Hacker News Reader

Comment by gruez | Hacker News Reader

I can understand banks using client fingerprinting for fraud detection, but Chick-fil-A? Are they worried that people might steal $5 of restaurant vouchers?

View on HN

You'd be surprised, Chick-fil-a has a TON of fraud to deal with given their food's popularity. They push the "convenience" of the mobile app (and it is in some ways), but coupon fraud was also a big hidden reason driving that; basically all paper vouchers or barcode-based coupons moved over to app-only. Same for their Christmas calendars that used to be paper coupons + those receipt-based "Free Sandwich" surveys, etc... all have been clamped down with vastly increased security over the years.

There might be a bit more sympathy for their plight, and a self-correcting problem if they'd explain why they were doing it.

Sometimes just by pointing out that it's an issue, people will start to adjust their behavior to make it not an issue anymore. There'll always be some ne'er-do-wells, but if we let that deconstruct our expectation of positive respect for one another's time and stuff, well... You reap what you sow.

A few months ago the official Android app for Instant Pot would not let me view recipes due to my device being rooted (I just checked and they have since changed this). Up until a couple years ago, my credit union had a password length limit of 10 characters. I can use 2 factor authentication with my power utility but not with my credit card company. Companies seem to have an extremely uneven view of what calls for strict security measures and what doesn't.

Gift Card fraud is a massive underground industry.

> I can understand banks using client fingerprinting for fraud detection

Why? What is it about banks that somehow legitimitizes this malware? They shouldn't get to pull out all the stops in order to prevent fraud just because it exists. There are some lines we can't let them cross. It doesn't matter how much money they lose.

Malware is, by definition, malicious software. Your bank attempting to prevent people from stealing your money is not malicious. Yes, your bank is insured and if your money is stolen you have a decent chance of getting the money back eventually, but not until you're able to prove it was fraud and that process finishes. That could take months in some cases, and you're missing all your money in the mean time, which is long enough that for many people they wouldn't be able to pay bills and could face eviction in the mean time.

So would it be okay if your bank forced you to install a kernel driver so it can intercept and log every network connection? Would it be okay for mobile banking apps to request every permission available and refuse to let you do anything unless you grant them? All this for "fraud prevention purposes"? Because that's what banks are like in my country.

There is no guarantee they will limit themselves to fraud prevention anyway. Any information collected is highly likely to also end up in the hands of marketing, governments and god knows who else. Without this guarantee, any and all "fraud prevention attempts" should absolutely be considered malicious.

we already went through this thought experiment with Sony.

I know in the past Chick-fil-a has been criticized for its conservative views; perhaps this was related to their efforts to mitigate attacks on the website?

Reply on news.ycombinator.com