Slashdot Mirror
Online Billpay Provider Loses Control of Domains
An anonymous reader writes "Several sites are running a story about a domain hijacking at Checkfree, the largest provider of online bill payment services to numerous banks and credit unions. According to Network Solutions, someone logged in to the domain administration page using Checkfree's account, and redirected its domains to a site in the Ukraine configured to serve up malware to unsuspecting users." Things like this make me nervous about switching to otherwise-tempting online bill payment, but checks are dangerous, too.
Posting anonymously so I don't get sued.
Funny thing is it's a step back for Network Solutions security. You USED to be able to set it up to require a RSA key for domain changes, back when everything was done via odd forms over email.
Things like this make me nervous about switching to otherwise-tempting online bill payment, but checks are dangerous, too.
I'm one of those holdouts who still use paper checks, envelopes, and stamps to pay my bills. Once a month or so I'll bring the stack into the office and take care of it during downtime, and folks look at me like I'm transmitting morse code over a telegraph. I do bank online, but I don't do online bill pay.
One reason I still cling to checks is that they allow me to be the final arbiter and gatekeeper of my money, and I have better fiscal responsibility when I'm directly involved in disbursement. Each time I physically write out a check, there's a bit of mental bookkeeping that takes place. You can't sit down and write "One thousand one hundred ninety-eight and 32/100" without pausing for a moment to think, holy shit, that's X% of my paycheck. If you elect not to use online bill pay, you have to actually look at your credit card statements each month, instead of just setting up a $200 monthly ACH and ignoring the current total.
I'm afraid that if I set everything up to be paid automatically, I'd very quickly wake up to discover that my checking account is overdrawn because I wasn't paying enough attention. Writing checks and licking envelopes is my way of keeping tabs on what's going out the door each month. The potential security benefits don't hurt, as anyone screwing around with mailed bills faces the wrath of the United States Postal Inspection Service. Unlike most online fraud, fucking with the mails will actually get you in trouble, and USPIS doesn't blow you off if you haven't suffered hundreds of thousands of dollars in losses.
I do miss the one benefit that physical checks had up until a couple of years ago, the float. Check21 pretty much ruined that, but maybe it was for the better. Come to think of it, I haven't overdrafted since Check21.
Long live the check, just stay away from my routing numbers.
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
It's not hard to set up a page that looks exactly like the front page of anything. cfhttp does it for you (if you are for CF.) At the very least, a site could be hijacked, a cfhttp to the IP of the server could easily be set up, and the forms could be hijacked to steal your password. Slashdot isn't probably the most likely target, but I'm sure there are plenty of people here who's /. password is their email (or [insert any service here] password.)
This isn't an online banking issue, this is an issue of domain-stealing. The fact that it's banking-related is immaterial. If the domains stolen were instead several newspaper domains we wouldn't call into question the credibility of the news (at least not more than we do now).
I've been involved w/ online/PC banking for 15 years or so and can tell you it's been a huge time + postage savings for me. I have no idea what the cost of a stamp is because the only reason I'd ever need them is for bills. Give it a shot w/ just one bill for a month or two.
That said, CheckFree is fairly notorious for their poor service and it's not surprising to me if they turn out to be at blame here. Especially disturbing is the apparently slapshod response.
JAGga.me ----> Producing video games addressing emotional health and wellness issues affecting teens.
The current bill payers in America are getting old.
The credit card companies have a stranglehold on paying by any form of credit card.
Paypal is evil.
There is no nationally accepted payment system where someone or both do not get gouged some fee. Checks are one of the few ways both parties can avoid some of the fees though I've heard that banks are starting to jack up the cost of processing them.
Our banks do not cater to customers, they are hind bound and greedy. They won't do anything unless they can screw their customers or the government for money.
When the banks finally get less incompetent they might be able to pry online payments and credit cards away from the major credit card companies. It won't happen soon because of the long term incestuous symbiotic relationship they have.
I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
At least they pay security lip service. My mother was having trouble enabling online Suntrust banking from her OS X machine months back (we tried three browser types, all failed differently.) The Suntrust rep on the phone actualy made the suggestion that my mother go to a public library with a Windows machine since it would work there*. It's at this point I went from anoyed to extremely cross and chewed the person out. I wonder how many other customers with out Windows PCs and tech-savy children were following this advice.
*For some reason the software lets you manage your account fine from a Mac, but won't let you do the first time setup.
"You saved 1968." - Ms. Valerie Pringle to the crew of Apollo 8
Mod the parent up. Seriously. So what if he is an Anonymous Coward. frick'in stupid moderators. :P
What is so wrong paying cash? For example, I have a AT&T dsl account that I'm "suppose" to have
a CC attached to it for payment. Wtf? Why should I have to go through these loopholes to pay my bill?
Do I have options to pay the account locally? Yes, I finally found that out. Automated payments are
evil, end of story. When has it became so evil to pay by cash? If I can't have a option to pay by
cash, without loopholes then said companies need to be sued, period. Oh, and I'm billed a month
ahead of my usage. Nice.....
Life was hell, then I discovered Linux...
Really? Why do you rate Enom below GoDaddy? I'm too light a user to have any real experience personally. I've heard gripes about NetSol and GoDaddy on places like Slashdot, but not much about Enom. What is their problem?
Why don't Americans use wire transfer more often? In Europe it is a fast and relatively safe method.
From what I understand of events, if you were getting that message then YOUR bank did not know. CheckFree did not notify anyone, even banks, until well after the domain was recovered and the Ukrainian IP was down.
On my country, in pratice checks - electronic or real ones - is not accepted anymore. Too many frauds
Religion: The greatest weapon of mass destruction of all time