Text 12087, 77 rader
Skriven 2010-11-15 08:18:22 av Robert Bashe (2:2448/44)
  Kommentar till text 12051 av Ross Cassell (1:123/456)
Ärende: Unbelieveable stories
=============================
Ross Cassell wrote to Björn Felten on Sunday November 14 2010 at 14:55:

RC> You have no control of the security of your financial info, once it
RC> resides on computer systems _**_NOT_**_ in _your_ control. My Visa
RC> Check card got compromised exactly that way..

Well, I agree you have to pay attention what is done, but "no control" is going
a bit far. I still don't really see how your Visa card could be compromised in
the manner you describe, since the magnetic strips contain more than merely the
card number - I suspect someone may have made a copy of the information on the
strip sometime when you charged something and then sold that data. Things like
that have been reported in Europe.

At any rate, that's a different kettle of fish than online banking...

RC> I dont argue against online banking, as I paid a few bills this
RC> morning with a few mouse clicks, but dont kid yourself bucko.

...since online banking in the States really is a security risk.

I don't know about your bank, but at the Fifth Third in Cincinnati, where my
sister banks, you require only the number of your "Jeanie card" (account card)
plus a password - and it's possible to use even your social security number as
a password (that people could be so dumb is beyond my comprehension, but
apparently this _is_ done) - to log into the account, after which you can send
checks to anyone you please without further authentication. Except in the case
of payments to utilities, large companies and governments, there is no such
thing as direct account transfers in the States, and thus all the talk about
"online payments" is mainly hogwash - what really happens is that the bank
sends a check to the payee through the regular mail.

This is the kind of thing Bjorn refers to, and knowing the system, I can only
agree.

Now, there are other banks around, and some have slightly better systems - one
is to send a pass code to your registered email address, which you have to
enter to access your account online. But once you're in, you're in and there is
no further authentication required for payments.

We have much stronger security in online banking here in Europe (an ID and
password only allows you to view the account, but you additionally require a
one-time transaction number to transfer any funds), and even so there are cases
of online theft, although I suspect they are fewer than check fraud in the
States.

RC> But I do write a check for car insurance, twice a year.

I don't. I get a bill for the yearly premium in November and pay it by direct
transfer the dne of December. Most other bills are paid by direct debit of the
account, an important point being that you can legally reverse the debit
without providing a reason for a period of several months - without this
protection, such a system would naturally be an invitation to fraud. Of course,
this means that you should keep track of your account and not merely look at
the numbers every 6 months or so... but I think people would normally do that
anyway.

RC> The advantage of check writing, is I have _absolute_ control of when
RC> the funds from my account go from me to whoever..

That would be nice, but see above. All someone needs to write checks in your
name are your bank ID and password unless there is some added security at
login. And no further authorization is required to send checks anyhwhre once
someone is logged into your account.

RC> So instead of insulting a entire society, how about letting everyone
RC> do things that they feel most comfortable doing, instead of insisting
RC> that all must do things your way..

Bjorn was typically grating in his comments, but in essence he's right. As for
your comment, naturally you'll continue doing things your way - but that
doesn't prevent others with experience with other, more secure systems, from
pointing out the pros and cons. Take it for what it's worth (to you).

Cheers, Bob

--- GoldED+/W32 1.1.5-0613
 * Origin: Jabberwocky System - 02363-56073 ISDN/V34 (2:2448/44)