Slashdot Mirror
Banking Via Twitter?
In the latest example of how just because you can do something doesn't mean you should, one credit union has decided to offer a new feature, dubbed "tweetMyMoney," that allows members to interact with their accounts via Twitter. Can't wait for the next version, "tweetSomeoneElsesMoney." "tweetMyMoney, available exclusively to Vantage members! With tweetMyMoney, you can monitor your account balance, deposits, withdrawals, holds and cleared checks with simple commands. And, you can even transfer funds within your account. It's all available on Twitter, 24/7!"
I've got two words for this "Bad idea" seriously I wonder what genius thought of this up.
Epic FAIL!
Check out my sci-fi/humor trilogy at PatriotsBooks.
1. Target needs to be authenticated to the user. This should require some positive action, as opposed to relying on certificates which are mostly ignored and whose provenance is not as strongly assured as was initially advertised.
2. Customer needs to authenticate to the target. Passwords are not enough since humans can remember approximately 1 password only, and only if they use it constantly. The authentication should change and replays should be rejected.
3. Customer must affirm details of the transaction before it is committed. This too must use some method that is changeable and disallows playback.
Ideally a transaction will have all these elements in one idempotent package, the way for example a check might if the signature were a better biometric than it is and if the signature were checked always. That is however technically awkward on a net, so the 3 elements listed may need to be separately done. Omitting any of the elements allows different classes of attacks. If all the elements are present and tied together, attacks become very hard. Also, note, step 3 makes it largely irrelevant whether the customer is declared not-present afterwards or not. It serves also to terminate the transaction. Whether another transaction is begun or not is for the most part immaterial. (A method I have advocated to accomplish these would allow several transactions to be tied together if desired, in one session, but there would always be a "signature" or "affirmation" step for each, even if the initial authentication steps were recent enough to continue to use them.)
This needs hardware. However it can be done very cheaply; the hardware needed can in quantity be had for perhaps $3 a copy, possibly less, even as electronics. Paper approximations could be far cheaper still.
This seems like a GREAT way to lose all your money quickly.
I guess after it happens, you'll at least have something to really tweet about (as opposed to the fact you bought the new Brittney Spears album - no one cares!).
How about the very idea of banking by twitter? What twit thought THAT one up??
I don't need Twitter for that -- I just call the bank and talk to a human.
Now we see why the banking industry is so screwed; it's run by morons.
Free Martian Whores!
Tweet: you're broke. :) Thank you for choosing stupidity banking.
120 characters isn't big enough for my account balance.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
"This Twitter thing, yeah, it's all, like, Web Two Point Oh, and customer synergy interaction right, and then people can, like, interact with their data and it'll be all like, in the Cloud! Yeah!"
I can guarantee something very much like the above took place in their marketing department shortly before this was built. I've spent 10 years listening to this from marketing geeks - nothing more dangerous than a new technology half-understood.
sig:- (wit >= sarcasm)
As long as Iâ(TM)m throwing caution to the wind, Iâ(TM)d like to hear some embedded MIDI while I bank.
0 = 1 + e^(Alt something)
Dear Vantage customer, our free joke service will send you a tweet every day with a new hilarious joke. Please tweet "#tran $1000 f1 t123456" to @myvcu to start!
Said, "It's just like dice but it's got more sides And it tells me who lives and who dies"
Lots of OMGWTF!!! responses here, but having looked over the information they're providing (balances, holds, cleared checks, etc) and noting that there's no transmission of account numbers, PINs or other identifying information, I'm not seeing a major problem.
Just because you can have a knee-jerk reaction doesn't mean you should.
Slightly disreputable, albeit gregarious
I cannot wait to see how many twitter IP addresses start originating from Nigeria.
Twanking
I will be Twishing your details
the only command I will tweet would be ...
Tweet: SELECT All Money FROM All_Accounts TO My_Account NOW!
Is there a list of banks that support this? Just so, you know, the intelligent people can move their cash OUT of these banks?
I don't see the point of the service, but then I don't use Twitter.
I also don't see the point of all the critics. Everyone alludes to how easily someone can steal your money with this. Ok... how?
I see a bunch of functionality where you can monitor your account status. The only thing I see that mentions affecting your account status is transfering money within your account. I guess that's enough that you could mess with someone, but where's the profit motive? You're going to commit wire fraud just to piss someone off?
Site: https://twitpay.me/
Basically you attach your twitter account to your paypal account, then you can send money to any other twitter user with a simple message to that effect.
Of course, the catch is that the money never actually gets transferred until you "settle" the account. It just keeps a running tally for everybody, then you settle and pay the whole shebang at once.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
So when I receive a twit from my bank about someone else's account will a judge order my account disabled?
I herd u like security holes, so we put Twitter in yo online banking software so you can have security holes in your security holes!
What really surprises me about the idea of 'banking via twitter' is how the originating bank got this concept past their internal compliance officer/team/department. I just came off of a 6-month stint at an up-and-coming regional bank. While there, I learned a couple of really interesting lessons about banking in general: 1. Absolutely every breath they take and every move they make (rock on, Police) is filtered through federal and state regulatory compliance. 2. To my surprise, most non-national banks think nothing of throwing money at software solutions with outside vendors and these banks rarely require direct interconnectivity with what is referred to as their 'core' system. This, as it happens, is often an expression of point #1. So, I say #1 to point out that *someone* familiar with regulatory compliance must have signed off on the Twitter-banking idea. Many here have noted that the communication with a user's accounts is pushed into a private realm at Twitter, but that doesn't sound like an adequate separation to me. 'Private' tweeting or not, it seems to me that most compliance auditors would reel at the mere suggestion of tossing any account information into that electronic pool. They would also likely need to get some kind of compliance statement from Twitter itself to make the bank tweeting product available. I say point #2 just to say that I'm convinced there's alot of untapped opportunity in banking for hosted applications. ;-)
Dear Twitter, I'm broke... follow me?
Here let me invest that for you..and it's gone.