Slashdot Mirror
Everything You Know About Password-Stealing Is Wrong
isoloisti writes "An article by some Microsofties in the latest issue of Computing Now magazine claims we have got passwords all wrong. When money is stolen, consumers are reimbursed for stolen funds and it is money mules, not banks or retail customers, who end up with the loss. Stealing passwords is easy, but getting money out is very hard. Passwords are not the bottleneck in cyber-crime and replacing them with something stronger won't reduce losses. The article concludes that banks have no interest in shifting liability to consumers, and that the switch to financially-motivated cyber-crime is good news, not bad. Article is online at computer.org site (hard-to-read multipage format) or as PDF from Microsoft Research."
When money is stolen, consumers are reimbursed for stolen funds and it is money mules, not banks or retail customers, who end up with the loss.
I had my identity stolen years ago by a guy who managed to run up a bunch of charges on my bank credit card (still don't know how he got the numbers). And, while the bank did reimburse me for the stolen money, they most certainly DIDN'T reimburse me for over $200 in bounced check charges that came after he cleaned out my account, or the hit that my credit rating took after a bunch of companies reported me as a deadbeat for passing bad checks and missing automated billing deadlines. Yeah, just TRY repairing your credit rating after something like that and tell me that consumers don't take a hit for identity theft.
It puzzles me when I see that people work really hard to come up with difficult passwords for their bank accounts, but not for their personal accounts on their own computers. They really need to think about what value those passwords have to other people - in particular what could someone else do with those passwords if they had them?
I have used a fair number of different banks over the past couple decades and seen a lot of different online banking systems. Not once have I seen one where you could actually use the online system to arbitrarily move money outside the account owner's accounts. I have seen some where you can set up bill payments, but that was a chore and would not be useful for trying to pull money out quickly. Most online banking systems intentionally do not even give full account or routing numbers to logged in users, and I've never seen one give out SSN or DOB either.
On the other hand, people keep a lot of personal information on their PCs. If you can get their personal user names and passwords you could get a lot more useful information on them. A lot of users likely have their SSN and DOB in their browser cache somewhere, and almost everyone has their address somewhere in there.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
First of all, it's not theft if you still have your password. Secondly, if you leave your car unlocked with the engine running and go shopping, will the insurance company pay you back for your loss or call gross negligence? There's a difference between having a reasonable password for banking that's not the same one you use everywhere, and between using "hunter2" for every single place you have an account. And finally, I'm pretty sure banks don't reimburse money stolen from shops. Same goes on here. If someone breaks into the bank, you get your money anyway. If someone breaks into your home, the bank doesn't care.
if you got my bank password... you could use online billpay to mail a check and cash it... if it was under a thousand, my bank wouldn't blink.
so scenario.. I get a good set of identity papers, even just a license together for a lady who works all day
I have, 10 account passwords at different banks and use online billpay to mail out 10 checks for $900 + odd amount checks.
I swipe them from the mailbox of the lady who works all day....
I cash them all on the same day- visiting 10 issuing banks...
burn the ID
yes, I see where that could fall apart in a few spots, but I'm not a professional grifter, a variation of it should be achievable.
every day http://en.wikipedia.org/wiki/Special:Random
OK, so say someone steals money from your account.
the thief has made money.
If someone notices the theft I guess you get your money back, at least that is what the article claims.
I guess banks have insurance for this sort of thing, but even if they do they would pay more in insurance payments than they would in actual dollars lost over time; That is how insurance works. So they do lose money, unless they are allowed to make new money when some is stolen. This loss is passed onto you the customer.
Troll is not a replacement for I disagree.
The gist of TFA is that since the transfer from the person with the compromised password to the mule is reversed it is the mule that loses out, so the password isn't the bottleneck. (evidently the bottleneck is mule-recruitment and back-end fraud detection). This rather misses the point that it is a potential stopping point. If the account cant transfer money to the mule then the mule can't be persuaded to take commission and send the rest on by Western Union.
Maybe I'm cynical, but it seems to me that this analysis is a big "not my problem" statement by Microsoft. The client-end OS and browser security, which Microsoft has a big share of are not the "real problem" - that lies at mule recruitment and backend fraud detection systems, both areas where Microsoft has little investment.
Remember: there's a seeker born every minute!
Avoid eye contact. If there are no eyes, avoid all contact.
Another headline that may misslead people. Password stealing is not just a banking problem. Attackers may do a lot of damage to a person without needing to extract the money directly.
The most important lessons for passwords are:
1. One password, one service. Do not re-use passwords.
2. Prefer long to complex passwords.
Using a sentence that is important to you and modfy it per service.
E.g. "may the face be with you" for Facebook or "may the search be with you" for Google.
If the service allows such, you are beyond any rainbow table and those passwords are easy to remember and customize per service.
Really?
Pretentious titles like this are ridiculous. This story did not prove any of my notions wrong.
So the argument is someone steals my password, steals my money, gives it to a money mule... then I get my money back from the bank, and someone that doesn't cost me in the end? Even disregarding the fact that those costs are going to get passed on to me somehow... The inconvenience of having to deal with identity theft is not always minor (and there's probably collateral damage here as well).
My biggest beef with banking is that I don't, but should, have the ability to send money with end-to-end authorization, by way public key crypto. If, say, Amazon could verify that I authorized a purchase using my public key, then network security, and banking security, is irrelevant. Bitcoins have offered a very secure example of how this could work, assuming that you have good local security (your private keys are safe).
About a year ago, I had my debit card stolen by a bartender, who used it to buy plane tickets for a vacation. Even though I *paid* for the tickets, the airline (*cough* Jet Blue *cough*) refused to give me the name of the passengers listed on the ticket. That in itself stunned me. Then it got worse.
I went through the bank, saying I could ID the person with 99% certainty (since the bartender was talking about not being able to pay for tickets at the bar that night). They of course referred me to the fraud department. The fraud department then of course referred me to File 13. Not one care was given to the matter. When I pushed on the issue, they asked why I cared, my account had been reimbursed. When I said it was the principle of the matter, they laughed and said the bank would simply write-off the loss and everybody wins.
It was then I realized the banks may actually *want* the fraud.
And I now trust my mattress more than any bank these days.
http://www.youtube.com/watch?v=KThlYHfIVa8
Thanks for the info...
Using their numbers, we would have to introduce security measures that made passwords 1000000% more difficult to obtain, than they currently are, in order to put credentials on par with mules in terms of value. Having N mules available and N+1 passwords available, the amount of crime would be no less than if we had N*10^6 passwords available. They do not mention why we cannot remove the ability for a money owner (mule) to initiate large unrepudiable transactions. They indicated this was usually via western union or moneygram. What harm would we do society by removing those methods? Security is very hard. I don't believe we can make credentials even close to 1000000% more secure, and if we do not, we will only drive up the price of those credentials by an insignificant amount.
refactor the law, its bloated, confusing and unmaintainable.
Fidelity. Made me choose all numeric password because alphabets would confuse their old retirees who use phone based transactions. I was shocked and wanted to disable phone based transactions on my account immediately. Was told to take a hike. They can't disable it without disabling on-line access as well. Was forced to continue the account because our company 401K is with these morons. Have not checked recently if it has changed.
ETrade They used to be good. They had the concept of a "trading password" on top of a regular password. Exactly what I wanted. You need to provide the trading password to actually do trade or cash out money or transfer funds. They took it away! I called to complain. They gave me a free RSA dongle. These jokers imagine their customers having an RSA key fob for each account. Cant ditch them. Our company stock purchase plan is with them.
Schwab would give a RSA fob if I asked. But don't know how it works with Quicken. Will upgrade to latest quicken and see if it is supported. Even then I don't fancy dangling around with key fobs.
PNC Bank if you setup an all numeric username it would also serve as your phone banking user id. But you need all numeric password to use it with phones. Thank you PNC! I set up an all numeric username and a alphanumeric password. So phone transactions are not possible. With VOIP and caller-id spoofing phone banking is as vulnerable as on line banking. At least let me cut down one attack surface.
Why cant they give me two level passwords? Why cant they implement a two factor authentication like google does with cell phones? Why cant they send a text message on every transaction so that I would be alerted by any fraudulent activity?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
That's wrong terminology! Passwords are not Stolen!
Look, if you have a car and I steal that car then you don't have a car anymore.
If you have a password, and I get a copy of it, then you still have your password! We can both use the password, IT'S NOT STEALING.
Cashing out using stolen passwords is very difficult. If it was easy, customers themselves would transfer money in an untraceable manner and falsely claim fraud. The thief steals from the money mule, not the bank customer. Customers do not suffer direct harm, the indirect costs are not noticed.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Or you could just use online bill pay to transfer money to a prepaid credit card.
Each fraudulent charge comes with a chargeback fee against the merchant when it is discovered, no matter the amount, and that's profit for the bank and the processing network.
New Economic Perspectives
The article presumes that mules are recruited instead of created and thereby shoulder the risk. However, if the mules' accounts are fabricated through a fraudulent account creation (using stolen SSANs, identity theft, etc.), then the mule and the thief can be one in the same.
When the thief is the mule, then the risk is foisted back on the bank(s) and passwords absolutely matter.
"The article concludes that banks have no interest in shifting liability to consumers"
Chip-and-pin was supposed to be a security upgrade that they could use to justify shifting liability. Someone needs to provide more than an MS paper conclusion to convince me that this isn't the case.
The real problem with password stealing is that they don't tell you when it happens - and they CAN. Just list the last 3 times you logged in, with IP addresses. You can even add in the word (new) to an IP address that has not showed up before.
excitingthingstodo.blogspot.com
It sounds like you had a Visa-branded debit card, not a credit card. Visa/MC Debit cards serve no use other than to enrich the bank, the merchant fees are much higher than PIN-debit. And, as you have learned, if a thief gets a hold of your number, your bank account is empty and your bills bouncing while you argue with the bank.
It's far better to get a credit card and simply pay off the bill every month. That way, if it gets emptied, you argue with the bank about THEIR money. (With a Visa/MC Debit, you argue with the bank about YOUR money. Guess which dispute gets more attention?
And yes, the bank should have paid up the bounced check fees... might as well dump this loser of a bank entirely and sign up with a Credit Union.
yes, I see where that could fall apart in a few spots, but I'm not a professional grifter, a variation of it should be achievable.
My brother-in-law IS a professional grifter, and he has spent more of his adult life in prison than as a free man. I assure you that the scheme you described will not last for very long at all (in the US).
TFA described exactly why you need some idiot "mule" to act as your middleman, and described exactly why that idiot "mule" is the one that ends up losing all the money (the original victim is always made whole). And TFA described why the real bottleneck in financial fraud is in recruiting idiot "mules" and not stealing passwords.
It stands to reason that making it harder to recruit idiot "mules" would have a far greater benefit than making it hard to compromise banking passwords.
"article concludes that banks have no interest in shifting liability to consumers"
Article is completely wrong.
Chip and Pin is entirely to make it the customer's fault.
They have no interest in making THEMSELVES liable.
A more relevent subject for discussion is how the thieves got hold of your 'banking passwords` in the first place.
AccountKiller
Relying on just a password is not secure, IMO. Just as my house has a door lock AND a security system, my bank account has a password AND monitoring. I get alerts for transactions over a certain amount, and I get daily balance updates so that I can catch any unusual activity. Sure, set up a good password. But then monitor your account, and possibly your credit rating.
if you got my bank password... you could use online billpay to mail a check and cash it... if it was under a thousand, my bank wouldn't blink.
so scenario.. I get a good set of identity papers, even just a license together for a lady who works all day
Identity papers good enough to fool a bank cost money.
I have, 10 account passwords at different banks and use online billpay to mail out 10 checks for $900 + odd amount checks. I swipe them from the mailbox of the lady who works all day....
I cash them all on the same day- visiting 10 issuing banks...
burn the ID
yes, I see where that could fall apart in a few spots
It sure does. For a profit of $9000 (minus the cost of forged identity papers), you have left your image and paper trail in the security camera of the bank you used to transfer the money, plus ten other banks; plus stealing from the U.S. mail probably over four or five days and hoping that the nosy neighbors weren't watching. You're hoping that none of the ten got their bank statement and noticed the check payment in the three days it takes the check to be mailed. And once the first person complains, the warning about your forged identity is going to go out to all the other banks, and so when you cash check number n, you're hoping that the account holders of checks 1 through n-1 haven't been complained yet. And banks in the US have a three-day hold on availability of funds from checks; so you are going to have to wait and hope not one of ten people noticed the withdrawal.
Suppose it is a 5% probability of getting caught on any one transaction. On the average, you'll make $18,000 before being caught. That is so not worth it.
Or you could just use online bill pay to transfer money to a prepaid credit card.
Except that banks do know that trick and protect against it. It's not hard to put $50 on a prepaid credit card without leaving tracks. Try putting $9000 on a credit card, and they start keeping records of who you are.
http://www.geoffreylandis.com
So the argument is someone steals my password, steals my money, gives it to a money mule... then I get my money back from the bank, and someone that doesn't cost me in the end?
No.
The argument is that convincing everybody in the U.S. to make their passwords harder to crack won't reduce the number of thefts from bank accounts using stolen passwords, because the rate at which passwords are stolen isn't the factor that controls how many accounts are stolen from.
http://www.geoffreylandis.com
For a while I have thought that with all the data and transaction records, simply stealing money by transfering ought to be very hard.
Sadly many of these so called "mules" are small businessmen who ship goods thinking they got real money. Still a verification system might be able to help even them.
In Sweden we're forced to use smartcards to validate every single frickin' banking transaction. Yes, cryptographically signing every money transfer and bill payment with a physical device. Of course this eliminates a lot of fraud in Sweden, but the banks still accept unauthenticated transactions from outside of Sweden, so what's the point?
Unfortunately, I've found that most banking sites have horrible password policies, basically requiring an 8-character alphanumeric password (no special characters, spaces, or anything more than 8 chars).
My Mastercard provider allows (and requires) that I use special characters in my password. The last several banks I've used... don't even allow them.
So the crackers are being hoodwinked into wasting their talents trying to beat a system with defenses in depth so they won't destroy the communist political correctness eugenic machine governing their country. Bazinga!
You'd think those guys should know at least something about usability design. But nooooo.
now we need to go OSS in diesel cars
Apparently, everything I know about passwords is limited to online banking, because TFA doesn't seem to address anything else.
This could be simple if you just get a few druggies to help you out.
Have the checks put in the name of 5 - 10 druggies, using their real names. Make it seem like you have a bunch of freelancers renovating a house or something. Mail it to a neighborhood where the neighbors don't give a fuck.
Have the druggies cash the checks, at places away from their homes/areas they hang out in (i.e. where the bank tellers don't know them). They won't care if their ID and picture is seen in the bank, because they're getting drugs out of the deal.
Cost = a couple hundred dollars on drugs and maybe using a van, profit = $8000+?
Something similar actually happened to my parents - just with 1 person and less money - with the only thing stopping the person from cashing the check being that the bank teller knew my parents. The crook was dumb enough to go to their local bank (though he was smart enough to not use his own name - he used the name & ID of his cousin who looked similar enough for him to pass), and had made things out like my parents were paying him for roof repairs, but the teller knew my parents get their roof repairs done my my cousin, and that they had just gotten it totally replaced a couple of years before that and would not need such a pricey repair that soon. If not for that coincidence (if he had, for example, gotten a different teller) it could have worked out; my parents' neighbors don't give a fuck about strangers poking around. My parents don't use email and etc. (so no notifications that a check was cashed, no online balance etc.); if the teller hadn't known them and therefore refused to cash the checks, he could have been long gone before my parents noticed their account was empty.
This could be simple if you just get a few druggies to help you out.
Have the checks put in the name of 5 - 10 druggies, using their real names. Make it seem like you have a bunch of freelancers renovating a house or something. Mail it to a neighborhood where the neighbors don't give a fuck.
Have the druggies cash the checks, at places away from their homes/areas they hang out in (i.e. where the bank tellers don't know them). They won't care if their ID and picture is seen in the bank, because they're getting drugs out of the deal.
So, let's see, the druggies cash the checks, and promptly snort the money up their noses ("see, like, we was planning on giving you a cut a the money and everything, uh, cause you was helping us out and all, you know, but my dealer was there and I already owed him ten grand, and plus I really really needed a fix..."), and you get nothing.
Then, when they get picked up (because they did use their own names...), all 5 - 10 of them finger you as part of the plea bargain.
So, your profit is zero, and you have five to ten witnesses testifying against you, so you go to jail for wire fraud, bank fraud, utterance, and conspiracy. Not such a great plan.
http://www.geoffreylandis.com
A friend of mine, now retired, used to be one of the 'webmasters' for a local credit union.
They took a very lax attitude for passwords and site security in general, their attitude being that it simply wasn't worth the time and trouble to worry about security...That's what the Insurance Company was for.
People like to think the insurance companies as fair game, but when they take a hit, they pass the costs back to their customers in the form of higher rates. The financial institutions pass those higher rates on to these customers.
It's no different than when stores take a hit from shoplifters. The costs pass back to the customers in the form of higher prices.
Don't tell me we don't pay for this!
> The article concludes that banks have no interest in shifting liability to consumers,
Banks can't shift liability to consumers because it's ILLEGAL. They would do it in a heartbeat, as the huge scandals surrounding the financial crisis proved.
Page 6 of their PDF includes this little gem on email passwords, definitely outside the scope of the paper:
Those who have had an email password stolen to send spam know what a miserable experience that is, and it is little consolation to hear that the hacker probably earned very little.
Anyone who knows anything about email knows that you don't need someone's password to falsify mail from them (e.g.: SPAM or UCE). A number of failed initiatives like SPF try to address this, but will never succeed because not enough companies/domains/people implement them CORRECTLY. At the end of the day SMTP is a great solution to deliver mail but is fundamentally broken from a security point of view.
Banks have every interest in shifting the liability. In fact here in Holland banks have started to deny reimbursements to customers, including those who don't properly cover the keypad when they enter their pin.
Banks would murder customer who were no longer depositing money if they could get away with it