Hacker News Reader

Comment by bananas | Hacker News Reader

Did we expect more?

there's one hell of a difference between a large financial organisation or an exchange and some half arsed startup who hacked up a web site in PHP that just happens to handle something that represents a currency. The former at least probably has a QA team, knows industry regulations and best practices and designs their architecture properly. Oh and they have cumulative experience and a designated location you can visit with burning torches and pitchforks when they steal your money. I'm ignoring regulation as I've worked in the compliance industry and it's entirely about working around it.

Not joking and I'm sure that this is going to stand on a few toes but some of the stuff I've seen on HN is verging on criminal. So many immature poorly thought out and damn right dangerous products being thrown out. Lots of people are sitting on ticking bombs like this.

View on HN

Large financial organisations can be surprisingly criminal and incompetent when it comes to IT - you don't have to look far. Knight Capital, NatWest, HSBC... just a few names that pop into my head. The big guys spend large amounts of time and money convincing regulators and the public that they're clean and clever. It's public confidence that counts.

They're pretty fine to be honest. They have mitigation and FCA oversight which means you're not in the shit as a customer (usually).

Knight capital was a cock up in a high risk trading env. They paid for that.

HSBC was money laundering which is basically the entire purpose of a bank.

NatWest was a process cock up.

However no money went "oops we lost it" and was never seen again. At most, even with HSBC consumer withdrawal limits it's a minor inconvenience for a couple of days.

Much like mobile phone networks, people expect 100% uptime but that's unrealistic in practice. Always keep £200 rolled up in your mattress.

HSBC was money laundering which is basically the entire purpose of a bank.

This is a very strong statement.

Do you mind backing it up, or is this just meant as a glib throwaway quip?

I suppose that was a throwaway quip directed at HSBC who seems to have managed to get away with laundering on a large scale with some slapped wrists.

I'm not the OP, but I think I can see what he means, and I think he means it in a non-pejorative way too.

One of the functions of banks is indeed to hide the source and destination of your money. My grocer doesn't get to know who employs me; my employer doesn't see where I spend my money.

Yes, you can achieve that with cash, without directly involving a bank. But the money is still issued by a bank.

I'm not saying that it's impossible to achieve this level of information hiding without banks, but I can see where the GP is coming from in his argument.

Sure, but the regulations worked. NatWest and HSBC were brought to book.

Nobody is saying that traditional financial institutions are perfect, but at least they are regulated and at least there are checks and balances in place. By and large the examples people roll out of these institutions behaving badly are examples of the regulators and legal frameworks working the way they are supposed to.

Knight capital were in a risky business and they blew it. It happens. But they're the exception, not the rule. In the wonderful world of Bitcoin, the goings on at MtGox looks like the rule, not the exception.

"But they're the exception, not the rule."

Excuse me, you must have forgotten about a certain global financial meltdown in 2008?

And yet you still see banking security that insists on alphanumeric password only and no 2FA.

Seriously, that's screwed up. That being said, banks have insurance and all that jazz. So even though the state of security is not that great, it seems that you are less likely to get screwed incase of a screwup.

Not seen that in Europe for a long time. In fact all four UK bank accounts I have use two-factor auth.

My UK bank account (Bank of Scotland) does not have two-factor auth, and there's no stated plans to implement it, as far as I can tell.

My RBS and Natwest accounts both have CAP devices:

http://en.wikipedia.org/wiki/Chip_Authentication_Program

Edit: apparently I don't need them any more.

HSBC does still require it though.

They used to offer 2 factor authentication to some personal account holders but they have removed that and it only appears to be available for business accounts:

https://www.bankofscotland.co.uk/online/portal/

That's news to me - not that I've logged into my accounts for a few months! :)

Reply on news.ycombinator.com