Comment by gpm | Hacker News Reader

Comment by gpm | Hacker News Reader

Parent Full thread

I'm not sure why you find this surprising, a bank has a much more complicated problem space than Facebook.

- They have a reasonably similar number of users (a fraction, but a large one).

- Mistakes cost a lot, so they have to be a lot more careful. It's a lot easier to make money hacking a bank than hacking facebook.

- They have to comply with all sorts of regulations.

- They probably don't trust their own employees to not be trying to commit fraud.

- They have to parse data on a scale that is likely similar or greater than facebook's. To detect fraud/lost credit cards/.... To decide who to give loans to. To price insurance. To decide how to trade stocks. ...

- They have to run a physical fleet of devices in the field, outside of their control, that have to give people the right amount of money ~100% of the time.

At a glance I see that Facebook has something like 300 petabytes of data [0]. I've worked at a bank, my team had something more like 10, but I don't think much of it was things like video that are just naturally huge. BOA is also approximately an order of magnitude bigger than the bank I was at.

One rumor I heard while there was that there had been a bug in one of our mobile apps that had been costing us a million dollars a day in server time.

[0] https://www.brandwatch.com/blog/facebook-statistics/

How do you spend that much on software and have such an abysmal usability and security story? I don't think there is anything technically difficult about the consumer software they offer, namely https://www.bankofamerica.com/.

I think you would find that their security is better than you think. Otherwise they'd be hemorrhaging money left right and center to North Korea and the likes.

As for usability, probably a degree of incompetence, mixed with design-by-committee and legacy. Edit: It's worth pointing out that banks usually don't gain or lose customers based on their UX, so it's not something that the business optimizes much.

I don't think there is anything technically difficult about almost any of the consumer software facebook offers, except scale. The same applies here but exchange "scale" for "scale, reliability, security, and regulatory compliance".

> I think you would find that their security is better than you think.

You can get in to my account by verbally relaying my grandfather's first name over the phone. You can open a bank account with a SSN and no photo id. What security? Their "security" is a fraud department, much like our credit card industry.

> Otherwise they'd be hemorrhaging money left right and center to North Korea and the likes.

This is not how transactions work.

> Edit: It's worth pointing out that banks usually don't gain or lose customers based on their UX, so it's not something that the business optimizes much.

All banks offer the same shitty experience. What does differentiate them if not their software? They offer literally nothing my local credit union doesn't offer.

> I don't think there is anything technically difficult about almost any of the consumer software facebook offers, except scale.

No argument here, but facebook at least manages to hire designers and not impose weird non-sensical patterns of auth, like "Look for this image when you log in".

Why do you say they have bad security?

I've talked with info sec employees working in their Charlotte office, and have not been given an indication that they are slacking.

Their security questions are a massive security hole. Credit cards don't require a PIN. I don't see much indication that it is difficult to steal from people.

Reply on news.ycombinator.com