Slashdot Mirror
Major Financial Groups Share Data To Fight Online Theft
smitty777 writes "The Wall Street Journal is reporting on some unprecedented steps being taken by major financial institutions to combat online theft. The initiatives include a new type of data center that would be used to analyze bank data for potential security threats. Additionally, a quarterly round-table between the rivals to attack security issues was proposed. The article notes that 'security threats are pushing the big banks to do something that doesn't come naturally for these secrecy-steeped institutions: share information with one another.' A video at MarketWatch digs into it a little bit more, and points out that the banks will spend an estimated $1 billion on protection this year, which represents a 12% increase. Technologically, there has been much discussion of two-factor authentication to improve security. In fact, security officials in Singapore are even hinting at biometric solutions."
The banks have decided to consolidate their weak IT policies into a convenient one-stop shop for attacks!
No longer will you have to break into a half-dozen banks to get the personal information of millions!
Women are like electronics: you don't know how damaged they are until you try to turn them on.
Having used both name/password, electronic tokens etc. to access my financial data, I would like to see an objective analysis of their security. I personally prefer the electronic tokens used by several Dutch banks (ING, Rabobank, ABN AMRO), above the name/password features used by American banks (BofA, Wells Fargo, Chase, JP Morgan, Credit unions, etc.). But the main question is: how do they perform in real-life? Which schemes lose more money to scamming or phishing?
Evaluating the performance of my parents (70+) with modern authentication schemes, does not bode well. My parents are generally unable to distinguish phishing mail from real mail - how should banks balance the convenience of email against the requirements for safety?
Can anyone point to objective evaluations of bank security and authentication schemes?
Biometrics; great; Like in Mexico, they will take your hand if you are lucky. If you aren't lucky, the bank will have some kind of life detector which will check if the hand is alive. In that case the gang just takes you along with your hand and then disposes of both together after the crime. With the exception of the situation where there's a guard actually checking that the ID system is being used right by a single person, what could be stupider than using a security token you can't change.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
I think it's funny how much money banks and companies with sensitive data spend on protection, yet they are 'defenseless' against hacker-attacks performed often by amateur hackers.
Biometrics must be the 'security' concept that combines the worst features with the best wiz-bang sci-fi aesthetic appeal... I can only assume that it was invented during a sort of 'product blackjack', where a group of players competed to see who could come up with the most awful ideal that could still be successfully sold...
"Hey guys, I'm trying to build a truly awful security system. Can anybody think of something like a password, only absurdly hard to change voluntarily, occasionally changed traumatically by forces beyond the user's control, and preferably left in traces all over the place during the course of daily life? Drinks are on me if successfully compromising it for one institution renders it strongly likely that it will be compromised across a large number of unrelated ones simultaneously!"
I signed up for a service to send a one-time-pad by SMS to my mobile phone for every online purchase. I've yet to receive a single request for a code, or a code itself, and it's been over 3 months.
Then again, Santander are completely rubbish.
Finally had enough. Come see us over at https://soylentnews.org/
Banks have already been sharing info with the National Cyber-Forensics & Training Alliance (NCFTA) which is a non-profit non-government entity. The NCFTA acts as a middle man between banks/other high value targets and law enforcement. They also do aggregate analysis on the attacks seen by multiple institution to determine if there are larger trends.
Watch out, that's personal ID they'll be sharing without client authorization and by an NGO! That's a felony in most states ...
The purpose of existence is to make money.
Of course it sounds good that the banks want to coordinate their security efforts. Probably one part of their analysis has to create profiles of common usage to be able to discern uncommon and possibly dangerous usage. These profiles will be much more detailed than their internal ones. Might they not use those profiles for other things like customer scoring, targeted advertising, etc., too? Or should I assume that they already share some data about their customers?
Technologically, there has been much discussion of two-factor authentication to improve security. In fact, security officials in Singapore are even hinting at biometric solutions.
Forehead or palm?
Electronics, more secure and convenient than cash...Yeah right, back to gold and silver.
How about the consumer and unions come together and take unprecedented steps to combat theft by banks and the Wall Street? First they commited fraud in multi-billion dollars, then get the money from the tax payers to not get bankrupt and now forcing the Europe and the USA into a degaced long recession by austerity and anti-labor politics.
http://www.mueller-public.de - My site http://www.anr-institute.com/ - Advanced Natural Research Institute
...banks are the place to work, for the next 2 years or so ( at least if you want to make big bucks ) ?
Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
...you don't use imaginary money (especially the one based on the debt promises [read: lies and make-believe] of others)... or one-crappy-factor authentication (and call it "two factor").
I know that when my game is done, it will be based on hard solid matter with a stable value. And there will be an exchange rate for imaginary money, that will make people rush to switch to my currency. (No, you won't be able to buy imaginary items [e.g. inside the game] with it. You will only be able to buy services. But since ALL products are just resources [which nobody owns] plus a series of services, that will be fine.)
> Like in Mexico, they will take your hand if you are lucky. If you aren't
> lucky, the bank will have some kind of life detector which will check
> if the hand is alive.
> In that case the gang just takes you along with your hand and then
> disposes of both together after the crime.
Wow...'Talk to the hand!' will get a whole new meaning now...
i can possibly rely on my financial institutions to keep me financially safe. i hit wells fargo this morning to change some coins into dollars and the banker at the counter couldnt count them without a plastic dowel to arrange them in. The entire time the banker on the floor lectured me without provocation about the banks many incredible services and why i should become a member right away. neither one thought to send me on my way with coin rolls perhaps.
now i know the banks public hat is quite different than their financial institution hat, but i cant help but conclude that when 'major financial groups share data' its going to be data about me, but its only going to be used to further their interests. come to think of it, when a publication mainly related to wall street prints a diatribe on how wonderfully secure major wallstreet institutions are set to become, one cant help but wonder if its the equivalent of trying to put a fresh coat of paint on an old car.
Good people go to bed earlier.
The banks are considering two-factor authentication? That's great! Now my bank account will finally be as secure as my World of Warcraft account!
http://us.battle.net/support/en/article/battle-net-mobile-authenticator-faq
(Seriously, my favorite online game has been offering two-factor authentication for years. Why is this a new revelation to banks?)
Biometrics; great; Like in Mexico, they will take your hand if you are lucky.
That example is a tad outrageous, as I believe the end goal was an RFID implant. Besides, if you can get their fingerprint, you can make a latex copy. I'm pretty sure that the 'gummy' fingerprint technique can still fool most dermal scanners.
No sig for you! Come back one year!
The specific example was installation of palm readers in ATMs. I don't remember anything about the RFID bit have a link? I don't see that it help, nor the fact you can forge the fingerprint readers easily with a rubber glove. Anything which is beyond the abilities and patience of a guy with a gun is a bad idea. What is needed is a PIN code with a maximum daily limit and a gradually extending authorisation system depending on the size of the transaction taking place. For example: if it's 100 your PIN is enough; if it's 1000 you also get a call and they use voice analysis; if it's 10,000 you have to visit a branch; if it's 100,000 the branch does serious authentication when you visit, checks your family is okay and so on.
As long as the cost of the authentication is a small fraction of the profit on the transaction and the loss through bad transactions is less than the cost to the criminals of the times they get caught, everything is okay.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
On the heels of MS sharing all info they have gotten from the malware with all the major big banking companies and law agencies, this is yet another great step towards uniting against a 5 billion dollar a year industry, identity theft/fraud!
I applaud it, although they might need to sanction some sort of governing body to help make decisions, else you might get one that wants to take their ball home if they don't play the way they like.
On the plus side, it just means more ideas will be shared across the board between all big banks, and security will be their #1 priority.