Online Banking Has Widespread Security Flaws

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
With all the bad news about online banking and security flaws, I thought I would give you guys some good news for a change. Wait…this isn’t good news, this is more bad news….oops. I guess if there was any good news in all of this it’d be that your bank isn’t the only one at risk. O.K., I’ll shut up now.

The security holes stem from the flow and the layout of these Web sites, according to their study. The flaws include placing log-in boxes and contact information on insecure Web pages as well as failing to keep users on the site they initially visited.
Click to expand...
 
This is great news. Awesome, thanks.
I'm gonna go order some stuff right now.

Seriously though
Glad to hear the internet is getting safer! Oops, I mean worse(by being lazy).:eek:
 
meh, my bank covers 100% of the shit incase their online banking service fails. not like i want it to tho, but i do take care of my browsers security and always have NOD32 up.
 
I love how at the bottom of the article the:

Article said:
A list of the banks surveyed can be found here.
Click to expand...

link is broken due to an internal server error.
 
I have chase and dont know what the hell a hacker would do with my account. All it seems to let you do is pay credit cards and check your balances. It is very limited, it doesnt even tell you your full credit card numbers or your bank number.
 
idividebyzero said:
I have chase and dont know what the hell a hacker would do with my account. All it seems to let you do is pay credit cards and check your balances. It is very limited, it doesnt even tell you your full credit card numbers or your bank number.
Click to expand...

agreed

i don't think anyone would want my shit anyway...unless they want a ton of school loans and the wrecked credit that came with it.
 
You would be surprised at the desperation of some of these people. Where I am from, some of my neighbors had some pretty bad credit. They were often known to open accounts in their children's names and SS # with no intention of ever paying them back.

Your wack credit might be worth more than you think.

 
The problem is that there have been similar articles published about this same topic over the past couple years criticizing financial websites for the exact same stuff (not using HTTPS for the page, only encrypting the data in that form you submit, limiting the kind of passwords you can use).

Some banks won't let me use a password longer than 8 characters, and only with Alphanumeric characters to boot. Others want a username 6 - 8 characters long (or even place such restrictions on both credentials). One of my credit cards does a redirect to a site that has a completely different URL for the page that lets you log into your credit card account. Of course, that page is protected fully by SSL, at least.

There is also the fun thing where you type in https and get a redirect to http.

The IT at these places (and other sites that also should have better client-server security) are really doing people a disservice. Maybe this month's issue of Technet was right and most companies are doing it to save money, as full SSL-protection of the page requires more CPU overhead, so not doing full SSL allows them to perhaps not buy a couple more servers. :rolleyes:
 
I've been doing most all my banking online for 7 years now. Zero problems.
 
I had an account with Jerrod's jewelers breifly and went to pay online ONCE. In order to log in I had to give it my account number, name and SS, all on a screen that was secure but reported insecure objects?
 
BillLeeLee said:
The problem is that there have been similar articles published about this same topic over the past couple years criticizing financial websites for the exact same stuff (not using HTTPS for the page, only encrypting the data in that form you submit, limiting the kind of passwords you can use).

Some banks won't let me use a password longer than 8 characters, and only with Alphanumeric characters to boot. Others want a username 6 - 8 characters long (or even place such restrictions on both credentials). One of my credit cards does a redirect to a site that has a completely different URL for the page that lets you log into your credit card account. Of course, that page is protected fully by SSL, at least.

There is also the fun thing where you type in https and get a redirect to http.

The IT at these places (and other sites that also should have better client-server security) are really doing people a disservice. Maybe this month's issue of Technet was right and most companies are doing it to save money, as full SSL-protection of the page requires more CPU overhead, so not doing full SSL allows them to perhaps not buy a couple more servers. :rolleyes:
Click to expand...


Yeah I hear you about those password/login type restrictions. That is one thing I can't stand either, I want to be able use my normal jumbled up mish-mash one-time-use-you-have-to-definately-write-it-down-formula for passwords on any site where I have to provide one especially for my online financial stuff.

I would also guess that maybe some genius in their IT or whathaveyou would put forth the idea in addition to them saving money on secure socket layer that it "would be easier for our customers to remember their passwords/logons if we made them only 6-8 characters alphanumeric long". lol OK
 
matcauth said:
I would also guess that maybe some genius in their IT or whathaveyou would put forth the idea in addition to them saving money on secure socket layer that it "would be easier for our customers to remember their passwords/logons if we made them only 6-8 characters alphanumeric long". lol OK
Click to expand...


I hate this type of thing. I have used websites that have gone to both ends of this spectrum. If you are going to have a stupid password like your address, I almost feel like it shouldn't be the responsibility of the website to protect you from yourself. On the other hand, let me come up with my own real password if I am a bit on the paranoid side.

Then you come to the case of my old university. The webmail they used had some crazy password rules. They required a minimum of 20 characters, 1 lower case, 1 upper case, 1 number and 1 special character minimums. Then, to top it all off, you had to change it every 90 days. Password rules like this only cause post-it purchases to go up if you know what I mean.

 
aardvark sandwich said:
I've been doing most all my banking online for 7 years now. Zero problems.
Click to expand...

right.

Most of the problems aren't from holes in the website, but in the PC and network. Maintain those properly and there's little risk.

Actually the most problem I've had with online banking is wrestling with Bank of America's rediculous security and login schemes. Fortunately my main bank is straightforward while being secure and consistent.
 
That's nice, list the types of security flaws, then list the offending institutions. Saves the criminals wasted time in tracking this stuff down. So typical of sensationalistic reporting, show the contents of a pipe bomb loaded with nails on a news show and you wonder how many morons out there who never had an inkling to create such a device all of a sudden decides it would be a great idea to build one.
 
Wheresatom said:
They were often known to open accounts in their children's names and SS # with no intention of ever paying them back.
Click to expand...

MY ead beat step did that to me and my brother when we were 8. I am 30 now, brother 28 and we still are trying to get the utility companies/credit bureaus to understand the damn problem!
 
Well what is a hacker going to do with your online bank account? With my bank there is nothing there other than purchase history. Everything is blocked to me, there is no entering or listing of credit card numbers, no social security number, I dont think it even has my address. What could they possibly do if they exploited some vulnerability about my account? Pay off my credit cards?
 
You must log in or register to reply here.
Back
Top