Hacker News Reader

Comment by css | Hacker News Reader

> the data being asked about in these KBA quizzes is culled from public records

Yesterday, when opening a savings account with a major US financial institution, one of the KBA questions asked for my Zodiac sign. The other two were about a mortgage and the year I was born (±1 year). I do not understand why any competent institution would find these secure and it appalls me that is all the information needed to open an account in my name.

Edit: Here is the screenshot https://i.imgur.com/Mr8gOOA.jpg

View on HN

That looks like Ally Bank. --BUT, it isn't, per the reply below. It's Discover, though Ally asked me the same zodiac question in what looked like the same font.--

They won't open a joint savings account for my wife and I because my wife doesn't have a phone bill in her own name "for verification." (We've been on the same Southwestern Bell/Cingular/AT&T, recently T-Mobile, family plan for the past, oh, fifteen years, and it's under solely my name because of employer discounts.)

When I mentioned this to the rep, she told both of us--we were all on speakerphone--that my wife could send in a copy of her driver license. Except Washington doesn't require us to get new licenses when moving and the address on both of our licenses is both the same...and four years out of date.

I get the need for ID verification but funny how we never run into this problem when my wife wants to borrow money in her own name. No one has ever cared about her license or a phone bill when she's taken out credit cards.

Oh, and one more thing: This is the same bank that called me the other day to inquire about our application and--even though they called me--their representative got mad when I wouldn't give him the last four digits of both of our Social Security numbers and our dates of birth and Mother's Maiden Name / Security Answers from the application.

When I pointed out that a) he called me and b) this is, quite literally, exactly how scam calls trying to steal money go, he got upset at how I wouldn't "believe him." I told him that's exactly what a scammer would say and hung up.

My "private" information has been leaked to other governments and various malicious actors at least six times, just in 2018, so I'm a little more wary than I used to be and that pissed me off.

I had a similar issue with Chase calling me, as a follow up to fraudulent charges on my card. They were asking for basic identifying information, but I didn’t feel comfortable so I hung up.

I then called Chase and asked if it really was them that called, and they confirmed it was actually them. But then they also apoligized and resumed the previous call from where I hung up.

It was just nice to not be judged for being cautious.

That's pretty atypical for Chase - whenever I get a call from them, it's always something like "Please call the number on the back of your credit card to solve this issue."

I've had Chase call me, text messages requesting that I call Chase, e-mail messages requesting that I call Chase, and both e-mail and text messages asking me to reply with a specific letter or number to verify a purchase.

I have multiple Chase accounts in multiple tiers (business, etc...), so my guess is what kind of contact you get depends on the nature of the account.

It's Discover, not Ally.

Oh, they use the exact same font. Fair enough; I'll add a disclaimer at the top but Ally did the same thing to me (same zodiac question).

The bank itself is probably not doing the KBA; they're buying and integrating a KBA dialogue solution from one of the vendors. So might be the same software / font / question bank at work.

Correct about the software most likely, but Discover uses FF-Meta [0] and Ally uses Lato [1]. They are admittedly quite similar.

[0] https://fonts.adobe.com/fonts/ff-meta

[1] https://fonts.google.com/specimen/Lato

I think what rlucas is saying is that the reason the font might be the same is that the bank implemented the solution straight up; without any of the styling that would usually be applied. I've definitely seen this and worse before, so it's not exactly out of the realm of possibility.

TBH it’s not the banks fault. Our governments stance on taxes, terrorism and drugs has caused this. Due to the need to verify citizenship, verify that you aren’t a terrorist and verify that you are a drug lord laundering money the banks are forced to jump through all of these hoops to give you an account.

> the need to verify citizenship, verify that you aren’t a terrorist and verify that you are a drug lord laundering money

One day these requirements are going to get out of hand. :D

Heh. I’m not saying they are or aren’t out of control. My point is that when the government creates all of the requirements, and the onus is on the banks to verify it all. At risk of penalties from the government. Then you get these kind of stories. People see it as overkill. The banks see it as CYA.

I basically agree with you on the issue; I was just making a cheap joke about the supposed requirement for the bank to verify that you are [as opposed to aren't] a drug lord.

I mean, I get that but why is it not a concern when I want to borrow money? Or, even more relevant, when my wife wants to borrow money? She has multiple credit cards with tens of thousands of dollars in borrowing power in her own name and has had and paid off two loans, all while not having a telephone bill in her own name or even being on the deeds to the properties we've lived in together.

I see it less as CYA and more as "we can make money off of you so the requirements are relaxed because we're making money"--that is, lending money that she'll presumably pay interest to borrow--versus "oh shit you want to put $1,000 in an account and our bank pay you better do the fifteenth degree."

Washington state doesn’t require this?

It says it does here: https://www.dol.wa.gov/driverslicense/moving.html

Zodiac sign? Seriously? I don't know what mine is because that is not a belief system/religion I subscribe to so I had to Google it. Turns out my birthdate must be on the border because different sources have it as a different sign. They might as well ask what color my aura is.

Lie about which is your sign. If the bad guy knows your birthday, they will guess the wrong sign.

And now you have to keep all of your lies straight.

Absolutely; use a password manager. This is the least bad way to go for these types of "security questions": give a plausible, but wrong, answer.

Correct is too easy to guess.

Obviously wrong will be recognised by the customer service representative, who is a kind person, and will help you out by just disabling the question (anecdotes galore for this, to the point we can call it data).

Lie, in a believable way. Put the answer in a password manager. Open your password manager up before calling any CS rep. Be a star in the security theatre. :)

Password managers solve the storage part of making security questions secure, but there's still the question of generating sufficiently random answers in the correct format.

I look forward to password managers including generators for your birth date, family tree, childhood friends, favorite color and maybe also social security number, name and address if those aren't actually required for anything. Then you can have a value for your mother's maiden name that isn't incredibly common, but nonetheless looks like an actual person's name.

I save my security questions in a password manager and just generate it. Though I've thought about instead giving answers that would serve as a message to customer service rep to actually validate it in cases of someone trying to impersonate me.

Q: Where were you on New Year's Eve in 1999? A: demand-exact-answer-over-phone

Someday someone will write a password manager equivalent for keeping track of one's lies.

They arent asking you questions they dont know. They will ask you questions about the color of your car or streets you lived on, and they know the answers.

This is one of those questionnaires that is generated based on your credit report and other items related to you identity. So it's extrapolated from your birthdate and probably makes it ever-so-mildly more difficult for robots to get it right than it would if it just asked for your birthdate.

They already know the answer from your credit report and other databases... If you answer incorrectly then you get denied opening a bank account online and you'd have to jump through extra hoops, either going to a branch or mailing documents.

Well what is it?

Sounds... not right. What is the date?

I just now Googled Scorpio (found a sign that isn't "mine", as an example) and saw dates that varied by up to 19 days on the tail end of the Scorpio range.

Depending on the sources I scanned on the first two pages of results, the cutoff is somewhere between November 2 and November 21.

Better than the SS administration who ask "Where were you when 9/11 happened" or "Where were you when JFK was assassinated"...Took a screenshot of these but cant find it now. My method is picking the common questions like "what street did you grow up on" and assigning it a random/not true/or another question such as "I don't know what my favorite street is"

I often use "None Of Your Business Street." Works every time.

These are so called "security questions" for that account; the great grandparent is talking about "knowledge-based authentication," which is a different thing entirely.

The "security questions" you choose your answers, in "knowledge-based authentication" the questions and answers are generated based on the information on your credit reports and other databases, such as insurance databases. You don't make up answers, they already know the answers.

> Static KBA, also referred to as "shared secrets" or "shared secret questions", is commonly used by banks, financial services companies and e-mail providers to prove the identity of the customer before allowing account access or, as a fall-back, if the user forgets their password.

Wikipedia refers to "security questions" as "Static KBA".

Speaking of the SS Administration, I ran into an annoyance with them when trying to get a replacement SS card. They would not accept any ID for which the name did not exactly match the name in the records.

So, for example, if you always went by "Ron Weasley", having your driver's license , your utility bills, your apartment lease, your animagus registration, and so on all under that name, but your name in their records was "Ronald Weasley", you would be out of luck.

No one thinks this is actually secure, it's security theater.

The thing is, the cost of identity theft of consumers to credit reporting companies is less than the cost to actually adopt secure methods to judge one's credit.

You’re exactly right. It’s the same reason we’re required to sign checks then the bank promptly ignores the signatures. It’s cheaper to handle the fraud than check the signatures, but it makes us feel good to do it anyways.

I guess the signatures are there in case someone complains? They can just pull the check and see if the signature is legit. But checking every signature is simply too much work.

It's my understanding (from hearsay) that they use software to look at signatures, and use that data as a fraud signal, among other data.

> the bank promptly ignores the signatures

You're technically supposed to sign and endorse the back of every check you electronically deposit; I have never done this since my bank offered mobile deposit and have never had a check rejected. It honestly just makes me sad.

They’re upgrading this to require you to write “mobile deposit for XYZ bank” as well, so that you can’t double-deposit without getting caught early on.

My bank upgraded their branch ATMs to accept multiple checks at the same time for deposits. What surprised me was the displayed instructions said one did not need to sign the backs.

I mean, whats the point of signing the back of a check? Most businesses don't sign the backs of their checks. They use a stamp that has their business name printed in some ordinary font. At that point you might as well let the mobile app superimpose its own signature or have the ATM apply its own stamp.

I wish - a few years ago I was trying to pay for rent with a cheque and it bounced. I ended up sending another cheque, having that one get rejected, go into the bank and give them a new signature sample, and then have the next cheque be rejected as well due to the signature.

Apparently my bank checks cheques.

Canada? Or Common Wealth? Judging from how you spell “cheque”. Signatures still mean something in some countires, just not the US.

Canada. I've never heard of anyone but myself experiencing this issue though.

Yes, Indian Banks too check Signatures on anything submitted to them.

I once had to deposit cash in my own account but in different city in India. It was free if I deposited it, but fees for anybody third party. Cashier told me my signature doesn’t match with whats on file and thus either I need to re-sign or need to pay fees.

Here in US I have seen policies in Stores saying we accept check, but we will onetime use the account & routing number on check to pull the amount. I am so confused if by merely giving someone a cheque they are able to “pull” money from just two numbers, and can do it for any amount & any number of times.

> I am so confused if by merely giving someone a cheque they are able to “pull” money from just two numbers, and can do it for any amount & any number of times.

That is exactly how checks work. It's optimized for happy-path, with a big mess of a process to handle fraud. The cash equivalent would be to carry a bucket with all your money and when you pay, you present your bucket so that the shop can pull out the amount you and them agreed on.

"Optimized for happy-path" is true, but it also reveals something pretty neat about the American financial / business climate.

"Default trust" actually works in our economy. And because of that, friction can be low and things Just Work.

Default trust / happy-path optimization in turn works because of the backstop of a strong legal system, fairly clear precedent, and reasonably well defined property rights. Think: UCC across states; standardized Delaware Chancery precedent; etc.

One reason I'm not a cryptocurrency or smart contracts believer is that the robust exception-handling backstop we have in the US is a mostly-invisible but super-valuable resource.

....and only all exists because people believe there's no alternative.

I just realized something -- the cryptocurrency-maximalist and antivaxx movement are born of a similar phenomenon.

Humans are great at rallying and pushing and making change when they see identify something as wrong in their direct lives. We work as hard as possible, and develop solutions (vaccines, a strong legal backstop). Then, all is well, and the problems we solved are no longer part of our lives because the system works.

Years later a vocal minority becomes very suspicious (they're inflating away my wealth!, autism!) and tries to overhaul the system. Then they learn why we do things the way we do (scams/manipulation/etc, measles) the hard way.

> "Default trust" actually works in our economy. And because of that, friction can be low and things Just Work.

Does it though? I think there's a reason we've stopped accepting cheques - cheques were the best "easy" way to transfer relatively large sums of money at once, now that we're past that and have more secure credit and debit cards cheques are becoming banned. I don't think it was optimized for "happy path" per say, but just for convenience and was the only technology we could manage at the time.

>> "Default trust" actually works in our economy. And because of that, friction can be low and things Just Work.

> Does it though? I think there's a reason we've stopped accepting cheques

That's a very specific issue but this is a pretty general fact. With respect to checks, people still write and accept checks, we just have more convenient payment methods. Also checks are still the easy way to transfer large sums of money at many banks. More generally though, just look at how much can be done with a signature under penalty of perjury, and how relatively rarely these are forged. The trust-based system really works decently well in the US.

You can expand that to other systems. For example you can walk onto a city bus in many cities without proof of payment. It is assumed the vast majority of people will have paid by tapping their transit card somewhere, or purchasing and activating some mobile-based e-ticket. Same with many commuter trains. The result is faster more streamlined service for everybody.

I find the cryptocurrency "space" fascinating for reasons like this. Because cryptocurrency gets rid of so many of societies long-evolved backstops, it is a perfect demonstration of why our society is structured the way it is and shows exactly what happens when we remove many of its features (eg: removing "trust" is very expensive).

I was initially taken aback by Moscow's gates for the subway but in restrospect they make sense and fit that model. They are (were?) gates that default to open, and stay open if you insert the token/pass. Otherwise they slam shut right in front of you. During rush hour, it's brilliantly simple as the gates just stay open as people pass through. (As a tourist, it was more "interesting" to get the occasional misfire and have it slam right in front of my legs, but that's a different story.)

Well yes, but in India it does not work like this. If I give you a cheque for X amount, you cannot use those numbers mentioned on cheque leaf for any more txns. You can get only that X amount with only that cheque leaf.

The "one-time use the account and routing number on the check to pull money" is utilizing the data from the check to perform an ACH pull. There's a specific process called an EFT [1] where merchants can perform an ACH transaction in lieu of a received paper check.

[1] https://www.occ.gov/topics/consumer-protection/depository-se...

I once forgot to sign a check completely, like totally blank signature line. It was cashed just fine.

I wonder if you could argue that that wasn't a valid cheque to the bank then. But then you'd be saying you were claiming fraud against yourself, so somehow you'd still end up the one in trouble.

Probably not. The Clinton-era law that relaxed check verification rules so that we could deposit checks remotely online moved a lot of the burden onto the consumer instead of the bank. That was one of the reasons it was opposed so loudly by consumer groups.

Apparently my bank checks cheques

One of mine, too; though only sporadically, it seems.

Now those people at the Board of Elections are hard-core about signatures. I've been hassled twice when trying to vote because my signature on their pad didn't match what is in their records.

I have a "good" signature, and one that looks like a doctor writing a prescription. I have no idea which one they're looking for.

I never understood the deal with signatures. Most signatures can be faked if analyzed by an amateur (every business). Sure there are experts who will spot fakes but how many of them are employed where signatures are verified?

I can tell you that I’ve faked a signature in harmless situations a number of times and nobody was the wiser.

I know some banks actually do check them. Last year, my wife paid a contractor with a check from Ally, and the check bounced because the signatures were not close enough.

For one payroll, I completely forgot to sign a set of checks for 40 employees. Not one employee came back and said their check did not clear. Scary world we live in.

When I opened my mortgage they required us to share via email everything in plain text. We did not have a choice of lender. I told my wife that these people were going to be hacked. Within 3 months we got a letter saying all of our information had been exposed. Oh whale, nothing that wasn't already out there from the numerous other breaches that I had zero control over.

United Airlines asked me to fill in a bunch of crazy password questions a few weeks ago.

Things like "What's your favorite flavor of ice cream?" Well, I dunno. It depends on my mood.

Or "What if your favorite vacation destination?" Another bad question because my favorite today may not be my favorite when I get back from the next place.

Unfortunately they were all mandatory — there wasn't an option to pick only the sane ones; all ten had to be answered.

Most of them felt more like marketing trying to build a profile on me rather than IT trying to keep my data secure.

These are KBA questions, which are generated by a third party based on information on your credit report. For the types of questions you describe, I just use my password manager to generate random strings for each of those answers and make a note of what question each string matches with. To make sure the strings are not rejected for special characters I use passwords a la https://xkcd.com/936/

I wonder if anyone has gone through the password lists to see if "correct horse battery staple" shows up, and if so, how many times.

According to haveibeenpwned.com, they've seen "correcthorsebatterystaple" 114 times

I have a hard time believing that a KBA database would have GP's favorite flavor of ice cream.

> For the types of questions you describe, I just use my password manager to generate random strings for each of those answers and make a note of what question each string matches with.

Can't do that with United.

The answers are drop-downs.

https://krebsonsecurity.com/2016/08/united-airlines-sets-min...

That is incredible. There are only twelve signs. I mean why not just ask your birth month? And even then, incredibly easy to guess or to find out. I honestly want to know who came up with that security gateway and question them on how they thought that was secure.

Yea. I recently had two run ins with this exact same KBA system. One for a bank and one for a health insurance type thing. Both asked a question of which hospital was closest to me. How is it "KnowledgE" when I had to google map 4 different hospitals to figure out where they even were? One of two variations also listed two 'different' hospitals that were less than 2 blocks apart, leaving the 'closest' question up to a flip of the coin.

I used to work at a fintech and seen Kba providers ask questions that provide zero security like “what county was your 1 Main Street Santa Monica,ca address located in”

I wonder if these questions were less about identity validation and more about stopping bots from opening accounts? Either way, it's not the ideal solution, but one is a little better than the other. The chance of a bot guessing all three right is pretty slim, but at least if a real person did research and made educated guesses then it would slow them down considerably.

This is not a problem - it's a feature!

Whenever I'm confronted with surveillance-based "identification" and I'm unable to just choose a better option like receiving a letter in the mail, I make sure to only answer questions that can be directly deduced from the basic information I've already entered, or otherwise researched online (like the ones about what street is in what city). When confronted with questions about past addresses and whatnot, I make sure to answer "don't know" lest I confirm something they actually aren't so sure of.

I haven't had any problems as a result of doing this. I wouldn't be surprised if there is some "confidence" score based on how much the surveillance databases have actually recorded about you, and even if they aren't super confident will still supply a pass result to keep the client from losing customers.

They're not competent. That is the problem.

I remember being asked the name of a street I lived near once. I still don't know the right answer, but I think it was some official or unofficial name of I-80 or the 101 that no one calls it any more (e.g. Lincoln Highway).

I would rather be asked my Zodiac sign, although that is definitely weird.

You shouldn't have to spend time doing research on different versions of road names to prove my identity. That's absurd. I can imagine some dystopian future where I'm strapped to a chair and my kidnapper is demanding I answer to obscure names of highways as my only reprieve from torture.

I was also asked about my Zodiac sign. I was shocked. A credit reporting company using that is just appalling.

This is probably the way the business found to ask the same question as a date of birth while requiring an extra step from the user, which then:

* Decreases the number of bots able to get into your account

* Make it harder for a foreign agent with limited knowledge of English to do the same.

No, I did not write that question for you to answer.

IIRC there was a post here awhile ago about how you could refresh the pages and the options would change. Except, of course, the correct answer. Maybe someone else remembers and has the link.

It has nothing to do with security only plausible deniability.

If it’s not multiple choice, You can answer with random digits and keep your answers in a password manager.

Not only is it multiple choice, but there are only five choices.

Reply on news.ycombinator.com