Fiat currency and banks - when it all goes wrong

Okay, so there are our banks, running away nicely. Depositors are happy, although they'd like a little more interest. Lendees (?) are happy, although they'd like a little less interest. Record profits are being announced, record dividends are being paid, and CiF is full of articles about how many nurses could be paid for out of "Bank of Evil & Sons" bonus pool. Hunky-dory. 18 months later, it's a world of shit and pain. What could have gone wrong?

Well, go back to the simplified model we had with the two classes of assets - our 10%-ish of low risk, high liquidity, low profit and the rest in higher risk, uncertain liquidity, higher profit. There are clearly a bunch of things that could go wrong here.

• We could be pushing the edge of that 10% - it's not set to punish the banks but to ensure that a bank run can be managed. 
• We could have categorised assets incorrectly. Something we thought was low risk (or high liquidity) could turn out not to be either, or to be neither.
• The regulatory model could be wrong - some things we are told were in the top asset class could turn out to be worthless.
• Our profit model could be wrong for the higher risk assets - we could not be making enough on the good loans to cover the expected %age of defaults.
• We could have a liquidity crash. Remember - we've got to cover the fact that you have between £2000 and £0 in the bank each month - and we've got to have the cash to pay you, even though we've lent out £1000 of your money (£100 to the govt and £900 to real people.)

Or, it could all happen. And, of course, you have the usual things going on - business executives taking strange decisions (RBSG and ABN AMRO, for example) that go badly, horribly wrong.

• There was a lot of pressure, from the market analysts, for banks to generate every increasing profits. You can't do this with low-risk investments.
• Many banks don't have the time to research, in detail, the risk models of the increasingly outre investments on offer. Hence the ratings agencies. They get paid to do the specialist analysis stuff. They get it wrong, especially for a category of assets and you've got stuff you think is near-cash that turns out not even to be "investment grade".
• Government bonds. Greek and Spanish, especially. And other things.
• Yes, err, mortgages. Housing market never falls? Non-recourse loans in the USA (certain states, YMMV)? Powered by Government regulation - the Home Mortgage Disclosure and Equal Credit Opportunity Acts in the USA, the Thatcher started (and New Labour continued) war against local councils via the Council House sales (with silly discounts.)
• Ah, yes. And here is the rub. These mortgage-backed securities - the Collateralised Debt Obligations of much infame. What was the problem here? Well, some of them, particularly the junior tranches of US mortgages, became worthless (non-recourse loans in a falling market). For the rest, people couldn't work out what they were worth. So very few people wanted to buy them, except at fire-sale prices. The market became illiquid and you had a price spiral of doom.

You see, although the UK house market is over-priced (relative to average earnings and the value of land - it's a planning permission issue), UK mortgage "asset-backed securities" were probably still worth a significant %age of their nominal value. We have had a rise in unemployment, yes, so mortgage defaults will be up. We have had a drop in the housing market*, so the collateral isn't worth quite what it was. But, still, with a bit of ingenuity, you'd have probably been able to recover over 80% of the value. Taking a long term view, you may even have made a profit over nominal.

But, with daily settlement required, a long term view is hard. With "mark-to-market accounting", ingenuity has to take a second seat to panic. And there we are.

What was the only thing that could have made this worse? Delay followed by selective government bailouts. What did we get? Ah, yes, Bruin to busy saving the world to work out what he should be doing at home, UK Financial Investments Ltd and 82% HMG ownership of RBS. Oh, well ...

And, please note - there is nothing in any of this that being on the gold standard would have prevented. Gold values fluctuate all the time - and the only banks that were ever required to be backed up in bullion were the central banks. Because it isn't the value of the £ or the $ that crashed (although they've not exactly done well). It is the value of the bank assets denominated in £ or $ ...

* But, if you look around, this is actually, in the UK, largely a liquidity crash, not really a value one. Values have gone down, indeed. But not to crash levels. The average house price is down to about £160k from a peak of about £185k. Painful but not catastrophic.

Fiat currency and banks

There are some people who believe that going back to the gold standard will save the world. It might indeed solve some problems but remember that most countries started on the gold (or silver) standard and have all, even the Swiss, come off it. There must be a reason. Quite often, it involved a war or two. So there must be problems that exist because of the gold standard that are solved by having a fiat currency.

But, still, even then, there are loads of people who get upset that "banks just create money". Sighs. Okay, in a fiat currency system, banks are required to hold assets to balance their liabilities. These assets can be all sorts of things: capital from shareholders, buildings, debts they are owed by other people or businesses. It's the last that seems to bother folks.

Let's look at it. I run a business - we are currently owed about £20k by various customers, about £5k of which is overdue. I am allowed to carry all of this £20k at 100% of nominal value on my books. Indeed, if I wish to write it off, I am supposed to show that I have taken due care to recover the debt before I can count it as a loss.

So, how does it work with a bank? Well, lets say you earn £2000 cash a month, and your outgoings are reasonably spread out. You are loaning your bank, in effect, £1000. What can the bank do with that £1000? Well, it could sit on the books as a cash asset. This is the modern equivalent of stuffing it under the mattress - say, a safety deposit box. It isn't the real business of a bank - that's lending money. Okay, now the government will say that the bank has to have a certain %age of that in "low risk, high liquidity" assets*. Let's call it 10% (which is about the right value.) The bank now has £900 of your money that it can lend out to somebody else. It does that - so it now holds a debt of £900. Let's look at the arithmetic. Assets = £100 low-risk stuff + £900 higher-risk stuff. Liabilities = £1000 to you. The bank is even. Okay, it will have to put some money aside for credit risk - the chance that it won't get the £900 back from its debtor so will have to pay you back out of shareholders' funds. But that's why banks charge different rates of interest. And have secured and non-secured loans - to manage that risk.

Now, let's say that that £900 is used to buy a car. And the seller happens to be at your bank. So he deposites the whole £900 to pay for his holiday next year. The bank now has £900 cash, £100 cash-like and £900 debt. Balanced out by a £1000 liability to you and a £900 liability to the car-seller. What does it do with the cash? Well, it lends it out. £90 into (hopefully not Greek or Spanish) government bonds. £810 to somebody who wants a new carpet. So it now has £190 bonds or cash and £1710 in debts owed. Liabilities - £1900. Balanced. 

There is no magic money tree. Every loan the bank has made has been funded by folding green stuff or its electronic equivalents being given to the bank. The same as if you were depositing gold or silver. All that is happening is that banks, like other businesses, are allowed to treat debts as assets.

What happens when it all goes wrong? Well, that's another post.



* Note that these include government bonds. And the Greek government was insisting until quite recently that Greek banks treated Greek government bonds in this way. Which was entirely logical but completely insane.

Naughty, naughty little bank

And all the rest of the security holes that having fancy indexing turned on allows one. You know who you are ...

Éoin Clarke: Outrageously Stupid

Now, I know that's not news but he's outdone himself this time with "A call to establish an International Banking Crimes Tribunal". Being a lefty, of course, crimes include facilitating legal voluntary payments between consenting adults:

Worse still, UK banks took payments from families in poverty for FarePak Christmas Hampers even though they knew they were calling in the debts of that company before Christmas and that families would be left stranded

things they simply aren't guilty of:

Moreover, our banks have flogged cash machines to racketeers who charged customers £1.50 per withdrawal.

{Note to the socialist or terminally dim (but I'm channelling Mr Clemens again ...): Diebold and NCR may indeed be evil but, regardless, they're not banks!}

and uses the example of the ICC (120 States Parties not including, as well as the USA, the two most populous nations in the world - China and India) as:

the entire world

But then he outdoes himself with a "perfect Ritchie":

The powers of the court are for others to discuss but the concept that a court would be able to apply unlimited fines and recommend bankers for trial seems a good starting point.

Civilised places, you utter statist filth, generally award punishments after the trial.

The Myth of "Banking Qualifications"

It's a great rallying call for modern credentialism, isn't it, from last week's Private Eye:

Q: Who is the odd man out from the following list?

Lord Stevenson, HBOS; Andy Hornby, HBOS; Sir Fred, RBS; Sir Tom McKillop, RBS; John McFall, MP; A strategically shaved badger, MP & Treasury; Sir Terry Wogan, everywhere.

A: Terry - has a banking qualification.

Well, well.  The great and the good.  Unqualified for the positions they find themselves in.  And I sure Sir Terry doesn't even have a BA in Radio Presenting, or even an NVQ2 in Modern Music Analysis.  Edited to add: And, of course, Ian Hislop's degree is in English Lit, not in Journalism, so he is clearly unqualified to be the editor of a satirical news magazine and should quit with immediate effect.

What a load of fatuous bollocks.

Back in ancient times, when I ran a banking team, it was very highly qualified, had an extensive training budget, and everyone was a full member of at least one professional body (normally the BCS).  None of us had a "banking qualification".  

Q: Why ever not, you complete fraud?

A: Because we weren't providing banking advice to customers, numbskull.

In fact, we once sent back a whole bunch of business cards because they had the "will only give advice on our own products" FSA disclaimer on the back - and we pointed out that if we were giving advice on any financial products, we were so far outside the rules, the disclaimer wasn't going to help.

There is nothing wrong with banking qualifications and for the people at the customer-interacting level, they are to be encouraged.  There is nothing wrong with working your way up within a business - from the shop-floor to the boardroom.  Equally, there is nothing wrong with being in a more specialist area - law, accountancy, IT - or being a generic business manager - and getting to board level.

Let's just look at the Chartered Institute of Banking in Scotland and their "Chartered Banker" Qualification:

COMPULSORY SUBJECT

• Professionalism and Ethics
  

SECTION A - CORE SUBJECTS (Candidates must complete at least one credit from this section)

• Retail Banking
  
• Business Banking
  
• Building Society Operations
  
• UK Financial Services
  

SECTION B - CORE SUBJECTS (Candidates must complete at least three credits from this section)  

• Financial Management 
  
• Business Law
  
• Financial Economics
  
• Management Strategy and Leadership 
  

In addition to the 5 credits achieved by completing the compulsory elements, candidates must complete a further 6 credits from Sections A, B and C.

SECTION C - ELECTIVE SUBJECTS
Half Credits

• The Compliant Person and Regulatory Risk
  
• Credit Risk Practice 
  
• Private Banking and Wealth Management
• International Business 
  
• Customer Relationship Management
• Operational Risk Management 
  
• Project Management
• Money Laundering 
  
• Financial Crime 
  

Full Credits

• Corporate Finance
• Managing People 
  
• Marketing and Selling Financial Services
• Call Centre Management
• Investment 

Now, is this really the level of qualification you would require in somebody at board level?  I am not saying that none of the modules would help but, compared to, say, an MBA and appropriate experience?  Just what in this would have given Sir Fred, or whoever, the insight into international interconnectivity to predict the US mortgage security debacle?  Why is it now considered necessary for you to have a qualification for everything?

I mean, the only qualification necessary to be an MP is that you wore the right colour rosette?

Illiberal & Undemocratic

While reviewing the latest effluvia from the odious Harman, I saw:

"Nobody disputes that Sir Fred should be deprived of his pension," said its Treasury spokesman Vince Cable.

Nobody?  Are you entirely sure, Vince?  There are quite a few people speaking up for the rule of law and holding to contracts voluntarily engaged in.  You're clearly not listening to them, mind, but people like you never do.

Class War!

One of the things my English colleagues fail to understand about Scottish politicians is that you actually have the good ones in UK Cabinet positions.  When you consider that means I am talking about such luminaries of the current or recent world stage as Broon, Broone, Darling and Reid (although Bliar is Scottish, true, he was never a "Scottish policitian" per se), just think what that says about those left behind or on the back benches?

Now, Jim Sheridan, true light of the radical commune, sits in Westminster, and you are welcome to him!

Jim Sheridan, Labour MP for Paisley and Renfrewshire North, has also asked the Metropolitan Police to investigate the activities of senior bankers.

Has this bigoted moron got no idea of the difference between crime and incompetence? With his colleagues in the nU-Lab conspiracy desperately moving us to le Code Napoleon, he is demanding:

I think it's only right and proper that the police has access to all the transactions to make sure what has happened is either down to bad judgement or incompetence.

Neither bad judgement nor incompetence are police matters. They may be civilly actionable, if they amount to negligence or breach of contract but for fuck's sake.  What an utter cunt.  He is so appalling, I wondering why he isn't a list MSP.

Isn't Schnadenfreude Fun?

Senator John McCain, who may (or may not) be a zombie, has been bitten in the campaign by the Digital Millenium Copyright Act. And Google told him/them to "bugger off".

After having several campaign videos removed from YouTube for alleged copyright violations, Republican presidential candidate John McCain wants the video-sharing web site to consider special takedown privileges for politicians and their ilk.

McCain '08 general counsel Trevor Potter yesterday sent a letter to YouTube execs claiming the site is too quick to remove their campaign videos based on "overreaching copyright claims." He wrote that on numerous occasions that the material in question was "clearly" privileged under the US fair use doctrine.

Ha, ha, ha, ha, ha! ROTFL. That's what happens when you create bad laws. You get bad consequences. Sympathy - in the dictionary between shit and syphilis. But, I really love this bit:

Warner Music Group, CBS, Fox News, and other media conglomerates have all sent YouTube takedown notices for McCain videos.

Warner Music Group demanded YouTube remove a McCain video that uses the 1967 Frankie Vallie song "Can't Take My Eyes Off You." CBS wanted a YouTube video removed that used a clip from Katie Couric. And Fox News had a similar complaint about a McCain video that used a clip about the financial crisis.

So it's not "all those people who are abusing the DMCA by bombarding YouTube with invalid takedown notices", it is a legal difference of opinion regarding the extent of the (common law) fair-use doctrine. Which should be tested, if necessary (especially remembering this is the United States of Lawyers) in court, between the (ab)user and the copyright owner. Not by Google who, rich and Kings of the Universe though they are, are not, yet, the legal system^*.

Update: And, this, too! Well done, lawyers. Not.

* As we all know that may, or may not be, Wikipedia.

Is there really a "banking crisis"?

Okay, a bit of a foolish title. Northern Crock, Bear Stearns, damn nearly Société Générale. There is certainly a problem but a crisis?

I'll admit that I am not trying to refinance my mortgage just now but I got my RBS Final Dividend cheque through the post a few minutes ago. This was a bit unexpected as I was expecting shares but there we go - I probably forgot to post some form or other. It was more of a surprise when I looked at the value - just under a fifth of what they want from me (but are not going to get) in the rights issue. Remember that that is diluting the share capital by 11/18^ths, albeit discounted - and that there is also an interim share dividend (about 1/3 of the total).

So, all in all, this emergency £12 billion cash injection is on the order of 3 years customer dividend. Lots of money, indeed, but, hardly, considering how many companies don't pay a divi, the crisis some are making it out to be.

New Coins

I am, in my (very limited) richer moments a non-obsessive collector of UK coins. And I like these new ones:



I think the idea is good, I think the use of the traditional heraldry is good (although there clearly should be a Scottish version with the proper arrangement of the Royal Arms for use in Scotland - this being different from the Royal Arms of Scotland). And I will buy a set, when they come out in silver Piedfort.

And for those bemoaning the loss of Britannia, can I please direct you to the 2008 design:



Update: Got the Royal Mint catalogue through this morning. £11k for the two (old & new) sets in platinum. A mere £6k for the new lot. :) My dearly beloved thinks not.

The Price of Progress

There was some startling old harridan on Breakfast News this morning (you can tell I am working away from home) who, apart from appearing to be auditioning for Miss Prism, was suing BT for charging her extra for insisting in paying in cash.

Now, the direct debit system is far from perfect - see here and here - but her main argument seemed to be that since cash was good enough for the Roman Empire, it should remain the main engine of payments for the 21st Century. Now, the reason we are not still mostly slaves and peasants, living in rustic poverty propping up the lives of a few patricians is the massive improvements in productivity since Caratacus screwed up in 43AD.

Cash has many problems compared to electronic payments - you need office space to receive it, cashier time to count it, change to pay out, total it at the end of the day (in case the cashier has developed sticky fingers), take it to the bank (and your courier may well be violently robbed) - who will charge you for depositing it and count it, again. All of this takes time which, axiomatically, is money. No wonder utilities prefer electronic payment.

Chip'n'Pin at home

Well, as I promised a considerable while ago, my RBS EMV / CAP (Card Authentication Protocol) reader has arrived - I thought it might be coming when they renewed my Highline card out of sequence last month. So I am going to enable it and see what happens.

Now, to enable it, you either need to wait 21 days, when it will happen automagically, or you need to log on and give the system the proverbial boot up the behind. So, onto the account we go, partial PIN, partial password, possibly for the last time, trying not to weep at just how little money there is. Okay, "Change Settings", "Enable Card Reader". Yup. Don't need the online demo.

Okay, select a card. Interesting - I have both a Maestro and a Mastercard on this account but I am only given Hobson's choice - Maestro alone (interestingly, when I put the Mastercard into the reader, it says "Wrong Card" as it does for all of my other bits of plastic. Clearly missing the CAP application). Okay - and it gives me the last 5 of my Highline card so I am not picking the wrong one.

(Correct) card into reader and I am asked to press the "Respond" button, rather than the "Identify" button. I wonder why (according to the online instructions, the "Identify" and "Sign" functions are not being used yet)? Enter my card PIN, then I need a challenge:


Okay, a 4 digit random component (yes, I did check a couple of times - nothing obvious but I'll let somebody else do the detailed statistical analysis) and a 4 digit fixed component - and, I believe, the first, albeit minor, protocol flaw. If this is being MITM'd and they want me to authorise something other than the action I had taken, I could readily make the final characters of the reference number into anything I want. However, the online user guide states

Some banking transactions don't include a familiar account number visible on your computer screen. For example, when you want to set up a payment for your gas bill online or change your Security Number or Password.

So when you use your Card-Reader for these transactions we'll provide a Reference number and an Authorisation number on the same screen. The Reference number will always be 00004444. The last 4 digits of these numbers must match.

I suppose that fraudsters will be in a major fight for bank accounts with the final four digits being 4s. Still, I get my response (7 digits rather than 8, interesting but not necessarily in a bad way) from the reader, punch that into the website and I am active. Wonders will never cease. Now what does that do for me.

Okay - any option to use this for login? Nope.

Make a payment into the main household account. No need for the reader.

Add a new payee, one of my little slush funds - yes - need the reader.


Okay, that works. Bump myself £50 (don't tell Mrs S-E). Nope. Hmmm.

So, seems easy enough to use. The On / Off button on the reader could do with a cover and it ain't going to fit into my wallet. I would really like the option to use it for login (especially if I could have a restricted functionality set, say balance only or balance and intra-account transfer, still available on pp&p). Having said that, it all seems to be a worthwhile improvement in the overall security.

S-E

RIPA Part III Code to Parliament

The Home Office, not that they exist anymore but that is what they have signed themselves off as, have informed me that that final draft (until the poliscum get their hands on it) of the Regulation of Investigatory Powers Act 2000 Part III Code of Practice has been placed before Parliament. If you remember, Parliamentary approval of the CoP is necessary before Part III, and its associated draconian powers, come into effect.

Given that the legislation has been in place for some time and is truly appalling, it was always going to be extremely unlikely that we could (and latterly clear that we wouldn't) get a citizen-friendly exposition of the regulatory limits on the exercise of the legal powers. Now, Sections 3.4 to 3.11 do contain some good advice on limiting the circumstances in which powers, especially key disclosure should be exercised but, as there is no "outside the tent" supervision (neither NTAC nor the Surveillance Commissioners are outside the tent), I am dubious how strictly these will be followed.

Section 3.29 makes sense but I can still see the warrants flying and Sections 3.34 and 3.37 are nicely direct. Sections 4.22 and 4.23, which a number of people specifically requested, gives you a single contact point, nationally, for querying the validity and correctness of a disclosure order, and a unique number for each order. This is seriously good news and should minimise abuse at the local law-enforcement level. 4.45 and 4.46 also provide a degree of protection for the techies who are likely to be tasked with actually complying with the notices - they now get an official record of their (apparent) compliance, especially vital where there is a strict time constraint on the disclosure and where the disclosure would be to a forensics lab or similar facility, rather than directly to the investigating officer.

Costs, Sections 4.43 & 4.44, I can see leading to serious bun-fights. If these make it through Parliament intact, it is going to be interesting to see how this pans out with our cash-strapped police. Ideally, from far-far-away.

Section 6.7 bullet 5, while of itself (in my opinion) a reasonable ground for needing the key as an item of evidence in itself, is rendered completely moot by 6.10 & 6.11 - here, if, for example, I have access to a key and the passphrase makes it clear that it is my key (as my personal and work PGP passphrases certainly do), I can give out a copy of my key (or generate an appropriate sub-key) with a completely different passphrase, possibly even hinting that the key was generated or is used by somebody else.

Sections 6.8 and 6.9 should re-assure the banks - the "must reconsider" in the last sentence is the strongest we could have hoped for. We'll wait and see the final version and the subsequent FSA protocol before casting too many plaudits, though.

Section 8 seems to have been toughened up a bit - I am still disappointed by the restriction to expensive civil action rather than using the offences in the Act itself to charge inappropriate subsequent publication or release of disclosed material but the establishment were never going to let us win that one.

On the whole, better than it had been - we'll see now what happens to it under the nouveau regime.

S-E

PS - I note from the draft order itself (statutory instrument) that we all (may) have until 1st Oct 2007 to bin all of our old keys as thoroughly as we can. Get started. Let them see what their mates in the drugs squads have to put up with :)

RBS to issue EMV readers

It was announced yesterday, which I missed, that RBS (and Natwest) will shortly start issuing their EMV readers for online banking. These are not just for start-of-session (or even significant transaction) authentication, but should also help prevent transaction hijacking either by trojans or MITM phishing / pharming /p-whatever-ing web sites.

Assuming I get mine (and I may now be on a black list), I will let you know how the whole process works.

S-E

Direct Debits - Fiend or Foe?

Wonderful - Easter weekend, no Tory morons, no Nu-Lab cretins (Terry didn't approve any comments yesterday - if he maintains his foolish consistency, we shouldn't see anything new until Tuesday, at the earliest), so back to moaning about the things I set this blog up to be ignored about.

One of the miracles of (not that) modern banking - the Direct Debit. According to BACS, they are "one of the safest ways of paying your bills." Safer than standing orders, because they should only be called upon when you actually owe the money and better than standing orders because they allow variable payments.

Except that there is a world of a difference between theory and practice. Think about what a Direct Debit mandate does. We all deal with various organisations whose fundamental competence we doubt (eg our local unitary authority, energy utility and, if you are south of the Tweed, water company). DD gives the minimum wage Sharons or Dwaynes in each of those (or, worse still, their computers) an unlimited tap into your current account. If they ask for the full sum of your available balance, they will get it. So DD is not a risk free endeavour.

I first began to suspect that all was rotten in the state of DD a couple of years ago. At the time, I was being paid into a personal account and then transferring most of the dosh pretty much immediately into a separate joint and several (with my wife) account. I cannot remember which insurance policy she was renewing but my wife told me that the monthly payment option had been reasonable and that there would be a new direct debit appearing. True enough, one did. On my account.

Just to be clear - my wife had managed to set up a direct debit on an account to which she was not a party. No trouble, no "we already know who you are but you are going to have to 'prove' it anyway" KYC bollocks. On the phone, to an insurance company, and a DD against my account. All she needed was my account number - not regarded, in the banking world, as confidential data. Now, we were going to be paying the money and it wasn't of an great significance which of the two accounts it came out of. I was just staggered that the system permitted this. A bit of judicious investigation, back at work, realised my fears - this was not a one-off error on somebody's part. There was no security control step that had been skipped. This was the system working the way it was designed.

And then this week. Well, a couple of days ago, in a brief respite from blogging work, I checked my bank account balances online. Much to my surprise, one of my accounts was overdrawn. This was a particular shock as all I now use that specific account for is to keep £50 or £100 in case I am "caught short" and need to visit an ATM in a hurry. What had happened?

It was, I admit, partially my fault. I had a savings contract for £100 per month which had completed at the beginning of March. At that point I could have, and probably should have, cancelled the DD. But wait? Isn't DD a pull not a push mechanism? The intermediary organisation shouldn't have demanded money that they weren't owed. Or so you would have thought.

So, clearly having to do a bit of grovelling, I called my bank's telephone banking - not a problem, they mentioned the direct debit guarantee and just asked me to call the intermediary first. So I did. What did they suggest? Once they had confirmed that they had made an error, they would send me a cheque - 5 to 8 working days.

Admittedly the amount of money is not significant (to me, at this point in my life), the bank are happy it was somebody else's error, but this is simply not the way the system is supposed to work. The safety net put in place has not functioned. This is another aspect of UK banking, amongst many, that the normal public need to be extremely wary of.

S-E

Oh, and I have, now, cancelled that direct debit.

2-Factor Security for UK Online Banking

A wee birdy tells me that a major UK bank is nearly ready to begin (I know, lots of hedging in there - maybe it was a dunnock) rolling out its EMV card-based 2-factor solution for online banking.

This will provide strong cryptographic security that a person with the customer's card and knowledge of their password was involved in authorising the transaction - so preventing session hijacking. I got a small play with the beta version (as part of a customer usability trial) and it seemed to work reasonably well at providing you with enough information to prevent transaction hijacking (one of the difficulties here as compared to traditional challenge - response systems.) Hopefully, you will at least be given the option to use this for log-on (I do not believe that you will be required to do that.)

Of course, this provides no protection against data leakage from transactions proxied through a man-in-the-middle site or recorded by malware infection of the workstation you are using but it is a damn good start.

More when I get my kit, assuming I am in one of the "early-adopter" pools.

S-E

Go Light Blue !

Read the article, watch (or record & watch) the programme, (internet link here Amendment - thanks to Youtube rather than the BBC - well done Web2.0, piss-poor from the public service broadcaster).

Then discuss.

Interestingly, this closely connected to the reason why (apart from the hideous cost) UK banks have yet to roll-out strong crypto devices for online banking. (The challenge / response mechanism needs to incorporate enough details of the transaction being authenticated to prevent the transaction being hijacked by a man-in-the-middle fraudster. Especially where you need a human to recognise the details, as in the online banking context, this is harder than it sounds.)

S-E

And what, precisely, is this "pharming" stuff?

This summary is not available. Please click here to view the post.

Bill and Ben discuss PCI-DSS V1.1

(Okay, I’ll apologise to the purists, but I am a bit young to have watched the cartoon, so all oddle-poddle errors are mine.)

Bill: Isn’t it great new that after 31st December everyone will have to use the new Version 1.1 of the Payment Card Industry Data Security Standards? (WARNING - irritating American legalese click-through required.) It will be a real improvement in security at online retailers and it should help reduce the massive spate of data leakage incidents (although not as much as wide-spread laptop encryption.)

Ben: Flob’a’lob’a’dob

Bill: Surely not?

Ben: Flob’a’lob’a’lob a’dob’a’dob

Bill: No, you’ve got to show me some evidence. This cannot just be a cynical arse-covering attempt by the Cards Schemes based on dodgy security principles and poorly thought out practices.

Ben: Lob’a’flob

Bill: Surely not – You mean that with the vast majority of (hacker) attacks occurring in the application space, there is no requirement for comprehensive pre-production application level pen-testing? What about 11.3.2?

Ben: Flob’a’dob

Bill: Oh I see: “significant … application upgrade or modification” and then all the examples they give are for infrastructure changes. Yes, and I do remember that it is often the small or emergency changes, that will have been through less QA, that cause issues.

Ben: Lob’a’flob’a’dob.

Bill: I didn’t know that. You mean that the Cards Schemes are considering the forensic recovery from disk of CCV2 values associated with PANs as fully probative evidence of a breach of 3.2.2? Haven’t they ever heard of asynchronous comms? Oh well, have you seen Weed anywhere?

What Bill is hinting at, here, is the weird contradiction between the requirement of 3.2.2 and the requirement to actually authenticate the transaction: at some point all of the transaction data captured is going to be assembled, encrypted and sent, by a normal asynchronous comms method, to the acquiring bank or financial institution. It will be kept in, probably in memory, until the accept / deny message (and the authorisation code) comes back. The computer is likely to suspend the relevant process / thread and there is a chance that this will mean that the memory is paged onto disk storage. Ergo, unless there is a requirement for the assembly to take place in a Hardware Security Module (expensive, and introduce security management issues of their own), any computer which is regularly used to process cards transactions is likely to have, somewhere on disk storage that was once used as virtual memory, multiple instances all of the sensitive card and transaction data. Without any intent to breach Section 3.2 or even with good technical and procedural measures to comply with it.

Sometimes, my job just makes me cry. Oh, and a little birdie told me that the auditing practices are so rigid for this standard that nearly no company can pass 1st time round, so it is another great money-spinner (and reputation killer) for the information security industry.

Ho hum. It's the weekend and Scotland really shouldn't lose at the rugby tomorrow. :)

The Evils or Otherwise of Chip and Pin ...

That's what I get for going to London for a couple of days :( As any fule kno, the Devil's published a bit about some of the intricacies of the cards networks: The Devil's Kitchen: ChipPin' away at fraud. Read it there, including the comments but I posted a bit in response:

If the terminal has not been modified to record your PIN (which should stop it working, but some crims are clever):

When you conduct a transaction, you enter your PIN and this unlocks the card, allowing the card to do a "challenge / response" authentication with the bank (or, if you are below the floor limit in the shop, just saying "I'm unlocked" to the retailers terminal, which then just does the transaction ignoring the rest of this paragraph.) On most machines, you see "PIN OK" or something similar. The bank and the retailers terminal then do a little dance to determine whether you have enough credit / cash, whether your card has (correctly or otherwise) been reported stolen etc, etc. If the bank says "yes", you get your goods, the retailer's terminal gets an auth code and off you go. The retailer can then modify the transaction - look at this in hotels:

You go in, they make a reservation against your card, which you have authenticated with your PIN. When you check out, they get your signature on your bill (which, unless you have been a real pig, is less than the reservation) - they don't need your card in most cases, they really don't need your PIN. (If they ask for them, they are not necessarily defrauding you, but they are doing a new transaction. The reservation will remain against your credit limit until it times out or they cancel it or you complain bitterly to your card company.

I appreciate people's concern, especially scotstoryb, but the systems as currently engineered to allow for amendments , as far as I am aware this is a function of the electronic tills rather than C&P - what would be interesting to know is whether or not this now makes it a CNP transaction (retailer liable) if they make a deliberate (or otherwise) error ...

The HBOS retail person was wrong - they have the bank auth code, they don't have your PIN. (This doesn't detract from the various comments about the relative weakness of Static Data Authentication as opposed to Dynamic Data Authentication C&P cards - see www.lightbluetouchpaper.org.)

Now, if as in the earlier Shell case, somebody has modified the terminals, especially where you have handed your card over and it has been "swiped and docked" - as per Tescos - they have your PIN and they have the mag-stripe data. Not enough to clone your chip but enough to create a mag-stripe only card and use it where either they don't do C&P or where the machines will "fall-back" to mag-stripe. The intent was for you to personally place it in the short terminal (therefore preventing the swipe either in a Tesco's style till or swiftly through a stripe copier).

Okay - but why Chip and Pin - it is relatively easy. Much credit card fraud was conducted with "cloned" cards - mag stripe reader/writers are cheap, ISO standard card blanks are readily available, and the more organised fraudsters can produce very good looking fake cards. ATM skimming gave them your PIN as well - and it is much safer to get money from an ATM than to buy goods - and you have cash immediately. Also, for those really interested, until the new Fraud Act, there was always the issue with the crime of deception that it required you to deceive a human, a machine didn't count.

Chip and PIN was designed to make cloning cards (much, much) more difficult. In order to prevent all the fraud transferring to stolen (but not yet reported as such) cards, you also have your PIN, which (read the small print) only you should know, so your card gets unlocked as described above, before it works.

However, there are, as ever in life, a few complications:

1. The type of smart-card chosen was the SDA rather than the DDA card - this makes it open to PIN capture attacks using modified terminals - see Mike Bond's Cambridge article here. As far as I am aware (and I was nowhere near the decision-making process), the decision to use SDA was taken because of the then cost of the DDA compatible terminals. I suspect that a few bank execs are now re-considering this.
2. All of our lovely C&P cards still have mag-stripe on the back. This means that if somebody swipes your card, either 'cause they are not yet C&P merchants, 'cause they capture your details for their MI purposes (e.g. Tesco - but they do this, already having swiped my Clubcard - so their computer already knows who I, or my wife, are - still stops them having to train the staff for dealing with "options", I suppose), or because they are collecting data for fraudulent purposes, they can still make a fake mag-stripe card. If they have buggered the terminal (or have a camera, or are just watching you), they have your PIN as well, so can use the card in swipe and PIN scenarios, such as ATMs. I wasn't aware that this was a cards scheme requirement - in the fuss following this press release, I heard an APACS spokes-weasel (may have been Sandra) say on BBC radio that Mastercard and Visa rules meant that we could not have chip without stripe cards. With Maestro having supplanted Switch, we can't even do it for debit cards :(
3. Many UK devices (especially ATMs) were configured to do "fall-back" - if they couldn't read the chip (or there was no chip) they would just use the mag-stripe data.
   
4. C&P was a UK thing, therefore all you need to do is take your fake cards abroad ...
   

So, looking at the APACS figures, C&P seems to have done most of what it was intended to do. The fraudsters may have migrated more quickly to other methods, the terminal security - tamper evidence (if opened, it would not longer work) - appears to be weaker for some designs than it should have been, and, as was well known, SDA is not a perfect (there is no such thing) solution.