the opportunities for fraud.

Re:No big deal

[Peldor]

Does giving your credit card to a waiter or cashier constitute being careless?

How about typing your PIN in full view of the other customers?

I think it was Heinlein who wrote "There is no safety this side of the grave." Well there's not much security either. Hell, identity thieves even take dead men's IDs.

Re:No big deal

[Guffy9]

Does using Windows that came bundled with Messenger and Media Player constitute being careless?

Re:No big deal

[Red Flayer]

Yes, yes, and yes.

But the line has to be drawn somewhere for personal sanity. Where the line is drawn legally is a different matter.

Anyone going online has to understand that they are exposing themselves to risk. Whether or not they think that risk is unacceptable is up to them. Taking steps to lessen that risk is up to them.

Re:No big deal

[AK Marc]

Anyone going online has to understand that they are exposing themselves to risk. Whether or not they think that risk is unacceptable is up to them. Taking steps to lessen that risk is up to them.

I think you do not understand the words in use. The question was about "careless" and you answered with "risk". You can engage in a low-risk activity, like walking, and do it carelessly. You can engage in a higer risk activity, like skydiving, and not do it carelessly. You are presuming all high-risk activities are done carelessly.

Re:No big deal

[Red Flayer]

I'm not sure you understand that I didn't equate acceptance of risk with carelessness. I equated carelessness with ignorance of risk.

Carelessness would be not understanding that there are risks involved.

Negligence would be when you are aware of risk, and choose not to take action to reduce it to an acceptable level.

Re:No big deal

[AK Marc]

Carelessness would be not understanding that there are risks involved.

So, if someone was told "don't write down your password, and use something at least 8 characters long, using letters, numbers, and special characters" and they followed that advice without knowing why, they are careless because they don't understand the risk, but someone that happened to pick the exact same password, knowing the risks, wouldn't be careless? I've never heard of the definition of "careless" being based solely on one's understanding, even if they act appropriately. But even if we were to take that risk, you defined 100% of people that pay with a credit card by handing it to a waiter as careless.

Negligence would be when you are aware of risk, and choose not to take action to reduce it to an acceptable level.

Well, if I know it is risky, but deem the risk acceptable, then I couldn't be careless by your definition. I might be negligent, but never careless. So your statements before that people who knowling give a credit card to a waiter are careless is incorrect. I'm glad to hear that, as it is not contrary to any bank's recommendations that I have seen. I also see how it would be any different than giving it to an employee that you watch 100% of the time. If they are crooked, they can get all your information if you are there or not. It doesn't matter. Watching them swipe the information into the database they have complete access too doesn't prevent fraud. Well, unless you sit there and watch everyone that gets on that computer or accesses the database until your credit card expires. But I don't think you want to sit in every store you make a purchase for a few years. But, by your definitions, to not do so is risky, or negligent, or careless, or something. I still can't figure that out.

Re:No big deal

[Anonymous Coward]

my take: make everybody pay! the banks for poor security, the people for not giving a damn (and not doing anythin) about security, microsoft for faulty products (patches don't count, you shoudn't ship faulty product because marking says so), dogs for not barking at owners when those bank online without patches to software, fraudsters for doing the crime in the first place, ...

mhahhahaha!!!!

Schneier likes it

[Anonymous Coward]

This is exactly what Bruce Schneier has been advocating for a while...here's his take on this story.

Other governments too busy invading our privacy!

[Anonymous Coward]

Now that's a responsible government! Why don't other governments enact this law as well? Or are they too busy bringing laws that nullify our rights to privacy?

Imagine you work for years and years and have amassed $100,000 in your bank account. All your life savings. Some punk criminal steals your identity and boom steals all that money away. That's just HARSH. I mean really, if banks do not pay that money back, that's a real waste. All this person's life savings are gone... just like that.

I guess bringing these kinds of laws into place would cost the banks billions of dollars right? I mean, this identity theft thing costs billions of dollars every year.

Better than the Secret Service's crap here...

[chroot_james]

While I was working for Harvard Law School, the Secret Service came and spoke to the different IT communities at Harvard. What they came to tell us was that if there was any security breach, they would help us minimize the damages and then went through their plan on how to do that. The plan was essentially to not scare the public, not tell anyone, and hide as much of the damage as possible and try to recover. That basically does nothing for anyone interested in *actually* knowing how safe they are.

Kudos to to Korea having the balls to blame the people leaving the doors to security breaches WIDE open.

Re:Better than the Secret Service's crap here...

[Anonymous Coward]

I'm not sure how you turned "not directly responsible" into "leaving the doors to security breaches WIDE open"...?

Re:Better than the Secret Service's crap here...

[nharmon]

You're wrong. They are blaming the big pockets. The people leaving the doors open are the bank's customers.

Re:Better than the Secret Service's crap here...

[chroot_james]

If they're providing the service, they should protect their customers.

Free to click and download stuff now

[Anonymous Coward]

So people there won't need to install any anti spyware or even use Linux.
Oh yeah and click on random links, no responsibility.

On top of that, I guess those banks won't have to offer online commerce, it's not like it helps their economy?

What if they run...

[hjf]

What if they run Windows Server? Should Microsoft compensate the bank? Worse yet, what if they run Linux or BSD (altough BSD is dead ;)?

You have to make it hurt

[El Cubano]

This action obviously will not stem identity theft but the hope is that this will push banks into security improvements that will make identity theft much harder.

I agree. I was listening to Clark Howard a couple of weeks ago on the radio and he was talking about how 99.9% of US banks have atrocious security when it comes to online banking. I know that identity theft also happens offline, but I also think that you have to criminalize grossly negligent behavior, or else you end up with a situation like what we have today: banks see it as more fiscally reasonable to absorb the cost of the problem than to even attempt to fix it. The problem is that this has tragic consequences for the individuals that are victimized. Hopefully the US congress will jump on board and start dealing with serious problems, instead of concerning themselves with things like college sports and drug testing among athletes, which ultimately shouldn't be of importance to the federal government.

There's little hope as long as DNS is broken

[putko]

DNS is broken -- it is possible to ask your DNS to lookup "Bank of America", and if the hackers have screwed the DNS servers inbetween yours and root, you'll get the wrong machine. That allows someone to do a man in the middle attack: all your requests get relayed to your bank, but perhaps with different amounts or payees. That subverts two-factor methods also.

Because DNS is broken, even if the banks beef up their stuff, there's no hope for secure transactions.

E.g. suppose you need a pasword and a one-use number (from a list of magic numbers the bank gives you) to do a transfer. [this is how it is in some parts of Europe]. The bad boys do the transfer, but they transfer the money to themselves, not your payee. And they take as much as they want. And they use the magic number you've given them for your intended transaction.

So because of this potential problem, I don't do online banking.

I figure the average schmuck doesn't have a chance anyway; he's using the same OS and software as 99% of the victims, so he's an easy target.

Re:There's little hope as long as DNS is broken

[Anonymous Coward]

In theory the DNS should not matter based on secure certificates.

While everyone here has obviously heard of the MD5 and SHA issues,
if the on-line bank uses secure forms, the man in the middle should
not be able to work since they cannot change the amount inside the
secure send without breaking te key and changing that value.

Regardless of common opinion, banks and the creators of the DNS
system are not complete morons....

now the people that make on-line printable coupons on the other hand
and those that accept them is a total different matter.

cnidarian

Re:There's little hope as long as DNS is broken

[CastrTroy]

I thought that server certificate and SSL were supposed to fix this. You lookup the IP of your bank through DNS, and it doesn't match the IP on the certificate, shouldn't your browser give you a warning? Then you encrypt the data going to that IP with the public key of the server. If you look at the certificate you can verify that it belongs to your bank, and therefore, all information you send out, should only be readable by the bank. Unless their private key has been comprimised. Which i think is another problem altogether.

Re:There's little hope as long as DNS is broken

[klaasb]

E.g. suppose you need a pasword and a one-use number (from a list of magic numbers the bank gives you) to do a transfer. [this is how it is in some parts of Europe].

The problem in Korea is, you only have a one-use number.
When you sign up for your account you get something like a creditcard with a couple of numbers printed on it.
While in Europe you get something that looks like a calculator in which you have to insert your bankcard, enter your pincode and then you get the one-use number. So in Korea they skip the pincode step, which makes is a lot easier to access somebody's bankaccount once you got his card.

Re:There's little hope as long as DNS is broken

[jonwil]

Here is a possible solution.
The bank would give you a little thing thats like a calculator.
When you do a funds transfer, the bank outputs a random number.
You then input the number along with the amount being transfered into the calculator which makes a hash of them and a secret number stored in the device.
This number is input back into the bank system before the transaction goes through. If the hash computed by the bank doesnt match what the user entered, no transfer would take place.

Unless the hacker can convince you to somehow press "funds transfer" "$" into your calculator thingo, all they would be able to get is whatever the user is transfering in the first place.

Although I am sure there are usability issues with this system.

I hope this serves as an example

[PW2]

I hope this serves as an example to legislators in the US.

People would be much better served to get advertisements via mail directing them to a secure website for credit-card sign up instead of the usual forms that get people into trouble. The blank checks that credit card companies send are just asking for trouble and should be illegal when not requested by the customer.

My mail-carrier can't see to well and my mail is often delivered to others in my apartment building. I usually get my mail back one way or another, but since it is a large building, I can be guaranteed due to statistics that there are a few dishonest idiots in the building that would love to try out some credit fraud. Hopefully better laws preventing banks from doing stupid things is in place before that happens.

Great ... I do so much

[ta ma de]

Banking in South Korea; In other news, Maritians have placed new surcharges on all atm's to cover increased transaction costs with South Korean Banks.

no comment

[Anonymous Coward]

Sorry I have nothing to contribute to this discussion. I know little about banking, security or Korea (except there may have been a war there and that North is bad and South is good). Please continue.

Great!

[brunes69]

And when said customers see their fees increse because of their bank's lack security, they will switch banks to one who has lower fees (because they have good security and don't have to pay said fines).

Any way you cut it, with this legislation the bank is the one who loses if they don't get their act together when it comes to security.

*Every* industry should have this type of legislation. It should not be the customers responsibility to research the security policies of their prospective banks/stores/whatever. Hell there is no way you could realisticly do that, since theres no way for you to know their internal policies.

This is what consumer protection should be. Too bad around here all the politicians are bought and paid for by the corperations that this should be protecting us from.

Re:Great!

[Anonymous Coward]

It should not be the customers responsibility to research the security policies of their prospective banks/stores/whatever. Hell there is no way you could realisticly do that,

But... would you really want to? (just think of all those sleepless nights you'll spend worrying about stuff that, in the long run, doesn't really effect you as much as you may think).

Yes, many corps have very stupid policies when it comes to security. Most store and send data in unencrypted form in places where the summer's intern can get at everything. Some even send data using hotmail accounts. Yes, the system is broken, but does it work? For now, yeah. The vast majority of folks never need to worry about such details.

Re:Great!

[bmwm3nut]

*Every* industry should have this type of legislation. It should not be the customers responsibility to research the security policies of their prospective banks/stores/whatever. Hell there is no way you could realisticly do that, since theres no way for you to know their internal policies.

i agree! i'm tired of all of these mailings that my bank sends me to tell me how to protect my identity. aside from not giving out personal info to people i don't trust, i should not have to be responsible for protecting my identity. i think that whoever loses personal information on people should be automatically liable for any damages. if the bank loses my info and my account is emptied, they should have to pay it back. if my grocery store loses info that damages me, they should be responsible. my university (http://www.colorado.edu/) just had an incident where the campus health center's computer was hacked and they lost medical records. ignoring the fact that the computer with medial records should never have had internet access to begin with, what was the campus's responce? they just sent out an email telling you how to identify if someone stole your identity, and how to protect yourself! i already protect myself, any info out in the open now, is solely the result of my univerity's mistake! why are they not liable for any damages i receive becuase of their lack of security. if legislation like this was extended to all people who store personal records, you'd immediately see security tighten up. they just don't have an incentive now because they aren't (financially) responsible for their mistakes.

Re:Great!

[AndersOSU]

What gets me is the "service" that credit card companies and credit reporting bureaus offer to protect you incase your identity is stolen - for a fee. Excuse me but how in the world can they ethically justify turning identity theft into a profit point.

Credit card companies have always (or for quite some time anyway) been on the hook for fraudulent charges, just as banks have always been on the hook for stolen money.

Why the rise of the internet should allow them to offer a service protecting you is nonsense, they are the ones begging for your money, they should be the ones protecting it. If I didn't buy something on credit I should not ever, ever have to pay for it. If it's too easy to pretend to be me that's their fault, not mine.

I hear some people whining about how their fees will increase because someone else's identity was stolen, and they weren't careful enough. Bullshit. You can get your identity stolen even if you're careful, as was the parents point. Holding credit card companies and banks responsible for fraudulent activity only makes sense.

If my car gets stolen because I parked it in a bad neighborhood the car insurance company still owes me money - so long as I didn't intend for it to be stolen ( in which case I'm perpetrating the fraud.) So long as I'm not posting my credit card number to Slashdot I should not be responsible for fraudulent charges.

Banks will require Trusted Computing

[jreiser]

The banks will use the new rules as an excuse to require Trusted Computing [or other restricted hardware/software] for home users, which in practice will mean some form of MS Windows. No MacOS, no Linux, no BSD, etc.

Re:Banks will require Trusted Computing

[FudRucker]

not to sound like a troll, but it would seem to me MS-Windows is the least to be trusted of the OSs mentioned...

Re:Banks will require Trusted Computing

[grimJester]

Some info on Linux and Trusted Computing.

Re:Other governments too busy invading our privacy

[TheGavster]

It sounds like a good idea, but this is covering cases where it wasn't anything the bank did/didn't do. What investment by the bank can prevent someone from giving their banking details to someone who sends them an enticing offer via email? Phishing victims aren't new; it's the same as if you walk into a bar with that 100 grand in your pocket and get hustled at a pool table.

I see a weakness

[Bastard of Subhumani]

1) Put money in bank account
2) Have your pal steal your identity and the money
3) Bank recompenses you
4) Split PROFIT!!!!!

Re:I see a weakness

[ElectroBot]

You forgot the rest of the steps:

5) Bank investigates and finds IP address of thief matches your friends computer.
6) Your friend gets arrested and charged with fraud and does one of the following:

7A) Doesn't rat you out.
8A) You give him your "profit money" to cover some of his court costs.
9A) He ends up in jail for a few years and you lost your profit and possibly a friend.

7B) He accepts a reduced sentence by ratting you out.
8B) The Police seize the money and you go to jail as well.

Re:I see a weakness

[Anonymous Coward]

Bank investigates and finds IP address

Wow! The grandparent got modded funny but you didn't. Go figure.

Re:I see a weakness

[ElectroBot]

Probably because I created the comment too late (not many viewers or moderators were viewing/modding it anymore).

Economic Incentives

[e4g4]

This is a classic example of using an economic incentive where all else seems to fail. Clearly if the economic onus of identity theft is (in large part) on the shoulders of the bank, they'll come up with better and better ways to secure their information that they had no will or reason to do before. Presumably they'll start using biometrics and the like (whether or not you think that's adequate security) and hopefully, if this is enacted in the States, they'll start to require more than a bloody SSN and birthdate to open a credit card account. It's an incredibly insecure means of identifying someone. I mean, really, how many doctors' office require that information along with your insurance info? Lots. And how many doctors have a security aware IT staff? Probably a much smaller number.

Along those lines, though, who gets the fiscal responsibility if a third party, like a doctor or a university, is responsible for the ID compromise?

Bruce Schneier

[diakka]

Looks like the government is taking a cue from Bruce Schneier Glad to see that someone is listening.

Thats what SSL ceriticates are for

[brunes69]

If the SSL ceritifcate does not match the IP address of the host you are connecting to, it should raise big red flags in your head.

Sometimes, there are legitimate reasons for this (such as a bank moving servers and not having time to get a new cert), but they are usually very temporary, so to be safe you can just not do any banking during that period.

Sure, you can still bypass this via a man in the middle attack using ARP poisioning - but in order to do that the hacker has to be on your local subnet if you have a home router, or else working at your ISP if you are directly connected.

Either case is highly unlikely, and **any** way you look at it, even if your original DNS thing was an actual issue, online banking is much more secure thank banking at an ATM or via debit payment, and I bet you do that every day.

All I need to steal your money at an ATM is to install a hidden swipe reader inside the ATM/debit machine and a hidden camera to capture your PIN number. This happens *all the time*, far more than publicized. It is very easy to do, and a smart crook who just leaves the setup installed for a few hours then takes it down is rarely caught either

Even easier is to just capture the cazd swipe, us eit to make a fake identical copy of your own card, and going into the bank and convince the teller to let you change the PIN on the card cause "you forgot it". Also simple to do. Much simpler than hacking itno the DNS servers of your ISP, that's for sure.

Not Great

[NDPTAL85]

Switching banks isn't trivial. For some folks every bill that comes into their house is paid through one bank. Switching all of those over to another requires a lot of effort. I myself maintain 3 bank accounts to make switching easier for me but I seriously doubt someone is going to jump banks beacuse of an extra $10 a month charge.

Re:Other governments too busy invading our privacy

[Red Flayer]

Phishing victims aren't new; it's the same as if you walk into a bar with that 100 grand in your pocket and get hustled at a pool table.

Major parsing difficulties today. I read:

'... it's the same as if you have a 100 grand bar in your pocket and you walk into a pool'

And I thought, what does a wet candy bar have to do with phishing victims?

Banks

[certel]

I think this is a good move. Although I don't care much about Korea, people who have become victims should be compensated by companies who can write that crap off.

Re:Banks

[beanlover]

I would agree except when they "write that crap off" that means that all taxpayers are picking up the pieces. If they are allowed to do such a thing then they still have little/no incentive to fix the problem.

What about those who have open relays?

[70Bang]

If they (victims) were granted pennies on the dollar for what spammers have made by utilizing Korean open relays, there'd be a lot of rich people floating about. If the Koreans (of any institution) were charged an open relay fee, they might be a bit more motivated to fix the problem. In fact, the Koreans might think twice before leaving all of those relays ready to be raped.

Obligatory

[dkleinsc]

Wow, 15 minutes or so and no old people joke, so here you go:

In Korea, only old people have their bank account information stolen.

(And in real life old people are frequently the target of scams, because they have money and tend to be easier to fool)

Bollocks

[brunes69]

I sue online banking exclusivly, and pay all my bills off it. I have some 15 or so registered.

Even so, if my bank started charging me a monthly service fee, I would jump ship with no hesitation.

I mean, it takes all of 5 minutes to reigster 10 or 15 accounts online. It is not rocket science.

The biggest pain would be swtiching the directd eposit at work, and only because it would take a few days to go through probably.

Not much of a deterrent IMO.

Re:Bollocks

[Anonymous Coward]

I switched banks to get a free ipod shuffle.

(TD bank in canada)

The next wave will be Pharming

[putko]

If the banks actually beef things up, the next wave of attacks will likley be pharming, as it allows the bad guys to circumvent the bank's methods:

http://www.wired.com/news/print/0,1294,66853,00.ht ml

MOD PARENT DOWN

[woolio]

He doesn't seem to realize that Linux has a Trusted Computing effort...

English lesson?

[LordNimon]

Someone needs to learn English:

This action obviously will not stem identity theft but the hope is that this will push banks into security improvements that will make identity theft much harder.

If you make "identity theft much harder", then obviously you will stem it. "Stem" does not mean stop, it means to "make headway against".

Re:English lesson?

[digitaldc]

This action obviously will not stem identity theft...

I think they meant to say 'prune' identity theft, as to cut the stem off completely.

If it is a cost, it is a cost.

[khasim]

If the cost of real, secure online financial transactions is that, then that is what it is.

The question is whether the benefits will be worth that cost. Or whether there is another option that will provide secure transactions without the cost.

Either way, the people most motivated to find the solution would be the banks IF they were held accountable as this seems to say they will be.

Too bad they don't do this by themselves...

[Nanoda]

It would be nice if banks and credit card companies actually did something to prevent and prosecute the crime that directly involves them.

Too often I read of someone getting their identity stolen or having their account run up, and the bank will reverse the transactions, issue a new card, and take no furthur action at all. Contacting the police also seems to result in no action, as they don't have the time, equipment, or mandate to follow up possibly tricky international schemes.

I'd bank with an institution that followed up and prosecuted such actions, but forcing them to do it is an option.

It's about time.

[signine]

You can't prevent home computers from being insecure, or outright stop identity theft. The idea here is that the banks will be financially responsible if any part of the process of banking with them opens up a customer to identity theft and/or if the bank itself is fooled by the identity thieves. This seems to be perfectly reasonable to me. If you're banking online you should have every bit of confidence that the bank you're working with will not only keep the data secure on its end, but also while the data is transit to you. Ideally, they should also make it work in such a way that the data is not stored on the user's machine at all, preventing intrusion from ever being a real problem.

Admittedly they'll never get around keystroke loggers or other such malware, but this is a good first step. Prevent what the users are able to do with a system we know is fundamentally insecure. Require various forms of authentication for requests that involve actually transferring money, at least one of which should be offline. Do not reveal information the user should already know (Credit Card numbers in full, user's SSN [or whatever the Korean equivalent is]).

It's really not that hard, it just requires feature-happy developers to stop for a second and ask themselves "but what if someone other than the user were logged in..."

Re:It's about time.

[sdpuppy]

>Admittedly they'll never get around keystroke loggers or other such malware,

Solution to that is easy - instead of keying in sensitive information such as SS#, password, and so on, put up a virtual keyboard that the user has to click on. Put the keys in different positions each time so that click loggers don't catch it.

But that wouldn't solve the problem of your nosey neighbor with his brand new telephoto lens peeking over your shoulder as you type/click :-)

Re:It's about time.

[signine]

...or someone watching via a BO/VNC type session. It would also be senselessly irritating to the users and if someone has already installed a keylogger, they've probably already installed the others too.

Re:It's about time.

[LegendLength]

Maybe you could send all users a CD via mail. It has a program that displays a number when run. That value is entered into www.bank.com and then the bank site spits back another value. When the user clicks next on their local software the numbers should match.

Re:It's about time.

[signine]

Unfortunately that wouldn't work either. You have someone who has full control of your computer and the software in it. The only really good way to authenticate in a scenario this terribly insecure would be via something akin to an RSA SecureID, or perhaps--and I like this idea--a telephone PIN to authenticate. Instead of performing stereotypical password authentication, the user would receive a phone number and a unique number. He would call the bank and input his login information (account number, password, etc) and then the unique ID from the website. This would authenticate the cookie the website had issued him, and he would be able to navigate freely.

Note: he in this context is used for brevity, it could easily be a she.

This is good legislation

[Anonymous Coward]

I put my money into a bank. I think that it isn't expecting too much of the bank to not give my money to other people. They earn money by investing my deposit, and in exchange they keep my money safe. If they get scammed, it isn't my problem.

(with emotion) IT IS CRACKING NOT HACKING!!

[sulli]

I said it so you don't have to.

Re:(with emotion) IT IS CRACKING NOT HACKING!!

[Anonymous Coward]

How do I mod this +1, old skool?

Re:(with emotion) IT IS CRACKING NOT HACKING!!

[Anonymous Coward]

Post it to trolltalk. 20721 is still active, I think.

Finally...

[steveo777]

A step in the right direction. Back in college some kid was swiping credit cards from people wallets and signing up for online services (porn mostly, but some dating services too). He wouldn't keep the cards, he'd just copy the info. People's addresses were freely available from the online roster, so that was all you needed.

Mine was swiped too, and I didn't even find out about it for about three months (had some overdrafts). Turns out this kid subscribed to some porn site that was pulling 60 bucks a month! I wasn't pleased.

I went into the bank and all they told me was they could put the funds under investigation and it would take up to 90 days to take care of. During that time I wouldn't have my money and that it wasn't likely that anything would happen. I called the companies customer service and argued the charges for about half an hour. They said they could cancel. I threatened legal action. They said it wouldn't work. I said I could prove that I never signed up for thier services, or used them because I log my IPs, and informed them it was THEIR resposability to verify ID, not mine. This is what did it. Charges refunded, overdrafts paid (and the bank refunded them too, got 60 bucks out of the deal).

Lately companies have been working harder at verifying ID, but they're also more adamant about not taking responsibility. Rather than the bank having responsability, I think, legally, if you can prove that it wasn't you, the store should be responsible.

Re:Finally...

[TykeClone]

Did you report this to the police? That was theft at the minimum. In Iowa, that would have fallen under an Identity Theft statute for prosecution.

The bank you dealt with was following Reg E and was doing what was proper. If you didn't find out for 90 days from the first such item, you might have even been out that first amount because you didn't report it back to the bank soon enough.

It is your responsibility as the customer to review your statement and make sure that there is no fraudulent or unauthorized activity.

Re:Finally...

[swb]

went into the bank and all they told me was they could put the funds under investigation and it would take up to 90 days to take care of. During that time I wouldn't have my money and that it wasn't likely that anything would happen.

This is why I won't have anything to do with a Visa/MC "debit" card attached to my bank account. All the banks "promise" that they will refund your money right away, yadda yadda, but the bottom line is YOU have to wait for THEM to give you YOUR MONEY back.

With a credit card, the only thing I'm out is a chunk of my credit line. Let the bank chase after their bad debt.

That's all well and good...

[OakDragon]

...now if the Nigerian government would just do something to get my money back from that doctor fellow!

Schneier Agrees

[omnirealm]

Bruce Schneier has long held the position that the banks need to be held fully responsible for this sort of fraudulant activity:

http://www.schneier.com/blog/archives/2005/12/kore a_solves_th.html

At the end of the day, the bank is entrusted with managing my funds. If my bank transfers my funds to someone else without my express approval, then the bank is at fault, no questions asked. The bank should have properly verified that I indeed wanted my funds to be released to the other party. If someone claims to be me, then the bank better make damn sure to authenticate that it really is me before taking my money out of my account.

Re:Schneier Agrees

[Detritus]

From talking to people who work in the banking industry, security seems to be strictly based on cost-benefit ratio. For the bank, it is often cheaper to skip security checks. Everything is automated and they rely on the customer to detect and report any problems. They will happily accept and pay out on forged checks that wouldn't fool a five-year-old.

Re:Schneier Agrees

[Anonymous Coward]

In other news, Bruce Schneier is now no longer allowed to make any changes to his account unless he turns up in person and submits a DNA sample, retinal scan, signature and voiceprint while under constant surveillance by cameras and five representatives of the bank.

Others Responsible

[TheOtherAgentM]

Wouldn't it make sense to make everyone involved responsible as well then? Shouldn't the ISPs be watching what comes into their users' email boxes. Why not hold Gmail, Hotmail, etc. accountable? The reason is you can't do this. You can ask them, but when it comes down to it, it's up to the user to be aware of what is going on out there. It's not the banks' fault that we are stupid, gullible people.

Re:Thats what SSL ceriticates are for

[rimalz]

SSL certs tied to ip addresses? All mine are tied to hostnames. I don't think anyone needs to "hack into DNS servers", modifying the host file on a win32 box to override a dns response is way simpler.

The Banks

[Digital Vomit]

Won't somebody please think of the banks? They're barely scraping by in these trying times as is it!

Re:Thats what SSL ceriticates are for

[Russ Steffen]

SSL certifcates are almost never issued to IP addresses, only to fqdn hostnames. In fact I've never seen a certificate with an IP address in the CN field, and I'm not even sure how a browser would handle it. In fact, issing a certificate to an IP address would make things even less secure. With a hostname, the broswer can check against a forward and reverse looklup, theoretically maximizing the number of machines that would have to be compromised to hijack the connection. It also subverts the only real check most certificate authorities do - verifing that the cert request is coming from the domain owner on record.

Possible solutions for banks

[romka1]

Banks could require you to install a piece of software that will verify the system to be safe allowing you to access you account only after the verification has taken place.
If you the verification fails it could offer you ways to fix your pc or something along those lines and would not allow you to enter your username/password...

100 Grand?

[n6kuy]

Woo hoo!

Holding software/service companies responsible.

[Douglas Simmons]

I'd love to see a EULA that had a line which afforded the user legal protection instead of just the typical kind that is intended exclusively to cover their ass. I read the article and there's no mention of which software was compromised, but if it's one that offers not only the software but maintenance and updates to it, be it Redhat or MS. This article doesn't mentioned whose product/service screwed up, or if it was human error on behalf of the bank. The hackers should not be the only ones to be demonized. You run an operation like this with a hole open, someone's going to break through it. I just installed snort on a small website and now the snort hack attempt email notification fills up my box faster than spam. Hacking should be expected just as rain would if the building's construction company used a form of concrete that wasn't waterproofed.

Imagine if you owned a ski resort operation and you just dropped twenty mil on a souped-up chair lift. As the lift company advised, you hired people to go regular examinations and keep it lubed up. Then one day the stress of a chair switching from the slow loading track to the high-speed main line caused the cable to snap, killing dozens of people, including lots of pregnant women carrying pandas. Checking the line integrity was not on the company-issued checklists of the maintainers you hired but the chair lift company said they'll have a look at it every six months to run stress tests themselves and they found a problem that seemed small enough not to bother fixing. The chairlift company, hopefully insured, ought to be the ones exposed to liability, and this Korean bank incident should be no different. The software company (assuming it's not Debian (in which case this wouldn't have happened anyway)) should be the ones absorbing the heat. That may not be the law, but it strikes me as common sense.

Re:Holding software/service companies responsible.

[LegendLength]

I agree it was interesting that the actual faulty software product was not named (was it the bank or Outlook displaying links wrongly). And the chair lift analogy is a good one.

My problem is that I understand that there are solutions. Whereas with the chair lift you could add an anti-sway system, you could give bank customers an RSA key, smart card or similar. But it means users who know better than to click a link from OE will have to pay this 'Outlook Express tax' now.

In Korea

[Cro Magnon]

only old banks have to compensate victims.

Freudian Slip??

[endoboy]

I sue online banking exclusivly

Wait, which one?

[Anonymous Coward]

I assume you're talking of South Korea, as in North Korea the 'Bank' is the stockpile of dead rats you've saved so you can eat and trade.

Yes, my post is probably redundant, but just stating 'Korea' is about as descriptive as U.S.A.S.S.R.

The credit bureas are at fault, too

[glengineer]

I'd like to see 'em slam the credit bureas too, for their racketeering : first I set up a service that you cannot live without (credit cards). Then, I'll make it easy for bad guys to use that service to steal your money. Then, I'll charge you for "protection" against those bad guys. Sounds like the mafia to me.

Re:The credit bureas are at fault, too

[Anonymous Coward]

I've been living quite happily without credit cards for years. I honestly don't see what the attraction is.

good for them

[supernova87a]

I think this is not a bad idea -- for example, if they made any bank/data aggregator/etc pay credit monitoring fees and penalties for every account holder's information lost (like say, when data tapes fall off a truck), banks might treat personal information a bit more like valuable information.

$50 x 100,000 records lost = big slap on the corporate hands.

Also in Denmark

[Carewolf]

It has always been that way in Denmark. Any money the bank loses because they trust online transactions are completely their own responsibility.

Why would it be any different? If the bank lets someone else withdraw your money over the net, I don't care how the hacker got the information, it is the bank that lets the wrong guy walk away with my cash.

Re:Thats what SSL ceriticates are for

[British]

Sometimes, there are legitimate reasons for this (such as a bank moving servers and not having time to get a new cert), but they are usually very temporary, so to be safe you can just not do any banking during that period.

1. Inform the customers in advance of server move.
2. Shut down the banking website to ALL customers until that cert is up.

No fucking around.

Use of a personal passcipher gadget

[rasmajx]

In my bank, which is a part of the Générali Group, you get this small device that looks like a calculator. Everytime you want to login into your account, you have to turn the device on, type in your PIN code, and get a random number each time. You than login in with your username and that random number. IMHO that severly tightens security, and prevents security unconscious users to mess things up.

That's the dumbest thing I've read all week.

[chaboud]

And I've been reading postings on Fark.

There could be meritous arguments to both of the sides here, but yours isn't one of them.

This is much closer to forcing Ford to give you a new car because you handed the keys to your car to someone with the promise of a better car in return. Absolutist inanity like "they should protect their customers" is absurd. The best way to protect customers from fraud involving online banking would be to stop online banking. This is clearly not acceptible, so a more reasonable solution must be found. Making banks responsible for the actions of their customers lifts the responsibility from those who should, at least, bear some responsibility for their actions.

Re:That's the dumbest thing I've read all week.

[chroot_james]

you're insane. if you really believe all problems are the customers fault, then join the mpaa and riaa and help create draconian laws that leave customers helpless to lazy and selfish big business.

Re:That's the dumbest thing I've read all week.

[Qzukk]

And yet, unlike a car (which people can and do loan out), a bank account site could take fairly simple steps to provide a more-secure authentication method. But they don't.

Personally, I'm not a fan of making it the responsibility of the smart to defend the stupid from themselves, but some of these things are things even smart people can't defend against, like stupid webdesigners. (Not an isolated issue. Look at www.wamu.com, www.bankofamerica.com, www.chase.com, the main pages are not encrypted but they have a username/password box on it. Normally, it would post to a secure site, but browsers don't provide a mechanism for displaying that a given form on an insecure page is actually secure. If you went there, and someone was using DNS poisoning to redirect you to their version of the site, there would be no way of knowing until after you hit submit that you weren't where you were supposed to be.) The banks aren't going to do anything about it themselves, they know that "has a properly secured website" is below "good interest rate", "low monthly costs", etc. are the features their customers are looking for.

You know what I want from a bank? "Write-only" account numbers, so I can give my account number to HR for direct deposit confident in knowing that should the guy get fired, he can't drain my account and flee the country. That level of security isn't even a blip on the radar of these guys, and frankly, they don't care.

Current US gov't would punish the customer!

[FatSean]

"The customer should be have more personal responsibility!", they'll say. "If a customer has their account compromised, we will charge them for the clean-up cost."

Because in the USA today...you don't count if you ain't a corp or a blathering religious retard.

Why not just...

[shiznatix]

Do it the good ol' Estonian way? Estonians use online banking to pay every bill that they get, I don't know anyone that does not, but you will never hear anyone complain about fraud, why?

Because we get a seperate card when you sign up for online banking that has 36 unique 6 digit numbers each a seperate password per-say.

When you login, your username is another 6 digit number that you are given (but which is perminant) then you have to enter your password (which you are forced to change every month). Then if those 2 are correct it will ask you for a random password off that card. Then, even after that if you want to transfer money to any account then you have to enter another one of those passwords.

Sounds a bit tedious when you write it down, but its really very easy because you just remember your username number and your password then when it says "Password 25:" you just take a glance at your card and bam, your in. Even if someone stole my wallet and had all my ID's they would not be able to have anything changed without a paper sent to my address notifing me, which is not printed on a single one of my Estonian issued ID's and thus would be hard to get.

Needless to say, I have never heard of a single case of identity theft in this country.

insurance?

[mottie]

I may be wrong but I believe this is covered for every bank in Canada is it not? I had my card double swiped and my bank account emptied (along with 50,000 other people in Vancouver I believe). I had the money back in my account within 2 weeks. All money in a bank is insured, just like your creditcard is insured. What's the difference between this and a robber stealing money from a bank?

That's not what I said.

[chaboud]

I didn't say that all problems are the customer's fault, and your attempt to lump personal responsibility with MPAA and RIAA positions is both childish and absurd.

I said that the customers "should, at least, bear some responsibility for their actions."

Customers who sign on for password-based services should be apprised of the risks involved in divulging information pertaining to their accounts. If that information is provided to others when they merely ask for it, how is the bank to keep the customer protected? Should they just eat the cost for some stupid customers? Should we?

I don't know about you, but I didn't sign on for an insurance-style amortization-of-transient-stupidity scheme when I put my money in my credit union. At least something along the lines of the $50 max for pre-report stolen-card use costs would put some responsibility on those closest to the source of the problem.

This is how it already works in Denmark

[thue]

This is how it already works in Denmark - and it works fine.

If somebody uses your card number on the internet, and the person who withdraw from your account does/can not document that it was done with your consent, you get the money refunded. So if somebody steals your credit card number and withdraws money with it, you get your money back from the bank.

A merchant may first withdraw the amount from your account when the object is shipped.

Thank heaven!

[Anonymous Coward]

Typical Trip Master Monkey...

Every frickin' post that can possibly be made on Slashdot always has more information available somewhere else.

God bless Trip Master Monkey! Because obviously the rest of us are too fu*king stupid to use Google for ourselves! Thank the Maker that his mom bought a Slashdot subscription for him just so he can frist psot every time!

That's our TMM - our beloved "always a more informative article at this link", frist-psoting karma whore.

Re:Thank heaven!

[Anonymous Coward]

What exactly is your problem? Everything TMM said is true...the article referenced in the summary was a joke, and the one he referenced had a lot more info.

Sure, I could have googled it for myself, but TMM saved me the trouble, and raised a few excellent points to boot.

Seems you don't give TMM the credit he deserves...but then again, it seems you have an axe to grind against him...What exactly did he do to you, to merit such acrimony?

Re:Thank heaven!

[Anonymous Coward]

Who said anything about having an axe to grind against you ... er ... I mean .. TMM? Nothing personal against you ... er ... I mean ... TMM. I just don't like karma whores like you ... er ... I mean ... TMM. Someone could quote the fu**ing Encyclopedia Britannica and you ... er ... I mean ... TMM would respond with "That article's really light on details. Here's a more informative link." and -- WHOOSH -- your ... er ... I mean ... his cronies would put you ... er ... I mean ... him up to a +5 Informative in no time. Anyone else who does that gets slammed as being a karma whore or "-1 Redundant".

Raised a few "excellent points"? The "credit he deserves"? Uh huh. Right. Now I'm convinced that you're TMM just trying to feign being an AC supporter.

At least you seem to have stopped it with those like-nails-against-chalkboard anime smiles that made me want to break things every time I saw them.

Re:Thats what SSL ceriticates are for

[thomas.galvin]

If the SSL ceritifcate does not match the IP address of the host you are connecting to, it should raise big red flags in your head.

The fact that you needed to point this out means that, for the vast majority of users, it will not raise a big red flag.

In other news...

[SheeEttin]

...even if the banks are not directly responsible. This action obviously will not stem identity theft...

In other news, Grokster has been shut down for music piracy. Though Grokster was not directly responsible, its products could be used to illegally share copyrighted files. However, piracy continues to flourish with other P2P clients.

But will the BANK choose to trust Linux?

[tepples]

He doesn't seem to realize that Linux has a Trusted Computing effort

But then you still depend on your bank to provide a "trusted" build of its software for Linux. Most banks won't think it's worth the money to pay developers.

mmhh... dog meat

[bundaegi]

For those idiot western media brainwashed idiots who don't know a thing about Korea, get a clue, nobody gives a damn about eating dogs or even hears about North Korea more than once a month here, just listen to your dear leader dog tell you who to attack next.

If only people knew how freaken delicious dog meat is, they wouldn't object so virulently (one would hope). After all, piggies are cute animals too, but we still eat them. "Oh no, the piggie I ate looked just like babe!" Big freaken deal!

I really love bosintang and suyuk but there's only so much I can eat in a week :-) What I'd love to try is dog meat samgyupsal! I guess it'll have to wait until I can travel to Pyongyang... unless there's a good DPRK restaurant in Seoul? Haven't found one yet.

And for all you animal lovers, check this page, it has many excellent recipes...

My card was fraudulently used in Korea

[tintub]

The bank phoned me last Saturday to see if I had been using my credit card in Korea. Apparently four transactions had been made. They cancelled the card and assured me that I would not have to pay for any transactions that weren't mine. I haven't seen the statement yet though to see how much was spent.

Re:My card was fraudulently used in Korea

[natureday]

It seems like where ever you go there is major fraud. That sucks.

Re:My card was fraudulently used in Korea

[tintub]

Doesn't bother me if the bank is gonna foot the bill. As for wherever you go there is fraud, I didn't even leave Melbourne :D

As opposed to the US

[grahamsz]

Where they let you choose a short password or sometimes even just a pin code.

Furthermore they often use your Social Security Number as the user id.

Online banking security in the USA is disgraceful, but no-one seems to hold the banks to task for it.

You couldn't PAY me to use most banks billpay sys

[ClioCJS]

tems......... I'd much rather use http://www.PayTrust.com.

Sure, it costs $9 a month. But I don't even have to RECEIVE my bills. My mailbox and trash have little to offer a would-be identity thief. And I'm not vulnerable to anthrax attack either. I cancelled my postal mail altogether. (Of course now I do Netflix so... um... if my choice is Netflix+Anthrax or No Netflix, I'll take the anthrax please.).

They receive your bills for you and scan them in. You can view them (or not) and have them automatically paid based on rules. 2 accounts are supported and 2 emails are notified -- set up for couples. At the end of the year you can order ($20 for 1 yr or $36 for past 3 yrs) a cd with all your bills on it. It is password protected and includes a java search engine that runs live off the cd.