Schneier on Security

Clive Robinson • March 1, 2023 5:30 PM

@ TomH, lurker, ALL,

Re : Extetnalising risk.

“What isn’t new is that banks will refuse to accept a voice-validated fraud incident. “

It’s a bit more than “dumb bank directors” it’s a very deliberate policy that they call “customer convenience” but in reality is “5h1t1ng on the customer any which way they can”.

For the sake of making more profit, banks are selling off their realestate holdings you call bank branches, sacking the staff and replacing them with ludicrously insecure digital systems.

They know without any doubt that fraud will rise and rise a lot, probably as a significant petcentage of their actuall turn over not their profit, where it will be a real hit.

When you look at bank behaviour since bank cards started over half a century ago, bank behaviour has been,

1, Get more customers.
2, Put all risks on the customer or other party such as merchants.

The later is based on two things,

3, The customer is least able to defend themselves.
4, Judges are stupid enough to believe the banks lies.

In fact in most places the “Bank Ledger Legislation” makes any old nonsense a bank prints out legal evidence, no matter how false you can show it to be.

Worse their legal representatives knowingly lie in court. If challenged they say it’s what they have been informed of by “their client”… They then try every trick possible from stopping, naming any individual, or having any individual made available to testify in person under oath.

They will also find every excuse to make the case more expensive for the harmed party under a “crush them in debt” policy. Where even if you were to win you will have more court costs than you will make from winning your money back.

These are all standard tactics, judges know the banks are doing it yet they alow them to do so.

Even where there is legislation supposadly protecting a customer, the banks will “time it out” that is they will say you have to notify them of fraud within 48hours or some such, knowing full well you have close to zero chance of being able to do so. You can call it “victim blaiming” but actually it’s a very very deliberate policy of “Victim Victimization” under a “Might is always right” policy…

I could go on at length but the legislation and regulation is different in nearly every jurisdiction and covers thousands of pages. So all the specifics in any one place are near impossible for any individual to know, and that includes,

1, Legislators.
2, Judges.
3, Lawyers.
4, Ordinary individuals.

Banks however have very large teams of specialists, and it won’t be long before they start using AI etc to find more ways to “Victimize by policy” which they will call “Customer Convenience” and tell legislators “That’s what the customer wants” when actually that is at best based on surveys that have been deliberately fixed to give a desired result.

But hey that’s “Freemarket Capitalism” at work thanks to Ronnie Reagun and Maggie Thatcher back in the 1980’s when they got rid of so much very necessary legislation going back centuries if not millennium, remember the turning over of the money lenders tables in the bible tells you just how long the bankers have been at it one way or another. Also one of the reasons what is sometimes called “Arab Banking” or “Islamic Financr” exists[1]. Which on paper looks good but in practice…

[1] Technically it is “Sharia-compliant finance” and complies with Sharia (Islamic law). It is banking or financing activity that is regulated by what is religious law. However Islamic banking and Islamic finance is these days jusy as full of abused loop holes as Western Banking… Only the claim is deity is right therfore you must be wrong, which is just a variation on the “King Godhead Game” of “Might is right”.

Clive Robinson • March 2, 2023 6:47 AM

@ Matt Palmer,

Re : Biometrics are a failure and always have been.

“biometrics should not be used for authentication.”

True for many reasons, not just,

“You cannot change you if it becomes possible to spoof the biometric.”

Again true, but you’ve missed the point they have always been possible to spoof to some degree, it’s why “impersonators” have been able to earn a living for centuries if not multiple millennia.

You incorrectly imply with,

“And they keep getting spoofed.”

That there is some safe period in which they can be used before techniques via technology advance.

Hence you say,

“They are fine for identification, just not authentication.”

When the reality is they are fine for neither identification or authentication, and never realy have been.

What has happened in actuall fact is bio-metrics have always failed the only question has been,

“To what degree?”

In practice the answer to that has always been,

“As much is needed to fool the techniques and technology prevelant at any given time”.

Thus “sales and marketing” to make money went in for “specmanship” and created the equivalent of an “arms race”. Where they make faux claims about how the increased resolution of their test measurments will beat the known attacks.

The attackers take one of two basic approaches in response,

1, They improve the resolution of the fakes.
2, They exploit weaknesses in the tests.

I’ve shown in the past that it was possible to beat a DNA test because of a weakness in the test proceadure.

I was told by many that I was wrong, did not know what I was talking about, etc, etc. Then an Australian researcher publishes a paper detailing the exact fault I had identified and all of a sudden people started going on with,

“Shock horror, why was this not seen?”

Well it was. Likewise I had worked out when not even a tenager how to fake finger prints with the red wax from Edam Cheese to make a mould, WD40 as a mould release and Copydex rubber solution glue as the fake skin. Again even though I had demonstrated this, I was told I did not know what I was talking about, and ended up getting sacked for demonstrating it (sales and marketing did not want their faux claims reviealed). As it turns out I should have just pointed them to a Sherlock Holmes story (The Balham builder). Where the use of hot sealing wax was used as an example of making the mould.

Do you remember the nonsense over BadBIOS, where I and @RobertT both described exactly how you would do it with acoustic networking. A technology that had been developed for PIM’s and such like in the 1980’s as an advance on storing data on audio cassets. Again we got told we did not know what we were talking about… Then a couple of students published a paper about an experiment in a corridor, and all those neigh sayers are suddenly experts…

The only bio-metric I’ve not been able to bypass is the mapping of structures in the human eye. Not because I don’t think it can be done, nor because I don’t have several good ideas of how to do it. No my reason is I do not want to take the risk of damaging mine or other peoples eyes in the process.

Such morals and ethics are not an issue for nearly 20% of the population from which criminal activity especially violence arises from.

Thus I deem it highly likely some people already know exactly how to bypass retina and iris recognition systems…

So bio-metrics are or will quickly be usless for identification and that includes DNA which is supposadly “the gold standard” but in reality is nothing of the sort for various reasons.

The thing is those reasons in a more general form apply to nearly all “super dupper new” methods of forensics, as we see they come along people get convicted on them, then the supposed science is found to be nothing of the sort and in many places –but not the USA in general– peoples convictions get overturned … And what happens? Those in authority look the other way, especially when the next quack-system comes along…

But hey “As long as justice is seen to be done” who cares if it’s not justice, just grandiose pantomime… It’s exactly the same with bio-metrics for identification (which forms the first step in authentication). As long as their is an expensive box to absolve responsability who cares that it’s all very nearly a nonsense?

@ ALL,

In multifactor authentication, we realy should drop the,

“Something you are”

It’s a totally busted idea that is just pushed by money making schemes based on faux techniques and a lot of idiot arguments, that at best are based on measurment disparity that never survive the test of time…