Hacker News Reader

Comment by CoolGuySteve | Hacker News Reader

This is also a national security risk. A nation state interested in war will have an easier time shutting down a small handful of things simultaneously to quickly cripple our economy.

For example:

- Shutting down only Visa and Mastercard would disable the vast majority of credit cards.

- Disabling debit cards or withdrawing funds from JP, BofA, Wells Fargo, and Citi would disable the majority of banking clients in the US.

- About 40% of US air travel could be stopped by hacking American and Southwest.

We've already seen similar large scale attacks on large companies:

- In the 90s and early 2000s, Microsoft's weak security allowed worms to cripple Microsoft Office and Windows.

- 100 million JP Morgan accounts were compromised by 3 people in 2015.

View on HN

And we don't even think about these dependencies. In the US, Mastercard and Visa payments are generally both processed by all of the same processors; you know if you use Amex or Discover you'll have a harder time.

I was in Cusco, Peru a couple of months ago, and there are signs ALL OVER saying Visa accepted here, and also quite a few about Mastercard.

Imagine my surprise when we tried to make a purchase at a store (with Visa and Mastercard logos prominently displayed, no less!) where the merchant insisted on Mastercard. Not Visa.

I found my backup credit card. And another. And I went through my debit cards. As did my wife.

We had 9 cards between the two of us, and they were ALL Visas. Just not something you'd even think of in the US, frankly. And I've had plenty of Mastercards over the years, but the distinctions are rarely important to us.

Paying extra for a service like cc is just accepted in the US but not so common elsewhere. So even slight differences in fees will have merchants refusing to use the more expensive one even at the cost of bothering customers.

Wait... You have 9 credit cards? Why? How? Isn't that a maintenance burden keeping track of all of them? I've never ever had more than 2 at the same time and it was because I was transitioning from one bank to another...

Sign up bonuses and benefits can net you a few thousand dollars. With a password manager and push alerts and autopay, it’s very little work to manage, plus you’re not liable anyway if you dispute in a timely manner.

Sign up bonuses are good but cards cost about $70 a year typically. Wouldn’t it be better to hold two and change it up every year?

Generally, annual fee cards have an equivalent free tier card. You should be able to just call the credit company and ask to downgrade to the free tier (usually after a year or two). They will usually honor this request. This conversion also doesn't affect your credit since it preserves your limit, balance, etc. YMMV but this has been my experience.

You can downgrade to the free card or just cancel it.

I have maybe 3 credit cards I use regularly. Well, really only 2, but I carry 3. One is my everyday card, the other one is Amazon-specific so I rarely swipe it. My wife has a couple as well (different accounts, we haven't bothered to combine yet). I've also got debit cards from my bank account, a debit card for our joint bank account, and a debit card for one of my brokerage accounts.

And of course my wife has debit cards for her account and another card for our joint account. That's just off the top of my head. I guess that's 9-ish?

They're not all credit cards, but they all have logos.. and, as it turns out, all Visa, apparently. The obvious question is "why so many", and the answer would be "situations like this", except in this case, it didn't help.

I guess I could take them out of my wallet and just leave them at home, but... why? A year back I was going to Germany; my primary credit card was deactivated on my flight there due to fraudulent use at a Home Depot, while I was on the plane. A second card stopped working, so I was down to my last card, which I really needed to work for a many-thousand-dollar rental car hold.

Called all the banks; the first card was shipped to my house in the US to arrive within 10 days (thanks!), second card was NOT inactive, apparently the merchant terminal was just screwing something up. It worked just fine. But I was glad to have the third!

As a sidenote, it's cool to be on a call with a credit card company, and before you're even off the phone, Apple Wallet pings you with a notification that your new card is active. But not everyone takes NFC. And in general, Germany's weird about accepting foreign cards, so it's nice to have options.

Doesn't even need to be a war that causes problems here. This:

> - Shutting down only Visa and Mastercard would disable the vast majority of credit cards.

Happened in the UK and Europe in June this year, where Visa's network crashed and took out credit card payment processing for millions of people for a good day or so:

https://www.theguardian.com/world/live/2018/jun/01/visa-outa...

As you can guess, that caused absolute chaos, with the crash becoming a major news event and many customers and businesses being unable to spend/receive money at all until it was fixed.

So yeah, forget a government. Even a large business like that crashing or experiencing major technical glitches for a few days or so would bring down a large portion of society.

The UK also had the NHS crypto ransom attack. It's hard to say if the US is similarly vulnerable, on one hand the US hospital system is more heterogenuos, on the other, the hospitals in major US cities have very janky IT systems.

Actually, the majority of hospitals and trusts had little to no infections in that attack, obviously some (too many) did which is why it was bad news. But the NHS, in IT terms, currently operates as a disparate set of trusts with mostly their own IT systems. The reason that there was the level of infection there was, was due to lack of national IT standards/systems being enforced and trusts using outdated unpatched systems. The few national systems in use are, while not perfect, much better funded, updated and secured.

Nassim Taleb's wonderful book "Antifragile" was about exactly this topic.

True, but I think his point was more precisely that when you go long periods of time _without_ having those systems fail (hopefully in relatively small ways), you get trouble. If Visa/Mastercard had outages on a regular basis, no doubt our retail system would be quite robust to them...

not sure if this counts as a paradox but that systems that are more reliable cause more chaos when they go down . The person easiest to survive the apocalypse is someone who already lives it.

Yes! That is a brilliant point. You have to test for failures, it's not obvious - if you have failing systems occasionally you are already testing for failures.

I believe that is why Netflix has the "Chaos Monkey" -- to occasionally break things and see what happens.

https://medium.com/netflix-techblog/the-netflix-simian-army-...

I'm not disagreeing with you, but the military side of me can't help but see how all of those things would be beneficial for our government as well. Stopping US air travel in an emergency. Stopping electronic transactions in a financial emergency. Etc etc etc.

I think a lot of government types would see many potential benefits in the way things are set up now. Even most regular people would have to, grudgingly, admit that, if it were necessary, this system could deliver the government unprecedented amounts of control. I mean, for good or for bad.

But yeah, there's likely a double edged sword there. No question.

There are very few cases where stopping a firm from functioning would be beneficial, as compared to it being destructive. Most of the time, we want flights, banking, credit cards, IT systems to function rather than go black; hackers have many more chances and time to disrupt all of these than a government will ever have occasions to consider halting a particular company's operations in the name of national security.

Remember 9/11? Shutting down airspace in an emergency is easish: tell everyone to land.

The US government already has a legitimate way to stop air travel. And the government already has significant persuasive power; if the Secretary of the Treasury asked all the banks to stop electronic transactions for a legitimate reason, I'm sure they'd comply.

So what you're talking about is neither a legal government power or something where people would trust the government and follow along. You're looking for a way for the people in power to seize further power illegally when they think it appropriate. There's no "for good" there; that's just authoritarians undermining the rule of law.

> if the Secretary of the Treasury asked all the banks to stop electronic transactions for a legitimate reason, I'm sure they'd comply

“Franklin Delano Roosevelt proclaimed a Bank Holiday...that shut down the banking system” in 1933 [1]. This is an old power pre-dating our current hyper-centralised banking system.

[1] https://www.newyorkfed.org/research/epr/09v15n1/0907silb.htm...

> Stopping electronic transactions in a financial emergency.

That means causing some people to starve. Literally.

I can't imagine how it would improve some situation. At best, if transactions are stopped for a short enough time, you will not make it much worse.

Our country adopted cards recently, I have a card and using it almost everywhere, but I'm always carrying some cash, 200-500 bucks just in the case that card won't work for some reason. It happens. If Visa would be down, I wouldn't be disrupted and nobody would be disrupted around here. Why don't you carry some cash around, it's still a legitimate payment method and it doesn't take much space in your wallet.

I like how easily you separate groups of men in "government" from groups of men in "corporations"

Slightly off topic, I was always thinking about are there any single point of failure in monetary system. Since bank reserve are accounts in central bank, which stores in some ancient servers. If terrorist or hacker found out a way to destroy those servers. Will the money in economy vaporize? Are there any paper record we could fall back?

Mr. Robot, is it you?

cough Bitcoin! cough

Bitcoin won’t save you if the attacking nation state (say, China) can simultaneously nationalize and take over a majority of miners. Power is power no matter how many hoops it needs to jump through.

This is pretty much the plot of Goldeneye. A lot of effort will have gone into disaster recovery (tapes in nuclear bunkers etc) but also remember the counterparties have records too.

It would not surprise me if the Bank Of England still kept written ledgers, with a quill, in Latin.

Large systems whose normal operation relies on the availability of one or a small number of individual components are by definition less reliable, less robust to attacks, and less resilient to disasters than large distributed systems which don't have such reliance and therefore operate smoothly in the face of routine failure of a significant portion of their individual components.

This is true for geographic networks, economic and financial systems, software-as-a-service applications, and even potato variety in farming systems.[a]

[a] https://en.wikipedia.org/wiki/Great_Famine_(Ireland)#Potato_...

What king of large system does not have smaller components that are relied upon?

> This is also a national security risk. A nation state interested in war will have an easier time shutting down a small handful of things simultaneously to quickly cripple our economy.

If you take a broader view, you will note that the United States telling Visa and Mastercard to shut down all service in <country> will cripple that country's financial system.

The dangers of someone bringing your economy to a halt by 'hacking our systems' is overblown. These kinds of problems can be fixed, or routed around in a few days.

You don't have this option when the systems you rely on are completely controlled by another nation state.

"These kinds of problems can be fixed, or routed around in a few days." a large scale IR could easily be months when state level APT is involved

Frankly, if I were going to consider upsetting the balance of power, I would __not__ go directly for the jugular. I'd beat around the bush. I'd start random socio-political fires in more venerable countries / economies. Let that simmer. Then step up for the big fight, knowing the giant has spread itself thin trying to take care of the smaller / random fires.

This reminds me of a defcon talk by Chris Rock about how to overthrow a government.

https://www.youtube.com/watch?v=m1lhGqNCZlA

Kinda like what's been happening for a few years now.

Agreed. UBL said he wanted to destroy the USA. He never said how. The fact that more and more money is spent as a reaction to fear; the divisiveness; the hyperbole; etc.

Seems to me we're doing ourselves in. It just took a nudge to get that self-destruction rolling.

There is a symbiotic relation between “terrorists” and the politicians that use this fear to get elected.

I have this hypothesis - which admittably is very weak on evidence and very weak on political correctness - that it is kind of a self-enforcing process.

First, people with less cognitive capabilities seem to be inclined into conservatism and prejudice.[1]

Now, how do you make people's cognitive capabilities less?

You make people poor.[2]

Second, you can make people conservative by making them scared [3]

So you being a conservative politician and wanting to get more votes, you make people poor and scared and you get more votes. And the problem is, it is much easier to make people poor and scared than wealthy and feeling safe.

[1] https://www.livescience.com/18132-intelligence-social-conser...

[2] https://www.reuters.com/article/us-poverty-brain/study-finds...

[3] https://mic.com/articles/26911/people-who-are-fearful-tend-t...

Reminds me of Naomi Klein's 'Shock Doctrine' book that went into how this worked during the glory days of The War Against Terror.

There are additional levers to be used, mass surveillance makes people not want to talk lest they reveal themselves to be not 100% aligned with the edicts of the regime. Plus if people aren't talking then they aren't discussing ideas, discussion is needed as without it people can end up believing very strange ideas told to them by the mass media or the conspiracy theorists, with both sets of those ideas being oppressive.

Fear is the big one though, even the smartest people succumb to it remarkably easily. It is quite funny to watch in a 'lemmings' type of way. But to watch it in a 'lemmings' type of way then you have to be in on it, a sick individual spreading the fear.

Not only does fear create a subservient mindset, it artificially elevates the need to the gov / politicians. That is, we can't no protect ourselves from these unseen forces, so some entity - spending as much as our money as possible - has to do that for us.

Per "Here Comes Everybody" (and similar books) the internet can allow the normally separated to organize and GTD. The __exact__ role the gov has played in the past. But people have to be willing to do that. Unfortunately, escalating fear and decisiveness maintain the power status quo.

Evidence? Afaik the #1 corporate benefactor of the War in Iraq (as well as other recent conflicts) is Halliburton. Is it necessary to point out the relationship between them and the then VP?

But at this point, it's not only politicians. These multi-national conglomerates are nation-state-esque. To think that they don't have their own best interests in mind is naive. They're players in the propaganda game as well. If it's good for business, It's on their radar.

For a person he surely did cause a lot of problems, killings and expenditure. "Martyrs" want to take as many as they can before they go and he surely a lot of damage

The CIA sabotage handbook details pretty much this.[1]

[q] https://www.cia.gov/news-information/featured-story-archive/...

And this is already happening. Look at israel and stuxnet and look at the chip battles with nsa and china and intel, cisco, huwai.

You can easily shut down the web just by dns. Icann owns pretty much everything and they're not even U.S based anymore.

The DNS is replicated everywhere. A concentrated attack can at most freeze some subdomains.

ICANN controls the non technical administrative/political portion of DNS, but the actual DNS root servers are extremely widely distributed.

https://labs.ripe.net/Members/emileaben/dns-root-server-tran...

https://labs.ripe.net/Members/emileaben/screen-shot-2017-01-...

pfft and then they come back up, like rebooting your machine. You can cause a temporary crash these days not a permanent shutdown. People just don't get how hyperconnected things are. Everyone takes a hit if there are shutdowns. The 2008 financial crisis was the first demonstrator. Things are just too big to fail.

Wasnt there a shipping logistics company whose network got hit by ransomware that shut down like 40% of shipping ports worldwide for like 72 hours? that’s serious economic damage, even if they eventually got backups etc running

Yup, Maersk.

https://www.wired.com/story/notpetya-cyberattack-ukraine-rus...

Yeah, how you cripple an economy is by not letting people take low budget holidays in Mexico and stopping them from buying imported crap off of amazon for a week. National security risk my ass - this is fearmongering.

> - Shutting down only Visa and Mastercard would disable the vast majority of credit cards.

Can you say "instant riot"

I had a similar realisation a few days ago booking a flight between Berlin and London Stansted. Judging by the time of the flights, I believe Ryanair operates exactly one aircraft on that route.

Reply on news.ycombinator.com