Slashdot Mirror
Everything You Know About Password-Stealing Is Wrong
isoloisti writes "An article by some Microsofties in the latest issue of Computing Now magazine claims we have got passwords all wrong. When money is stolen, consumers are reimbursed for stolen funds and it is money mules, not banks or retail customers, who end up with the loss. Stealing passwords is easy, but getting money out is very hard. Passwords are not the bottleneck in cyber-crime and replacing them with something stronger won't reduce losses. The article concludes that banks have no interest in shifting liability to consumers, and that the switch to financially-motivated cyber-crime is good news, not bad. Article is online at computer.org site (hard-to-read multipage format) or as PDF from Microsoft Research."
When money is stolen, consumers are reimbursed for stolen funds and it is money mules, not banks or retail customers, who end up with the loss.
I had my identity stolen years ago by a guy who managed to run up a bunch of charges on my bank credit card (still don't know how he got the numbers). And, while the bank did reimburse me for the stolen money, they most certainly DIDN'T reimburse me for over $200 in bounced check charges that came after he cleaned out my account, or the hit that my credit rating took after a bunch of companies reported me as a deadbeat for passing bad checks and missing automated billing deadlines. Yeah, just TRY repairing your credit rating after something like that and tell me that consumers don't take a hit for identity theft.
online banking- mine pulls up full images of check faces... which does include routing & account #'s
every day http://en.wikipedia.org/wiki/Special:Random
I have accounts with First Niagara (they acquired my HSBC account), ING Direct (recently acquired by CapitalOne) and Ally Banks. I frequently move money between them through the web interface - real easy to set up, you just need to be able to log in to both accounts you're transferring between. Furthermore, my girlfriend has an account with Keybank and we transfer money from her account to mine about once a month to cover living expenses (I pay for almost everything up front, she pays me her share monthly). All I needed from her to set it up was her password.
If I get your banking login info, I can probably get a good chunk of your money before you realize it. Fortunately, many banks offer email alerts for transfers over X amount or if another account has been added. However, if you target someone who doesn't check their balance or email more than once or twice a week, you can probably get away with it before they know it's happening.
About a year ago, I had my debit card stolen by a bartender, who used it to buy plane tickets for a vacation. Even though I *paid* for the tickets, the airline (*cough* Jet Blue *cough*) refused to give me the name of the passengers listed on the ticket. That in itself stunned me. Then it got worse.
I went through the bank, saying I could ID the person with 99% certainty (since the bartender was talking about not being able to pay for tickets at the bar that night). They of course referred me to the fraud department. The fraud department then of course referred me to File 13. Not one care was given to the matter. When I pushed on the issue, they asked why I cared, my account had been reimbursed. When I said it was the principle of the matter, they laughed and said the bank would simply write-off the loss and everybody wins.
It was then I realized the banks may actually *want* the fraud.
And I now trust my mattress more than any bank these days.
I think what they are getting at is that criminals have access to X passwords and Y mules, where Y is significantly less than X. Lets say they have 10,000 passwords for every mule that they have, and each mule will perform 10 transactions before they are caught out (or catch on, depending). That means you could reduce the number of leaked/grabbed/cracked passwords by 99% and still have the exact same amount of financial crime; and none of those numbers seem all that far outside of the realm of possibility to me.
But that is about overall crime and statistics. You can still lower your risk of being a victim by choosing strong passwords, keeping a clean pc, etc.
Fidelity. Made me choose all numeric password because alphabets would confuse their old retirees who use phone based transactions. I was shocked and wanted to disable phone based transactions on my account immediately. Was told to take a hike. They can't disable it without disabling on-line access as well. Was forced to continue the account because our company 401K is with these morons. Have not checked recently if it has changed.
ETrade They used to be good. They had the concept of a "trading password" on top of a regular password. Exactly what I wanted. You need to provide the trading password to actually do trade or cash out money or transfer funds. They took it away! I called to complain. They gave me a free RSA dongle. These jokers imagine their customers having an RSA key fob for each account. Cant ditch them. Our company stock purchase plan is with them.
Schwab would give a RSA fob if I asked. But don't know how it works with Quicken. Will upgrade to latest quicken and see if it is supported. Even then I don't fancy dangling around with key fobs.
PNC Bank if you setup an all numeric username it would also serve as your phone banking user id. But you need all numeric password to use it with phones. Thank you PNC! I set up an all numeric username and a alphanumeric password. So phone transactions are not possible. With VOIP and caller-id spoofing phone banking is as vulnerable as on line banking. At least let me cut down one attack surface.
Why cant they give me two level passwords? Why cant they implement a two factor authentication like google does with cell phones? Why cant they send a text message on every transaction so that I would be alerted by any fraudulent activity?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
That's wrong terminology! Passwords are not Stolen!
Look, if you have a car and I steal that car then you don't have a car anymore.
If you have a password, and I get a copy of it, then you still have your password! We can both use the password, IT'S NOT STEALING.
Huh? Just go to "transfer money", write the account number of the receiver and the amount, and off the money goes.
At least that is how it works here in Denmark. Very handy, too. Is the US still using personal paper checks?
The article is talking about irreversible and untraceable money transfer. If the bank has been given "the account number of the receiver and the amount", it is neither irreversible nor untraceable. When the person defrauded complains to the bank, they reverse the transfer.
Thus, the thief needs a mule, a person with an account that can be used to accept the transferred money and turn it (somehow) into untraceable cash.
Some banks, like ING Direct, even allow you to transfer money between two phones if you have their app installed. Steal someone's phone, find they have their passwords saved, install the app on your phone and transfer away.
Transfer to whom? To steal money by such a transfer you need to make an irreversible transfer to an untraceable account. (If it's not irreversible, they just take the money back; if it's not untraceable, they come after you and put you in jail.) The whole point of the article is that this process, making a transfer that the bank can't reverse and sending the money to an account that the law can't trace, is much more difficult than the process of stealing passwords.
http://www.geoffreylandis.com