Slashdot Mirror
Fraud Threat Halts Knuth's Hexadecimal-Dollar Checks
Barence writes "You may be aware of Donald Knuth, the creator of TeX and author of The Art of Computer Programming, who used to post checks to anyone who spotted an error in one of his books — one hexadecimal dollar, or $2.56. No one cashed them though. This blogger has two of them proudly on his wall, but the sad news is that modern day bank fraud has put a stop to Knuth's much-loved way of keeping his books free of errors." (Here's Knuth's own post about the sad change.)
But wouldn't one "hexadecimal dollar" be... wait for it... exactly one "regular dollar?"
0x1 == 1
Can I have my cheque now?
MacBook Pro. Worst name since the Bicycle
Checks and credit cards are absurdly easy to fake in the modern world. Banks need to get off their asses and roll out a new system...With the billion dollar bonuses that they keep giving themselves, I'm not too sympathetic of the cost.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
That the financial system is not any more secure than this. I always thought there were some serious security measures taken by banks before transferring funds, like doing small payments whose value has to be confirmed, and stuff like this.
Just like any security issue, though, it appears convenience wins over security for now. It would probably be too detrimental to the big banks and financiers of the world to have to authenticate transfers properly. They're already reduced to quasi-poverty (WHAT? I ONLY GET 100MILLIONS TO SPEND THIS MONTH?).
If he explores all forms and substances Straight homeward to their symbol-essences; He shall not die.
But it seems he's found a bank that will offer adequate safeguards for the reward?
Personally, I'd prefer error-spotters to be written into the books like David Weber used to do, but I don't know how you'd kill anybody in a book on programming.
This is a sad commentary on our society and a horrible end to a wonderful tradition.
Obviously we must petition the United States Treasury to release a $2.56 bill with Don Knuth's face on it, which he can then autograph and send to the smarty pants who find errors in his book.
Anyone can print a check. Everyone knows this or at least should. Companies print their own checks. Government offices print checks. Hell, if you run out of checks you can just write your information on a piece of paper and sign. (Ask your banker if you want confirmation.)
Anyone can print a check with any account and routing numbers they want. While checks are low-tech, and easy to copy, they're also very easy to trace. The fraudster's bank has identifying information for whomever cashed the fakes, which makes prosecution trivial.
This is not 'the end of an era' unless you've been living under a rock. Have none of you heard of Frank Abignale? (Watch 'Catch me if you can.') Check fraud is as old as checks.
LOL, captcha: decency, which the fraudsters didn't have.
would think the way he does... If you can't beat the banks... create one. :D
Actually, don't the cheques start at $2.56, and then shift left by 1 as each error is found, up to a maximum of $327.68? (It's wise of Knuth to put a cap on it.. you might be tempted to cash a cheque worth (164)*$0.01..)
The tao of democracy: the government you can vote for is not the real government.
hexAdecimal
One of my friends left their laptop somewhere and it was "stolen." Among the other items in the laptop case was a personal check from me, and within the next couple weeks I had some mysterious payments going out of my bank account. During the resultant hassle, it became clear that the security on checking accounts is non-existent. As Knuth's post says, all someone needs is the routing and account numbers (numbers printed on every check) in order to make payments from the account and probably to get at the money in any number of other ways. No verification at all is done to ensure that the person making the payments is the person who owns the account. It seems outrageous that your finances can be compromised by writing checks to people you don't know, or just having one of your checks seen by someone untrustworthy, when that's basically what checks are for, but that's the way it is. What is it with bankers these days? Aren't these people supposed to be smart about money?
First, the blurb is very misleading. I took from it that the bank yelled at the use of the phrase "one hexadecimal dollar" which no banker would understand how to equate to the digits, $2.56. Since it's the text that wins in most audited disputes about amounts, that's a problem.
He's just paranoid about the MICR routing numbers, and how banks are not secure. This has not changed, and is not at all particular to him. It is odd that he's had multiple attacks while I've had zero, since he claims the attack is entirely despite any knowledge of the account holder's name or wealth.
Pseudocode: // I was going to write this in WEB but fuck that
(Mistake-finder framed the check for his wall.)
[
He could still PayPal... (?)
Evolution is a state-sponsored, state-protected religion.
I blurred the numbers identifying the account and such before posting mine online.
It is sad that things have come to this :(
Last time I checked you can't "void" a check you no longer possess. You can, however, put a stop on it, but that costs more than $2.56 at most banks.
This issue is a bit more complicated than you think.
Knuth writes that "before long, companies will find it impossible to give out paychecks without exposing themselves to unacceptable risk". When I interned in the US, I was absolutely stunned that my paycheck was actually a, well, check. Seriously, is that still common in civilized countries? Where I live the paycheck hasn't been a physical check since before I was born.
If you're going to rely on banks to get paid anyway, why go through the cumbersome road of checks? Just have the money transferred directly...
We should make every suit at every financial institution in this country write a thousand times on a blackboard:
An identifier is not a shared secret key.
This applies to account numbers, credit card numbers, social security numbers, drivers license numbers, everything.
The symbol that represents you is not the thing that proves who you are. Otherwise, your name itself would be all you need to verify your identity, and we all know how absurd that is.
Of course, the real problem is that they aren't held adequately liable for the fraud that occurs. They blame it on the customer and wash their hands of it. If we made them always eat that cost, I guarantee we'd see real progress against identity theft.
You hexed a decimal?
While it seems to be fine at the moment, it took a few tries for me to load it. So, to try and help the server, here is TFA: "Financial Fiasco Leading banks and investment funds have been foundering, because of bad debts and lack of trust; and other, less well-known kinds of fiscal chaos are also on the horizon. For example, due to an unfixable security flaw in the way funds are now transferred electronically, worldwide, it is no longer safe to write personal checks. A criminal who sees the numbers that are printed at the bottom of any check that you write can use that information to withdraw all the money from your account. He or she can do this in various ways, without even knowing your name --- for example by creating an ATM card, or by impersonating a bank in some country of the world where safeguards are minimal, or by printing a document that looks like a check. The account number and routing information are all that international financial institutions look at before deciding to transfer funds from one account to another. (See, for example, Grant Bugher's comments.) More and more criminals are learning about this easy way to acquire money, and devising new schemes to conceal their identities as they steal the assets of more victims. Nowadays almost everybody knows that it's dangerous to reveal your credit card number, or to have that full number on a printed document that somebody might find in the trash. Soon people will learn that it is equally dangerous to reveal the numbers that are printed in plain sight on every check. Forget signatures; banks have no time to verify them. The once venerable system of checking accounts is irretrievably broken. Before long, companies will find it impossible to give out paychecks without exposing themselves to unacceptable risk. One consequence of this debacle is, alas, that I can no longer write checks to reward the people who discover errors in my books. The system that I've been using has worked well for almost forty years; but recently I have had to close three checking accounts, and the criminal attacks on those accounts have caused significant grief to my bankers. (Certainly I do not believe that anybody who received one of my checks has been in any way a culprit. But all such recipients are entitled to bragging rights; therefore the numbers printed on those checks inevitably become known to random members of the public.) I cannot in good conscience continue to traumatize the people at my bank, who obviously have plenty of other things to worry about. After painful deliberation I've come up with a new plan, which I hope will be acceptable to all concerned, and perhaps even welcomed as an improvement. Instead of rewarding heroic bug-finders with dollars, I shall henceforth award brownie points, otherwise known as hexadecimal dollars (0x$). From now on it will be kudos, not escudos. Instead of writing personal checks, I'll write personal certificates of deposit to each awardee's account at the Bank of San Serriffe, which is an offshore institution that has branches in Blefuscu and Elbonia on the planet Pincus. It turns out that only 9 of the first 275 checks that I've sent out since the beginning of 2006 have actually been cashed. The others have apparently been cached. So this change in policy will probably not affect too many people. On the other hand, I don't like to renege on promises, so I shall do my best to find a suitable way to send money to anyone who really prefers legal tender. Everybody who has received a reward check or a hexadecimal certificate from me since 1 January 2006 automatically has an account at the Bank of San Serriffe, and these accounts are listed on the bank's website. All of these people have my undying gratitude for the invaluable help they've generously provided in order to improve the books and the software that I've written. I ask friendly readers to keep sending those precious bug reports, and to let me know if my new policy displeases you in any way"
Rather than the fictional bank, he could make good on the promises by purchasing money orders. The worst that can happen is a fraudster figures out a way to cash the money order, but the fraud stops there.
a check doesn't legally have to have your account or bank routing number on it. It certainly doesn't have to be printed by your bank.
The numbers are there to make it convenient for banks to move money around. A bank can refuse to honor such a check, but a bank can refuse to honor any check. There's no legal obligation to honor any check.
The numbers don't turn an ordinary piece of paper into a check. What does that is your signature.
I once knew a guy who wrote out a check to another guy on a napkin. He then went over to his bank branch with the other guy and made sure they honored the "check", which after some discussion they did. He could have just withdrawn money, but he wanted to prove it could be done, and he did.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
If no one is cashing the cheques anyway, why bother with a cheque? Knuth could just create signed certificates and geeks will still scramble to get them. The guy is famous enough now that there's no need for any monetary incentive...
Cuz he's obviously wrong. He's such an idiot.
It's called a joke.
I imagine that at some point consumer accounts will get the same protection that business accounts get with positive pay features. Basically companies write all their checks then send their bank files with each check number and the amount of the check.
All they need is a web interface that does the same, then I can put in the information for the one check I end up having to write each month.
How pervasive of a problem is check fraud to the BANKING industry? When it is YOUR account it is a problem. I guess they have had bean counters study this and the extra security is not worth the money and time.
PS Remember getting the ACTUAL cancelled check with your statement.
PSS There is mom and pop dry cleaner in my neighborhood that hangs bad checks on the wall. Those are ripe for the theft!
If you look at http://en.wikipedia.org/wiki/Knuth_reward_check you'll see a picture of a check with all the numbers. A Yahoo-image search immediately yields scanned checks, both front and back. More attack vectors, indeed.
How about doing it via Paypal instead of direct deposit or check?
I explicitly tell Anglophone clients not to send cheques. It is easier, cheaper and less time-consuming to do your banking electronically.
In my country we're not used to cheques. Cashing it would take me a 45 minutes trip to the bank (depending on the waiting line) plus it costs me over 10 Euro to receive my money. Excuse me?
So, I'm sending it back although I'm not sure what the consequences of that are.
Bert
Well, probably the Koreans laugh at the way we pay here anyway (they can pay just about anything with their mobile phone).
Just send an MO for $2.56, you can do it at any post office, any bank, or most convenience stores. Since it's a one-time use thing, they can't steal money out of your account.
Okay, so the fee is a bit higher, but I get the idea that Mr. Knuth isn't exactly hurting for cash.
Apart from the whole "they're evil" part.
you had me at #!
That the word you're looking for?
if he had posted the checks in binary and the clerk didn't notice the difference...
I work for the Department of Redundancy Department.
There is good protection on money orders in form of the USPIS. That is the post office's police force. Really, they have their own federal police force specifically for the purpose of investigating mail crimes. This means that in the event a money order is stolen, there are police who are actually interested, and able to, look in to it. Your local police force can't do much if the check crossed state lines, and the FBI isn't interested unless it's a large amount. However the USPIS, well that's what they do. Mail crimes are their reason to be. That isn't to say they close every case of a stolen money order, but there is at least a group that will look in to it. Makes them much more secure than a regular check, in general.
I know this is off topic, but can someone explain the point of these posts? I'd like to think it's just trolling, but trolling usually involves making comprehensive sentences whose statements are formulated to annoy people with a certain worldview. These posts, on the other hand, are like a nonsensical, malfunctioning Markov chain.
'"The system that I've been using has worked well for almost forty years; but recently I have had to close three checking accounts, and the criminal attacks on those accounts have caused significant grief to my bankers," says Knuth.'
Maybe (and this is just wild conjecture here) that has something to do with idiots writing articles like this, complete with scans of people's personal cheques with the signature uncensored. Brilliant. Real effing brilliant.
So who got the 'last' one?
I'm sending it back although I'm not sure what the consequences of that are.
I can't speak for Euro/UK law but in the US, nobody is required to take a check. There simply are no legal consequences for not accepting a check for payment.
Cash, on the other hand, specifically says, "This note is legal tender for all debts, public and private", so it has to be taken if the service or product has already been provided.
In the US, companies are not required to take coins but they are required to take cash for "services rendered". ie: you've already received the benefit. If the service is not yet rendered, then they/you can negotiate the required terms of payment. But now you're getting into contract law...
Hah, screencapped for posterity (0 is a post!) http://i38.tinypic.com/dr8gzn.jpg
Umm. You do realise that only Fundamentalist Atheists are required to scorn everything that a theist does. Mere fanatical Atheists just scorn theism, and evaluate other aspects of a person's character and activity according to whatever criteria are locally relevant.
Slashdot isn't an especially atheistic crowd to begin with and I don't think I've ever met an atheist who thought that theism necessarily prevents somebody from doing good work in other areas(though it certainly can). Strawman much?
and since check21 legislation (google it), physical checks can be transformed into digital copies by processors...then shredded. it cuts down on shipping fees, but its hard to read a holographic UV watermark through a bad black and white JPEG.
sorry, i work in that environment, and what you are saying is just not what i see every day.
banks are not 'working hard' to prevent check fraud. . . they are working lazily when they feel like it. What they are working hard on is reducing costs, and outsourcing. some of the software that processes checks is owned by Indian companies, and when you call for service on your check processing machines, the person who answers might just be in india too.
hell, banks arent even 'working hard' to make electronic check payments secure. a high school kid, with just a tiny bit of knowledge, could steal tens of thousands of check account numbers in minutes, and my employers would never know. considering the high turnover rate of employees here, who make less than 10 dollars an hour to bust their ass and get yelled at for being lazy, its a miracle it hasnt happened yet.
and i am not going to point out the problem either, because anyone who knows about computers or points out potential problems at a bank is considered a 'terrorist', because of bankings' anal-retentive, hyper-hirearchal, techno-ignoramus republican filled culture. they'd rather wait until disaster strikes, then have the government bail them out, instead of spending any time/effort to deal with it.
restaurants, bars, theatres, grocery stores, boutique shops, and gas stations are the ones 'working hard' to prevent check fraud... by not accepting checks anymore. this doubtless costs them some business, but they have to do it to prevent theft.
as the poster above said, banks win either way with bounced checks. . .. why should they care?
I havent written a cheque in my life and I get along fine. Why do we still need a system based around sending bits of paper around when I can log onto my internet bank and transfer money to any other Australian bank account in a couple of minutes (although the money doesn't actually end up in the other account right away unfortunatly)
Seriously, checks? In 2008? You might as well complain that you can't pay with beads and mirrors any more.
At least thats something the Korean's cant pay with their mobile phones. Of course if they could they could live for free- Charge everything to the mobile bill including the mobile bill which includes the things you charged last month. Infinite recursion!!! Of course there is a real world example for this behaviour- the US dollar . The US pays for everything using paper dollars which are worth only the paper they are printed on - anytime anyone wanted something real in return say gold all dollars would instantly be worthless so noone demands payment and just pass on the dollars while the national debt keeps growing just like the mobile bill would but noone is bothered as the debt is being serviced just like the mobile bill is paid every month.
**Life is too short to be serious**
Hmm... Funny thing is, when I check my SlashDot user page, the only comments from me that are ever modded down are about atheism.
Slashdot mods are willing to asses the merits of even a closed source argument or laugh at a Pro Republican joke, but give them anything involving Religion or Evolution and you get the instant knee jerk.
--= Isn't it surprising how badly I spell ?