full-disclosure - Re: [FD] Bank of the West security contact?

Open Source and information security mailing list archives

Message-ID: <20140402222321.GA7351@laurana>
Date: Thu, 3 Apr 2014 00:23:21 +0200
From: Stefan Weimar <stefan@...nhop3.de>
To: "Sholes, Joshua" <Joshua_Sholes@...le.comcast.com>
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] Bank of the West security contact?

Hi,

Am 02. April schrieb Sholes, Joshua:
> And how fast would those ATM manufacturers switch to a Linux or other
> offering if, say, Bank of America said "We won't buy an ATM with an easily
> skimmable reader or with an insecure OS on it?"

I agree. But it's not _one_ bank that has to say, it's more of them.
Because they would have to pay more for the "secure" ATM (development,
testing anyone?) and they have to wait a bit. That's completely doable. 

But: In the end it's the bank's customer who has to pay for it. And if
BoA charges him higher interest rates on his loan, what's he gonna do?

He just wants a simple device (like in: card in -> money out) and he
simply doesn't care about the OS. 

> Diebold, for example, has a market cap of less than $3B.  BoA is sitting
> around $182B.  With that much leverage, the big banks have NO excuse to
> just accept whatever crap the vendors shovel out the door.

Again, I fully agree. But as long as the customer doesn't care (he gets
his money back in case of fraud, right?) the banks won't care, too.

We won't see banks turn until the financial damages grow beyond the
costs for security. Like anywhere else in IT-security.

Yours sincerely
Stefan
-- 
make -it ./work

GnuPG-Key: 742ADF27 <stefan@...nhop3.de>
Fingerprint: 037F 17FC CF4B C1E0 598D  97B1 C2CE 7963 742A DF27

Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives