Hacker News Reader

Comment by vkou | Hacker News Reader

> The issue didn’t stem from a breach of Robinhood’s systems, the spokesman said.

I disagree.

The Robinhood system includes their disbursement process.

In this case, someone with access to a username and password managed to, without passing any of the other typical 2FA checks in finance (Calling the the account holder, snail-mail confirmation, actual 2FA tokens) managed to get Robinhood to wire them money.

This is absolutely a compromise of their disbursement system. If a bank gave all my money to some random asshat that showed up to a branch with my debit card, the blame for that lies on my bank.

This is typical liability laundering.

View on HN

I think it's important not to stop at simply offering security systems, but to require them when appropriate. Hey you've got $1000 in your account now, that's awesome! Let's set up 2FA to protect that money!

more than that. For Robinhood to even allow initial account setup without robust (reda: no SMS) 2FA is bordering on criminal negligence. the only explanation to not doing that is feat that it would reduce their signup completion rate. Which fits Robinhood's prior behavior. This should be a class action at minimum, companies cannot shovel this kind of risk onto the general public.

Hyperbolic much? "Criminal negligence"? There are no laws requiring 2FA. Half the world thinks 2FA means SMS.

There are laws that require financial services companies to take appropriate steps to protect customer data.

Sure, but those laws don't require 2FA (maybe they should) and Robinhood is far from the only institution that doesn't require it. A startling lot still think 'state your name, SSN/PIN/ or account number and birthday over the telephone' is sufficient.

> Sure, but those laws don't require 2FA

Funny that. The PSD2 regulations in Europe do.[0]

The downside is that they don't mandate properly secure 2FA, so we have a mishmash of SMS, time-based tokens and whatever else passes for various banks under the regulations.[ß]

0: https://www.bankinfosecurity.com/psd2-authentication-require...

ß: My UK bank requires locally generated, time-based reader/app tokens, and has done so as long as I've lived here. My Finnish bank uses SMS.

Not sure what you mean laws but there is certainly regulatory guidance that assessors will be using.

The agencies consider single-factor authentication, as the only control mechanism, to be inadequate for high-risk transactions involving access to customer information or the movement of funds to other parties. Financial institutions offering Internet-based products and services to their customers should use effective methods to authenticate the identity of customers using those products and services. The authentication techniques employed by the financial institution should be appropriate to the risks associated with those products and services. Account fraud and identity theft are frequently the result of single-factor (e.g., ID/password) authentication exploitation. Where risk assessments indicate that the use of single-factor authentication is inadequate, financial institutions should implement multifactor authentication, layered security, or other controls reasonably calculated to mitigate those risks.

https://www.ffiec.gov/pdf/authentication_guidance.pdf

Enabling 2FA by default is probably a good idea, but I do believe quite strongly that users should be able to turn it off. You don't know the user's situation—maybe they don't have consistent access to a single phone, for instance—and if they actually use a strong and unique password, that should be sufficient.

Additional factors are of course always safer, but everything is a trade-off between security and usability, and users should have control.

From what I see on WSB, you can trade options without even fully verifying your email.

It seems to me that the damage is pretty limited for a cyber criminals with alleged ability to bypass 2FA. That low number of victims among millions of RobinHood customers is highly uncharacteristic for a critical security breach.

If someone shows up with your debit card and pin, which is similar to knowing someone's account credentials, wouldn't the bank give you that cash up to some amount (without further verification) because it's insured anyway?

> If a bank gave all my money

A bank would not let you empty an account with just a debit card and PIN, assuming there was some non-trivial amount of money in there.

> up to some amount

I think that's a pretty important detail. With my bank they could only get up to $1000 without further verification.

1. It will give that cash up to some amount. It won't let the chap drain my entire account.

2. They will return my money if I reported the theft in a timely fashion.

Robin hood seems to be doing neither.

For a singular transaction, a thief might limit themselves to something well under $10k. If a thief makes multiple withdrawals totaling $16k, which is over the FDIC insured amount, would a bank really just compensate you for that?

Wouldn't that be out of the graciousness of the bank (or PR)?

In the US, as long as you notify the bank within 60 days of receiving a statement that has fraudulent transactions, your maximum liability is $500, and that goes down substantially if you notify the bank promptly of a lost/stolen card, or if the card was not lost in the first place[0]. So yes, the bank really would[1] just compensate you for that, provided you notice the fraud within 2-3 months of it occurring (depending on how quickly you get a bank statement).

Edit: You may still be on the hook for overdraft fees from e.g. authorized payments, and it may take some time for the bank to indemnify you, which is why the conventional wisdom is that CCs are safer than debit cards from a fraud perspective.

[0] https://www.consumer.ftc.gov/articles/0213-lost-or-stolen-cr...

[1] and is in fact legally required to: https://www.federalreserve.gov/boarddocs/caletters/2008/0807...

At least in EU that would be a legal requirement (Payment Services Directive rules that limit liability for unauthorised transactions), not graciousness/PR of the bank.

FDIC insurance (and its equivalent in other countries) is something completely unrelated - it's for cases when the bank is unable to pay you because it goes bankrupt for some reason (which may include massive fraud done to the bank or by the bank), it's not for cases when your money gets lost in some other way.

The $10k thing is only necessary for AML compliance.

Since the bank is on the hook for giving out customer money to random con artists, their threshold for investigating suspicious account activity is much lower.

Came here to say that. If your system relies on an external system like someone's email, and that gets breached, your system has been breached. You don't get to brag that the successful attack was indirect; most of them are.

Liability laundering is an awesome phrase that needs to be used more

> This is typical liability laundering.

Relevant Mitchell & Webb comedy sketch: https://www.youtube.com/watch?v=CS9ptA3Ya9E

Reply on news.ycombinator.com