throwaway201606

[edited to deal with formatting]

Genuinely looking for clarification - what does "untestable claim" means to you in this context?

If it means that you personally can't test it, then yes, it is an "untestable claim" and you are right, the whole thing is effectively a magic black box.

If it means that some other party/authority can't test it, then no, it is the opposite - a "testable claim" - to use the nomenclature put forward.

As a counterpoint to illustrate this, others who can, and do, test include:

1) internally (within the bank itself)

     + risk management: they define acceptable level of risk for login architecture & management

     + enterprise security: they define standards for login architecture among other things based on risk standards

     + infosec - they enforce ent. security standards

     + finance/analytics: test stuff like 
     "what did we/our customers lose to this type of fraud before/after we implemented this black magic box"

     + internal auditors (IT): assess and report on compliance

2) externally (outside the bank)

     + external auditors (who believe it or not, actually test this stuff)

     + regulators (who can mandate security levels in some jurisdictions - esp true outside the US) 

     + pen-testers: banks hire them to ensure that the security posture works

In large bank environments, developers cant simply put out a username/password login architecture and expect to see it deployed to production.

There are a ton of other groups defining what they MUST do. The degree of functional separation in (large) banks is astounding - but it mostly works - because everyone has to toe to requirements defined by other functional groups.

I would argue that another CS-related analogy to this is machine learning. Everyone says they do "ML", most people don't understand it, some do understand it and a few understand it deeply; from an execution perspective, most are doing it ML badly, some doing it OK but there are a few are doing it really well because they understand it really well.

As with ML, for the case of user access management, the fact that *most" are doing it badly does not negate its (very real potential) value if done right.

Access control is not on a binary 'yes-or-no ' decision on a per single-signal basis.

It is usually a weighted result of multiple signals. For example, it may look at say 20 factors and have a failure threshold of 15 passed. Most of the signals are evaluated server-side.

By design, some signals used are picked such that customer convenience, among other things, is not affected (e.g. the account holder data pull automation that you describe in your example ).

Examples of signals include timezone, time of login vs. past logins, hardware profiling (OS, screen resolution, IP, ISP, VPN vs. no VPN - based on known VPN server lists ) etc.

I agree that not all banks are doing this but the more sophisticated ones are (quite a few of them). Point here is curl or headless browsers working is not evidence of only account and password being checked.

Also possible they are identifying folks you are interacting with via audio.

http://www.independent.co.uk/life-style/gadgets-and-tech/new...

It is my opinion that it is a terrible statement on current affairs that this comment is ranked so high.

While all the things said here are true, they: a) happened more than 20 years ago in 1990 ( http://abt.cm/QNKiYt ) b) have little or no direct bearing to the issue at hand (Rwanda and its place in the current technology marketplace)

In my mind, a similar example might be reading something about say, for example the state of technology in Kenya and the top comment being about what happened there during the Mau Mau uprising. Yes, the correct would be factually accurate but that time does not represent the country today. And, most of all, WTF really? Stop with red herrings. The country is working like crazy to grow and develop and instead of "nice job getting from a where you were to b today", all you can offer is "yeah, but your dad and mom did terrible things 20 years ago".

Almost every nation in the world, developed or not, has parts of its history where its' peoples and governments did things - that they now deeply regret and would rather forget - as part of becoming the nations that they are today. It just happens that some, not all, African nations are going through those things in our lifetime.

We need to be fair in our positioning and evaluation of others especially if we perceive that they are making their way out of being on the low end of our assessment curve. No need to introduce extra huddles of history to the information we share especially if those hurdles are not contextually relevant.

Finally, the last sentence in that comment is worth some disassembly. - The first part: "Rwandans do some pretty nasty things around Africa to steal their wealth. But I suppose it's easy to overlook that stuff if you're making money. And to be fair... a LOT of people in Africa do these things. Of course, we don't usually do business with those people."

Please share some evidence around this. Else, STFU with opinions that hold no ground. And even if it were true, how is it different from, for example, the way western economies deal with African and Middle East nations that have natural resources they are looking for. Don't these economies do "do some pretty nasty things around Africa to steal their wealth" Should Africa make a decision along the lines of " Of course, we don't usually do business with those people."?

My two cents, definitely written while wearing my heart on my sleeve.

Saved a screenshot of your quote on img just in case it goes AWOL because don't want to end up sounding like a nutjob if if it does. Link to original quote here http://imgur.com/aYjzkUE

Kenya lies on the equator and does not extend 800km (450 miles) north or south of it.

The country has never needed and never had Daylight savings time. Day and night length are pretty much the same all year round with just a little variation.

Only countries at the extreme north and south edges of Africa would need daylight savings time.

Egypt, Morocco, Algeria, Libya, Tunisia and islands in the Mediterranean Sea in the north combined with Namibia, Botswana, South Africa in the South. Also need to count the two enclave nations in South Africa if we are being pedantic - so Swaziland and Lesotho join our list. These are countries where Daylight Savings Time makes sense.

In practice, of these, only about 5-6 countries actually have DST - Egypt, Morocco, Namibia and Tunisia and the islands in the Med. IIRC Egypt and Libya have an on-again off-again kind of deal going on with DST.