New banking code cracks down on out-of-date software

PSD

There is a little thing called the Payments Service Directive that comes into force in 2009 and will apply also to the UK that makes the onus for evidence and intent lie by the bank. So this measure will be of very short extent.

Full security

The one time keys + password might be able to prove to the secure site (bank) that the user is who he is and has the FOB. However as mentioned by Anton Ivanov, an attack vector would be possible by using man in middle attack or by hijacking the authenticated session using some method.

Obviously the Man in Middle could have his own valid SSL cert, so that the user sees the "key" and thinks he's secure even if it is the wrong site. This even happens with legitimate banks who use multiple domains across subsystems, some pop up windows may even hide the address bar completely.

Or worse, if the client desktop has already been infected, then anything is possible as the machine can show the user what he wants to see while doing something else. Even a compromised *user* account is powerful because it can fool the user into providing root credentials by displaying a false login screen, I bet even most pro's would be caught off guard.

There is a physical solution to all these things without resorting to out of band communication. The FOB's weakness is that it can be used to authorize *any* action, even if not intentional. It would have a small lcd display on it so the user could review the transaction(s) on it and then click 'Approve'. The device would then sign the transaction (or a hash of it), and this signature would be verified by the bank. So long as this "digital signing FOB" is kept physically secure and cannot reprogram itself so that it is not digitally exploitable, then the user has very high confidence that the signature can only be used to approve a specific series of transactions.

Such a device would be used at the *end* of a session/transaction instead of at the beginning. An attacker / middle man could go through the steps, but the user would have to approve the transaction. If he doesn't look at it, then it really ought to be his fault.

I wasn't going to write this in, seeing as this thread already has many comments. However am worried about someone patenting/profiting from the idea instead of benefiting the public. So hopefully this thread can be used to claim prior-art on the idea.

Oh great...

Sometimes I feel my own country's "third world banking" (Mexico) seems to be more advanced than some, but then the Bulgarian system seems to be more efficient. Oh wait, PKI has already been proposed over here.

OTP tokens over here are *mandatory* since 2007. Though it is true that implementation itself isn't regulated, so some have the OTP challenge during initial login, others have it for any third-party transaction; and some use challenge-response systems. Oh, and one bank uses some funny "number matrix" cards.

So security's been upped nationwide, and we have the added advantage that we have INSTANT inter-banking electronic transfers (search "banco de mexico SPEI" for that) unlike other countries where "quick" means "next day" or "next 2 days".

Even with cheques, longest time to wait would be 24 hours for "other bank" deposits.

Downside of course that fraud investigations usually take about 2 months to solve, and even then you might not get your money back. Oops! But at least they do try to be secure.

Banks???

I don't even use banks - no credit cards either. I rent so I don't have a mortgage. I pay my rent in cash - hand it right to my landlord and he gives me a receipt. I guess I'm lucky in that all my clients will pay me in cash. When I do have to accept a cheque, I cash it at the local money mart. I pay my other bills by money order. You can probably guess that I don't like banks and I don't trust them. And don't get me started on the insurance companies!

Full Security, clairify patents

I feel I must pre-emptively clarify my stance on patents.

A company should make a profit for building security devices, after all the existence of safe (hopefully open source) security devices *is* a public benefit. They should not make a profit off of the mere idea and algorithms of security devices, which is what such a patent would grant to patent trolls.

Some people may complain that it is impossible to compete/innovate without patents. However without patents, nothing is stopping them from building something better than the competition - actually building on their competitor's ideas without worry of a patent lawsuit. This would be a huge boast to innovation and to the public.

secure system

how about a simple device with a radio in it, we'll call it a "BankSafe" to please the marketing guys

when you log in to your bank account you just enter your username/accounts number then get a (constantly refreshing) "Please use your BankSafe to verify your identity" page. you pick up your "BankSafe" device, on the screen is a message "Are you trying to log on to online banking using <your ISP>?" you enter a PIN and "confirm". you want to transfer your life savings to someone you get a message "Please use your BankSafe to verify this transaction", you pick it up, on the screen is "Do you wish to transfer £50,000,000 to John Smith?", you enter your PIN and press "confirm". Of course an extendable system would be open to currently unknown future uses (allow the bank to specify custom messages for confirmation).

This could then be extended to your debit card transactions, the delay need not be more than a couple of seconds, so you put your card in like you currently do, wait 2 seconds, then instead of entering your PIN in to the shops machine you enter it in to the "BankSafe" device, press confirm, 2 seconds later the cashier gets a "payment confirmed" back from the bank and trasaction is complete, the same as the current system - with the difference that you enter your PIN in to your own machine, rather than having to trust the machines in every single shop (it's also not fixed in to a location on the checkout where the people around you can see you entering it!). of course you could use RFID as well then so no need to put a card in to the machine, merely take the device out of your pocket, enter PIN, payment made.

The only issue with this system would be radio coverage, however the bandwidth requirement is rather low and would mostly consist of encryption overhead, a low data rate network would be fine for this so would not need more than a few dozen masts to provide acceptable coverage of peoples homes, and for in-shop coverage, the shop has a low power transmitter in it (a small change to the hardware of the credit card machines in use today, to include the RFID reader and the "BankSafe" transmitter - it is already linked to the bank for transactions anyway)

Naturally communications are done using a secure form of encryption, bank sends messages encrypted with your public key and its private key (so you can verify its identity from its public key, and only you can decode it with your private key) and the same in reverse.

The only potential problem I can think of with such a system is online banking from a house outside of the coverage area, but it could have a failure mode that is less convenient but where you can enter a code given by the banks website and it will then give you the relevant confirmation code to give to the banks website.

The inconvenience of carrying the device around would not be a problem if it became universally adopted, as you would soon find mobile phones including "built in BankSafe support" so you can give your bank your phones certificate and you can then authenticate transactions using your phone which most carry with them anyway. and a standard fitting on the top of the checkout machines that you can rest the device in to power it would sort out flat battery problems (battery flat, just plug in to their machine for power, authenticate the transaction, then remove).

Such a system would of course work with multiple bank accounts with a single device, assuming they all used the same standard compatible system and allowed you to register your own device, rather than each sending you a separate device and insisting you use that.

Anyone see any problems with such a system?

@banks???

Curious. How the hell do you pay the Internet bill/electricity/etc.

Plus, which mattress do you stuff your wages under? I've a mate from the pub who's interested for some reason...

@banks???

Yep, cash is still king.

Like you said, we don't need banks for anything (unless you like people rooting through your personal life). I just walk down the street and pay all my bills in cash - Internet, utilities, etc... And it's super convenient, the utility office is on the way to the pub.

@banks???

You can pay just about any utility bill at the Post Office. You even get a receipt which is better than some banks...

I have internet with Zen who seem to accept payment by almost any method, though I don't see any mention of Flainian Pobble Beads on their website.

I do have a bank account (with the Co-op/Smile) but to I avoid Credit/Debit cards and Direct Debits. I don't go as far as AC above as I do pretty much trust the Co-op to look after my money.

Surely it's about the monkeys?

People are coming up with a whole lot of nonsense in this thread.

Surely this is about the morons that will dish out their account numbers, pin numbers and logins to any chump that emails them?

Why should the banks (and in the end every bank customer) have to pay for their moronity?

My bank phoned me this week about my life insurance. They asked me for my date of birth and my postcode. After me arguing with them for a little while they told me half of the answers which persuaded me it was them, and they already had the information. If your bank phones you and asks for your account number or password, move banks.

Banks could start to get sensible

Most people have quite predictable patterns to their spending. If someone, after years of mundane mortgage and grocery payments, suddenly needs to transfer all the money in their bank account to somewhere in Nigeria the bank's software should stop and think a bit. But its easier to blame the customer (cheaper, too).

I just happen to work on ebank security

First, the bad news.

Practically ALL current solutions are open to MITM (man in the middle) attacks, which can be installed via various means (malware redirecting or messing with DNS settings, dodgy WiFi twins or trusting a cyber cafe). The problem is that it's for Joe End User pretty hard to discover that his instructions are "translated" somewhere, so the current bank counter measure is usually scanning for questionable transactions and delaying them. In the UK there is less incentive to do this as the banks have successfully transferred liability to the end user (did you really think Chip&PIN was for YOUR safety? Better read "security economics" by Ross Anderson for a primer).

The problem, however, remains: how to get feedback securely to the end user?

Two ways: "in band" by using another approach that thus needs to rely on different protection than "regular" SSL (you wouldn't need that if people actually checked the Cert). The second way is "out of band" by using a different transport mechanism such as SMS. The latter is low cost, but becomes unsafe (and uncontained) the moment the SMS has to travel abroad past "inter telco" gateways. This is, however, a solution about to go live in a number of places simply because it's easy to get going. You'll find it for randomising logins (to defeat key logging) as well as transcation confirmation (true value of transaction and target, and a confirmation code).

And so we hit another issue that will keep showing up. We have static components in the logon, which can be used for denial of service attacks. 3x a logon means a blocked account and an angry customer.

I have seen a number of approaches, and the nicest one is one that does away altogether with a user name. Think of a session key acts as a salt to a known sequence - the result can be worked back to one specific user, but the algorithm + changing session key will make it much harder to hack together a combination that works as a valid account.

The issue is not an easy thing to work on because you have to balance usability and hassle against safety and available budget, but I have seen decent solutions emerge - you'll start seeing them go live in a number of places over the next few months, including new ways to manage your electronic identity in a way that YOU are back in control.

IMHO it's about time.

They Tried That...

here in New Zealand. The new Banking Code put the onus on customers to cover all losses unless the customer could prove it was the bank's fault. However one or two banks kept the old approach of covering the customers regardless. Then they all bailed and the code was changed back the way it used to be.