I'm inclined to agree. I was checking my bank account on my phone yesterday and the office Wifi was having an off day. So I disconnected the wifi and proceeded to try to login over 4g. I got locked out of my account for 10 minutes because that is suspicious. After checking my account I couldn't find a payment I was expecting to see so I opened my account on my laptop and got locked out for another 10 minutes. Sounds like the dumbest IP checking to me, not some super clever heuristic based check.

It's that assumption, literally: if the attacker had managed to steal your session information from the browser, then they would not be able to use it since they would also need to share my IP.

In real life if the attacker is capable of stealing my session credentials the chance of them _not_ being able to tunnel through my local network is infinitesimal.

The thing is though, what they seemed to object to was trying to login (not using the same session cookie) across different IP addresses. At least that was the case when I opened the site on my laptop. Maybe my phone did login on the dodgy wifi and then when I reconnected via the 4g it tried to use that session, perhaps causing my account to be flagged. I'm not really convinced though.

It clearly makes sense to tie the session to the IP address but the 10 minute delay doesn't make much sense to me.

> It clearly makes sense to tie the session to the IP address...

At one point that might have been true but not any more. Mobile devices are the norm, and handoffs between cell towers and WiFi access points are handled transparently without any user interaction. Consequently, people expect their sessions to continue working despite changes in their IP address. Use TLS connections and set expiration times on the session cookies, but ignore the source IP address.

Your IP doesn't change per tower transition, your data from the tower goes through more centralized servers. For example my IP sitting physically in RTP in North Carolina is actually exiting AT&Ts network in Atlanta, Georgia.

For clean handoffs within the same network, sure. But you also have roaming to consider, and the device may lose its connection temporarily and be assigned a new address when it returns.

Is there actually any advantage to having a dynamic pool of IP addresses like this? Associating a number from your IP block to a subscriber number seems far, far simpler and better.

Locality/size of routing tables. If you had a hundred million subscribers with fixed IP addresses moving all over the country, you essentially could not aggregate any routes, but would have to have a hundred million routes in your routing table, and/or you would have to push all the traffic from and to all subscribers through one central router, which in particular would add latency for any subscribers that currenty are at the other end of the country.

If you’re suggesting each subscriber gets a static IP then that’s much worse for privacy.

I'm speaking from the provider's point of view: they don't care about privacy. In fact, in the US there is a federal law that requires them to be able to associate network activity with a subscriber at the request of law enforcement.

Your cellular traffic is proxied in most cases, and how carriers present it varies.

>In real life if the attacker is capable of stealing my session credentials the chance of them _not_ being able to tunnel through my local network is infinitesimal.

In real life each "trivial" filter like this cuts down a substantial number of potential attackers. Defense in depth. When there's a ton of hoops to jump through attackers go find a different target.

Nah, in real life it constantly batters the system administrators with unnecessary alarms who then stop taking them as seriously as they should be if they were actual attacks.

I mentioned signals in another comment in this chain and this is a scenario (for banking specifically) where it makes 100% x 100% sense to kill the session for the client's security.

Like kill it totally totally dead!

Unlike other apps, with online banking, the priority is not to keep you connected.

It is to ensure the person carrying out the activity is whom they really say they are and that it is OK for them to do what they are doing with your account

The security posture is "deny" by default and allow if we can verify this person is whom they say they are.

Think about the signals here:

- connection has changed (from wifi to 4g - that gives you a whole bunch of IP, ISP, routing (hops) etc stuff )

- there is a proxy in the chain now (it is possible to identify the hop from phone to laptop)

- view port is still the same (connection is not the user on their phone, they are on their laptop, connected to a phone)

... then the same thing happens all over again but in reverse when you went back to the laptop.

The bank has no idea whether the proxy is a real phone or a MTM intercept especially since the connection did not initiate from that device but switched in flight.

Would totally have required killing the session if I was responsible for defining scenarios here.

> Yes. I assure you that when bad guys with your username and password log in and steal all your money the bank _won't_ say: "Doh, our sophisticated environment, behavioural and heuristic patterns used to establish legitimacy let you down this time. We'll pay for this" No, they'll say it is your fault because the bad guys had your username and password.

If your bank treats you this way, you should contact the relevant government authorities.

In the US that's the FDIC: https://www.fdic.gov/consumers/questions/consumer/complaint....

In the UK that's the FOS: https://www.financial-ombudsman.org.uk/contact/index.html

My own experience is that the bank fixes the account balance while I'm still on the phone with them so I'm not inconvenienced, does an investigation, and then decides whether it was actually me that did the transfer over the next few weeks.

In the 1990s, someone sent a fax to Chase with instructions to wire $25,000 out of my dad's bank account. When we discovered it was missing, they found the fax and realized that it wasn't my dad's signature and his name was misspelled. Chase put $25,000 back into my dad's bank account within about 2 weeks.

So yes, they will pay for it.

Two weeks seems like an unreasonably long time to be missing $25,000. If my bank took that long to repay me that much money, I would probably switch banks.

My Nans will was held up because she spelt my Uncles (her son) first and last name wrong. Professionally I've seen various other equally stupid errors over equally important things many times.

So I feel for Chase in this situation, I'm not suggesting they shouldn't have paid out.

On the other hand I log into my bank with my computer using the same browser as always and my username and password, but this time I'm in a different country. Even just a different Wi-Fi (like at a coffee shop)

And the bank _freaks out_. Omg omg omg hacking hacking! Quick to the 2FA mobile! Should we call you? Can we text you? Do you prefer email?

That's before we even get into how trigger happy they are about credit cards being used in weird ways. You buy one thing out of the ordinary (like a $3000 downpayment for a motorcycle) and immediately get 5 texts, 10 emails, and 2 phone calls. YO did you do that?

Or the one time my girlfriend deposited a physical cheque and it was so out of the ordinary the bank had a melt down and started shutting down all her accounts and blacklisting her from the bank.

I don't know about "sophisticated", but they definitely do something.

You really want to work yourself into a frenzy about minor inconveniences, huh? You’re so hyperbolic here that you sound like you’re basically making stuff up.

> You buy one thing out of the ordinary (like a $3000 downpayment for a motorcycle) and immediately get 5 texts, 10 emails, and 2 phone calls. YO did you do that?

First, dropping 3 grand at a motorcycle dealership is extremely out of the ordinary for most people. Second, my money says you got exactly one text, one email, and either one or zero calls. It makes perfect sense that they’d want to do the fraud check here. It also makes sense that they’d use multiple means of contact to reach you quickly.

As for the girlfriend blacklisting story, I don’t know if you’ve just horribly mangled this story or what. It doesn’t make sense. If you deposit a check, there is no potential fraudulent withdrawal from your account. Also, a bank cannot randomly close your accounts and “blacklist” you. They are holding your money. Stealing money from your depositors is generally frowned upon from a regulatory standpoint.

Yes it’s obviously hyperbole. My point was that banks do have security practices in place that go beyond weird password rules.

The girlfriend story unfortunately did happen. The part I left out was that the cheque bounced despite being from a reputable company – most likely an HR system glitch. This leaves the bank with 2 options: This person is doing something shady, or the big company that successfully pays thousands of cheques per day is being shady.

Guess which one the machine learning algos say is more likely :)

PS: when you sign the back of a cheque you become legally liable for that cheque not bouncing. If it does bounce, the law says you are committing fraud. The bank is therefore within their right to stop all service (they do send you your money back after killing your accounts)

That was a fun lesson to learn

I didn't understand the gist of the GP to criticize bank actions, but wanting to point out that banks do indeed have alarm systems in place beyond simple IP-change rules.

Some do. Many do not.

Sometimes they make mistakes. My wife once went to the bank office to make some operation and they unexpectedly asked a "security question" about her father's given name - something they don't usually do (the standard practice is to ask for one's mother's maiden name). She gave the answer and they rejected it, and immediately locked down access to her account without her realizing it. She only found out when she couldn't log in to the on-line interface at home. Angry phone calls were made and situation was restored, but it took a day or two and was pretty stressful.

Speaking of countries, it might be worth it to let the bank know if you're going somewhere atypical. Before my work trip to China, I phoned the bank and told them I'm gonna be there from this to this date, and didn't have any problems with accessing my account (modulo one branch of ATMs not cooperating with my card).

At least they contact you these days. I remember my cards getting locked every Christmas and every time I went overseas due to "unusual spending patterns". Yes, it's Christmas. Yes, I am overseas, I bought the airline tickets with your card.

The airline charge won't tell them where you are going... My banks have an online tool to inform them of travel plans.

Sure, but back then it was an expensive international phone call to be on hold for 15 minutes and then talk to a person who said: your card was used overseas, looked suspicious.

They are costing me money to protect themselves.

A good heuristic might be that I spent 2000AUD on Qantas a couple of months ago.

And yeah, their ads showed people on the other side of the world using their cards. No mention of this sort of stuff.

I’m not sure that’s true. My credit card statements usually show the route (and maybe the date; I don’t recall) for airfare purchases. The format the statements use has led me to believe it’s more than the airline stuffing that data in the generic string that all transactions have.

Honestly, I'd rather my bank be too quick to notify me of weird activity and ask for my approval than the opposite. At the very least, it lets me know that they are paying attention. If someone were to steal from my bank account, I'd rather find out about it from the bank than when I next try to make a purchase.

>And the bank _freaks out_. Omg omg omg hacking hacking! Quick to the 2FA mobile! Should we call you? Can we text you? Do you prefer email?

That seems like a melodramatic way to say they asked you to authenticate by a second factor, which my banks do on any unregistered device.

>No, they'll say it is your fault because the bad guys had your username and password.

This sort of claim requires evidence. Many people have had money fraudulently taken out of their accounts, so there is a wealth of experiences to draw from out there. Lots of people are getting hacked via credential stuffing due to password reuse. If the normal response from banks were to blame the customer, everyone would be talking about it.

Right. I've heard what actually happens is the bank does an investigation (which obviously costs them). One thing they'll want to figure out is if the account holder is trying to defraud them.

During this investigation the money is not available. And they do not guarantee it will be over quickly. This could result in all kinds of unpleasantness, including eviction, repossession, etc.

I don't think gullibility is the issue here. Really it's liability. Don't think for one second that Troy wouldn't get his pants sued off for any number of these banks for poo pooing their security. They certainly have the money to do it with.

I don't think it's gullibility, but I doubt that it's liability, either.

Why would the banks give a moment's thought to what Troy thinks about their security?

Even if he went on national TV telling everyone that this is terrible, they would just roll out their normal "While we appreciate the feedback, we are confident that our systems are secure" line.

The vast majority of people don't know who Troy is, they don't have any understanding of IT Security, and having some random computer guy rave about bank security is going to mean nothing to them. The few that might be marginally concerned over hearing it are almost certainly going to be persuaded by the bank's IT Suit that's rolled out to deliver the line.