Everything You Know About Password-Stealing Is Wrong

isoloisti writes "An article by some Microsofties in the latest issue of Computing Now magazine claims we have got passwords all wrong. When money is stolen, consumers are reimbursed for stolen funds and it is money mules, not banks or retail customers, who end up with the loss. Stealing passwords is easy, but getting money out is very hard. Passwords are not the bottleneck in cyber-crime and replacing them with something stronger won't reduce losses. The article concludes that banks have no interest in shifting liability to consumers, and that the switch to financially-motivated cyber-crime is good news, not bad. Article is online at computer.org site (hard-to-read multipage format) or as PDF from Microsoft Research."

Comments

The hell it doesn't cost consumers!

[Anonymous Coward]

When money is stolen, consumers are reimbursed for stolen funds and it is money mules, not banks or retail customers, who end up with the loss.

I had my identity stolen years ago by a guy who managed to run up a bunch of charges on my bank credit card (still don't know how he got the numbers). And, while the bank did reimburse me for the stolen money, they most certainly DIDN'T reimburse me for over $200 in bounced check charges that came after he cleaned out my account, or the hit that my credit rating took after a bunch of companies reported me as a deadbeat for passing bad checks and missing automated billing deadlines. Yeah, just TRY repairing your credit rating after something like that and tell me that consumers don't take a hit for identity theft.

Re:The hell it doesn't cost consumers!

[Anonymous Coward]

They also don't reimburse the cost retailers have to pay for each fraudulent transaction.

Re:The hell it doesn't cost consumers!

[Anonymous Coward]

Yes, you do have to fight those things, because among other reasons, the banks deliberately do choose to keep the bounced check charging people out of the fraud reporting loop, so you have to find somebody to knock the heads together and get the information shared. And even then, your liability is controlled by state law, so that limit is up to them anyway.

Your credit rating, however, you can repair, by disputing those false charges. And if the credit rating company mishandles that, you can get some serious money out of them.

Re:The hell it doesn't cost consumers!

[blueg3]

Either your bank sucks or you didn't browbeat them enough. They should reverse the bounced-check charges resulting from the stolen money.

You need to dispute the results of identity theft on your credit rating. If the rating agencies refuse to fix it, you can sue the pants off them.

Of course, this is a lot of trouble and it sucks pretty hard. TFA actually agrees with you on this.

Re:The hell it doesn't cost consumers!

[Intropy]

FTA:

"Thus, in the US, individual consumers are largely insulated from the direct financial consequences of credential theft..." (emphasis in original)

"While 'we all pay for cyber-crime' is true in a general sense, it is not the case that individual users face grave financial risk."

They're pretty clear that they are discussing risk of catastrophic loss to a single individual rather than increased shared costs.

Re:The hell it doesn't cost consumers!

[ragefan]

Clearly, you missed the 60 Minutes report this week about Credit Rating companies and their dispute process (source).

In a nutshell, your dispute is never sent to someone who will approve it, and you basically have to sue them to fix it. Its a multi-year case and you better be well documented.

Re:Banking passwords are overrated

[way2trivial]

online banking- mine pulls up full images of check faces... which does include routing & account #'s

Re:Banking passwords are overrated

[SJHillman]

I have accounts with First Niagara (they acquired my HSBC account), ING Direct (recently acquired by CapitalOne) and Ally Banks. I frequently move money between them through the web interface - real easy to set up, you just need to be able to log in to both accounts you're transferring between. Furthermore, my girlfriend has an account with Keybank and we transfer money from her account to mine about once a month to cover living expenses (I pay for almost everything up front, she pays me her share monthly). All I needed from her to set it up was her password.

If I get your banking login info, I can probably get a good chunk of your money before you realize it. Fortunately, many banks offer email alerts for transfers over X amount or if another account has been added. However, if you target someone who doesn't check their balance or email more than once or twice a week, you can probably get away with it before they know it's happening.

Online security for banks is a joke.

[140Mandak262Jamuna]

I have made many posts asking for two level access. First level password is good for looking at balances and bills etc. And you need the second level password to actually move money or cash it out. But each financial institution does it its own way. The final decision seems to be made by some old coot who gets mortally afraid of computers, who has a bevy of secretaries who print their emails and put them in folders, whose on line skills match that of Donald "I save classified docs in my unsecured personal laptop" Rumsfeld or David "gee I will exchange mail using drafts folder, no one will think of it ha ha ha" Petraeus.

Fidelity. Made me choose all numeric password because alphabets would confuse their old retirees who use phone based transactions. I was shocked and wanted to disable phone based transactions on my account immediately. Was told to take a hike. They can't disable it without disabling on-line access as well. Was forced to continue the account because our company 401K is with these morons. Have not checked recently if it has changed.

ETrade They used to be good. They had the concept of a "trading password" on top of a regular password. Exactly what I wanted. You need to provide the trading password to actually do trade or cash out money or transfer funds. They took it away! I called to complain. They gave me a free RSA dongle. These jokers imagine their customers having an RSA key fob for each account. Cant ditch them. Our company stock purchase plan is with them.

Schwab would give a RSA fob if I asked. But don't know how it works with Quicken. Will upgrade to latest quicken and see if it is supported. Even then I don't fancy dangling around with key fobs.

PNC Bank if you setup an all numeric username it would also serve as your phone banking user id. But you need all numeric password to use it with phones. Thank you PNC! I set up an all numeric username and a alphanumeric password. So phone transactions are not possible. With VOIP and caller-id spoofing phone banking is as vulnerable as on line banking. At least let me cut down one attack surface.

Why cant they give me two level passwords? Why cant they implement a two factor authentication like google does with cell phones? Why cant they send a text message on every transaction so that I would be alerted by any fraudulent activity?

Re:Banking passwords are overrated

[Geoffrey.landis]

Huh? Just go to "transfer money", write the account number of the receiver and the amount, and off the money goes.
At least that is how it works here in Denmark. Very handy, too. Is the US still using personal paper checks?

The article is talking about irreversible and untraceable money transfer. If the bank has been given "the account number of the receiver and the amount", it is neither irreversible nor untraceable. When the person defrauded complains to the bank, they reverse the transfer.

Thus, the thief needs a mule, a person with an account that can be used to accept the transferred money and turn it (somehow) into untraceable cash.

Some banks, like ING Direct, even allow you to transfer money between two phones if you have their app installed. Steal someone's phone, find they have their passwords saved, install the app on your phone and transfer away.

Transfer to whom? To steal money by such a transfer you need to make an irreversible transfer to an untraceable account. (If it's not irreversible, they just take the money back; if it's not untraceable, they come after you and put you in jail.) The whole point of the article is that this process, making a transfer that the bank can't reverse and sending the money to an account that the law can't trace, is much more difficult than the process of stealing passwords.