lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 3 Apr 2014 00:23:21 +0200
From: Stefan Weimar <stefan@...nhop3.de>
To: "Sholes, Joshua" <Joshua_Sholes@...le.comcast.com>
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] Bank of the West security contact?

Hi,

Am 02. April schrieb Sholes, Joshua:
> And how fast would those ATM manufacturers switch to a Linux or other
> offering if, say, Bank of America said "We won't buy an ATM with an easily
> skimmable reader or with an insecure OS on it?"

I agree. But it's not _one_ bank that has to say, it's more of them.
Because they would have to pay more for the "secure" ATM (development,
testing anyone?) and they have to wait a bit. That's completely doable. 

But: In the end it's the bank's customer who has to pay for it. And if
BoA charges him higher interest rates on his loan, what's he gonna do?

He just wants a simple device (like in: card in -> money out) and he
simply doesn't care about the OS. 

> Diebold, for example, has a market cap of less than $3B.  BoA is sitting
> around $182B.  With that much leverage, the big banks have NO excuse to
> just accept whatever crap the vendors shovel out the door.

Again, I fully agree. But as long as the customer doesn't care (he gets
his money back in case of fraud, right?) the banks won't care, too.

We won't see banks turn until the financial damages grow beyond the
costs for security. Like anywhere else in IT-security.

Yours sincerely
Stefan
-- 
make -it ./work

GnuPG-Key: 742ADF27 <stefan@...nhop3.de>
Fingerprint: 037F 17FC CF4B C1E0 598D  97B1 C2CE 7963 742A DF27

Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists