Slashdot Mirror
Court Rules Passwords+Secret Questions=Secure eBanking
An anonymous reader writes "A closely-watched court battle over how far commercial banks need to go to protect their customers from cyber theft is nearing an end. Experts said the decision recommended by a magistrate last week — if adopted by a US district court in Maine — will make it more difficult for other victim businesses to challenge the effectiveness of security measures employed by their banks. This case would be the first to add legal precedent to banking industry guidelines about what constitutes 'reasonable' security. The tentative decision is that a series of passwords + some device fingerprinting is enough to meet the definition of 'something you know' + 'something you have.' The case has generated enormous discussion over whether the industry's 'recommended' practices are anywhere near relevant to today's attacks, in which crooks usually have complete control over the victim's PC."
We've been using one-time pads in Finland for a long time, and they do the job.
What's the issue?
I think this standard is OK, *if* the banks are liable for compromises (as they are with credit/debit cards). Obviously this isn't totally secure, but you have to consider everybody's wasted time when weighing alternatives.
There's a name for this sort of security - "Wish it was two factor" security.
And now a judge is ruling that it's enough, along with a "device fingerprint" that can be trivially faked? That is complete bullshit.
From a consumer perspective, the lower the bar is for "effective security measures" the better, because if an attacker breaks ineffective security measures, you're basically on the "caveat emptor" hook, meaning you failed to do due diligence, therefore any losses are yours. If the security's effective, the bank's on the hook for any losses due to theft. Think of it this way, your bank has a wooden safe, and a robber gets in, you try to sue the bank for your losses, the bank says "well, duh, we had a wooden safe, what'd you expect?", and gets off the hook, while if the bank has a steel vault, you sue, and the bank's required by fiduciary duty to cover your loss, even though it's not negligent. Kinda twisted, huh? But then again, look at the rhetoric flying around Washington about the banks, banking law is truly down the rabbit-hole.
Just because you're paranoid doesn't mean they aren't out to get you
I find it odd that Blizzard offers more security for a World of Warcraft account than your average bank.
Sometimes my arms bend back.
Seriously, everyone calm down. If your banks security sucks, switch. It's really easy. I switched banks on monday... it took me all of about an hour. Imagine if the judge had came down with a verdict like: True security is a 30+ character alpha-numeric password that is at least half capitals or special characters. The same password can never be reused. The user name must be a randomized 10 digit numeric sequence. Both user name and password can not be valid for longer than 30 days at which point both must be mail separately to the user on different dates. Users can not reset passwords without being in-person and present 2 forms of ID at a branch office. Lastly login periods can not last for more that 5min upon which the user must log in again.
What banks really need to do is give you options to lock down your online account. I want online banking, but I only want to transfer money between my accounts with that bank and 1 other account. Why can I not pre-approve those accounts and disable everything else unless I go down to the bank? Seems like a simple concept. Even if I were to get hacked, they could only move money around in my own account!
The company suing the bank had seen the bank's security measures. They had the opportunity to judge whether the bank's security measures were secure enough for them. The bank should win unless the precautions were unreasonably weak.
You would think everyone involved would be insured against these kinds of losses.
If you have a business account where the bank won't cover losses from fraud; if your bank doesn't implement effective security measures; if you have some reason to stay with that bank anyway; if you feel compelled to sign up for online banking:
Use a dedicated computer. They're cheap. You can afford to have one computer that's off limits for web surfing, online videos, dancing cursors and so on. For extra credit put it on a separate LAN segment, and of course you should have disabled Autorun anyway. Set it up so it can only connect to your bank's web site and to Windows Update.
I've worked at a bank where $30,000 was sent overseas by accident in a testlab incident. A testlab!
Banks are monumentally incompetent at securing their environments, so each individual needs to become accountable for the security of anything that takes place outside the bricks and mortar of their bank. Mmy strategy is to distribute my funds across a few different banks.
No password sharing minimises the risks, and distribution minimises the impact.
A decision by a U.S. District Court is not even binding within the same jurisdiction of that court. Yes, other District Court judges might give the decision some weight; but they are not required to do so.
Only when the U.S. Circuit Court of Appeals upholds a decision from a District Court in that circuit does the decision become binding on all the District Courts in that circuit. Even then, the decision is not binding in other circuits. To be binding throughout the U.S. requires a decision from the U.S. Supreme Court.
Even after the Supreme Court decides, similar cases may arise in which Circuit Court judges conclude the Supreme Court was wrong. Then the process starts all over again until the Supreme Court either upholds its prior decision (most likely result) or overturns its own prior decision (rare but not unknown). For the latter case, look at how long (about a half century) it took the Supreme Court to overturn its prior decision that "separate but equal" segregation was legal for public schools. Attempts to get the Supreme Court to overturn Roe vs Wade (abortion) have been unending for decades.
Conclusion: Living in California, I'm not yet worried about a ruling by a District Court in Maine on this issue.
If banks can't protect our money, and aren't liable when it goes missing, then what are banks for?
"In the absence of the ability to establish the attribute of truth they tried to establish the noble attributes."
Banks resist the idea because all the major trojans wreaking havoc have MITM /MITB capabilities to bypass the tokens and mobile sms in one way or another as well as cost issues.
The 2 European banks in the following article were using transaction signing tokens
http://slashdot.org/story/10/07/25/1954216/Online-Banking-Trojan-Stole-Money-From-Belgians
and mobile sms trojans have been around for awhile now
http://securityblog.s21sec.com/2010/09/zeus-mitmo-man-in-mobile-i.html
You might want to investigate https://www.shieldpass.com/ online authentication cards which are cheap and can do mutual authentication passively. For example specific transaction information can be included in the challenges to stop MITM and the process is passive or visual so the trojans or phishers cant walk a target through a transaction as they did with the first link.
First off, if your machine is controlled by your adversary your probably fucked one way or another regardless of what your bank does if you give your attacker enough time. Also I run windoze 7... feel free to troll me.
With that out of the way I highly recommend using keepass or something similar, not only do you get the obvious benefit of stronger and unique passwords but if a form wants answers to secret security questions, just pick a question, any of them it doesn't matter, and use a long random hex key as the answer, then store it in the notes section of that key entry in keepass, or don't store it at all, your choice. In short, bank security could be better, there are a few creative ideas above me that could be offered on their end like the firewall between your account and other accounts idea, but there are smart things you can do to avoid the pitfalls of these stupid ass "security" questions.
Also, if you want to sync the database across machines, but are worried that your password may not be strong enough in the event that your online service for syncing is cracked into do this:
1) set up a keepass database with both a password and a key file for encryption
2) share the encrypted database through your favorite online syncing service, personal home server, dropbox, whatever
3) set up syncing with online service on each machine you want to access the database
4) put the key file on each machine you did in 3, if you want this to be more secure than just a password you CANNOT share the keyfile through the net, but it literally never changes unlike the database so copy pasta across machines with a usb key or similar manually is easy enough
5) additional note: this will save your password database for a non-trivial amount of time if someone has both your online service's password and your keepass password but cannot access the key file, hopefully long enough for you to realize what happened and change your passwords.
6) as a corollary to that: if your machine is hacked and the hacker is smart enough to search for the keepass database and the key file then your screwed, note that naming the file cleverly, using a clever file type extension, or putting it somewhere obscure does not help since keepass "remembers" where it is, so all the attacker has to do is find where keepass stores that info and the easiest way to do that is simply start keepass...
Failure formatting five FAQs of financial facts.
What you see on your screen may be fake, and what the bank sees you type may be fake too.
The only thing that may not be faked are your identification to the bank, when using one-time-pad.
The obvious solution, which is too deep for bankers and judges, is to secure all the necessary information.
In practice this means having something looking like a calculator which shows each transaction,
having cryptographic secure two-way communication to the bank via the net, and being tamperproof.
A sort of two-way code calculator.
The bad thing about a precedent is that it will fix at a certain time. Imagine they find something that is secure as we know it, while still being usable. That would be effective today.
Tomorrow some smart person finds a way around that security, making it insecure.
Now the banks will say the day after tomorrow in a lawsuit: We did what was required, while the customer will say that security was not enough.
Don't fight for your country, if your country does not fight for you.
which involves old/new olives. Funnily the judge does not try to verify by himself but call somebody who is a trade of olives and knows about the topic of old/new olives.
Here in Sweden - my bank uses a keypad - where the user first must key in a pincode to activate the device. Then to login - you must key in your national security number (userid) - from this the bank generates a code - I key this code into my unlocked keypad - and get a return code. This is I guess similar to the RSA key generation (the device is not supplied by RSA incidentally) - except that the whole activity is locked down by a 4 key pin in my handheld device - which I guess is the key to the code generation. My bank thinks this security is impregnable (the last time I questioned it they laughed at me) - but after the recent RSA hack I really wonder if this is the case. If the generation algorithm becomes common knowledge (ie the security provider is hacked) - then all that is needed is to identify the 4 digit pin code.
My bank's site requires three things to authenticate me:
1: a user code, 8 characters of randomness generated by the bank (something I and the bank both know)
2: a password, at least 8 character of not-very-randomness generated by me (something the bank can check without actually having to store it)
3: a four-digit number from a printed wallet-size list of one-time codes generated by the bank (something I have)
The password used to be also generated by the bank, but they came to their senses; now that I get to choose it myself, even the clerk who created my account (and possibly caught a glimpse at my one-time password list in the process) does not know everything that is needed to authenticate as me.
The extra trouble is, of course, the exchange of the one-time code lists. This they do by mailing me a new one when there are ~20 unused codes left in the old one, and then I just need to log in to their web site, give the id of the new list, and confirm the list change by a code from the old list.
Not nearly as high-tech as SecurID, but works like a charm.