Hacker News Reader

Comment by steventhedev | Hacker News Reader

> Why am I supposed to believe that?

Because it's required by law, at least in the US, UK, and most of the EU. The quality varies somewhat, but the main goal is less to prevent fraud than to detect it after the fact. Basically every single bit of information your computer is willing to send will be recorded. That includes request headers at a minimum (if you've disabled JS) and quite a bit more if you do have it enabled. Try a packet capture when you open your bank account next time to see just how much they transfer out of your computer.

Source: used to work on one such product

View on HN

What laws?

I worked dev (hence the username) and left the company more than 5 years ago, so I don't remember the exact regulations. I do remember it was a big deal towards end of 2012, so you're probably looking for something from around 2008 with a final enforcement date of 2012.

I'll update if I remember the name.

There was a bunch of stuff to do with this in the first payment service directive, most of which was enforced around 2012-2013

https://en.wikipedia.org/wiki/Payment_Services_Directive

PSD2 has requirements on "strong customer authentication" basically requiring 2-factor, that were meant to come into force on Saturday the 14th of September just passed, but ended up being delayed at the last minute in most countries.

I'm sure whatever product you worked on had all of the features you've described. I'm skeptical that the primary purpose of those features was fraud prevention rather than data mining. I'm quite certain none of those features are required by law.

I've yet to see any law that requires a specific feature. Usually they're worded like "has a control for preventing unauthorized access to accounts". The definition of unauthorized, access, accounts, and even control are left to auditors and each bank defines them differently. I spent 2 months implementing something with absolutely zero security value, but the bank's auditor was insisting so we had no choice.

I don't remember any data mining projects that weren't explicitly anti-fraud, but that was years ago and things may have changed since. One project I recall was able to proactively reach out to banks and inform them of compromised accounts based on things we learned from other banks. Pretty cool stuff; kinda wish I had stayed there longer.

It would be interesting to see how this squares with GDPR, the purpose of the latter being to minimize recording of what your computer is willing to send.

GDPR allows you to collect data if you have a legal need to do so.

It's debatable whether there is a legal need. I prefer 2FA and that should be it. If you are trying to stalk me, I am willing to cancel.

We have one dataset we would very much like to delete (discontinued product) but are required by a different EU law to keep. GDPR now also means that we have to provide that data to our customers if they request a copy of all the data we hold on them.

Reply on news.ycombinator.com