There is a flip side to that. You ever hear of an actual customer losing their money in one of these attacks on banks?
It's all about the cost of doing vs. the cost of fixing it and who ends up paying.
We do, you just don't hear about it because "we're in it together" and it's not really anyone's specific money being stolen. And banks profit so much, it's just a small dent in their profits. And these security costs and investigation is paid by society, not the banks.
You're right, but you're talking about application security, not the security of the infrastructure itself. For most endeavours, it's enough to have a securely written app hosted in an average data centre. When you're looking after currency, there's so much more incentive for people to break in, and you have to put some extra resources into securing your infrastructure too. By the sounds of it Bitcoinica has completely neglected to do this and has been operating as if they were just a startup storing my cat pictures on S3.
Very true, the difference is banks will give you back your money after you're/they're hacked.
In fairness to Bitcoinica, they've promised to do this:
> The thief stole from us not you.
> All withdrawal requests will be honored.
> http://www.bitcoinica.com/I have not seen an online banking without two factor auth though.
I assume you are not in America? PNC, M&T, and TD all do not have two factor auth. (That I've seen.)
Yes, Europe. Maybe there are different laws? Some decade ago you used to get plastic card with grid of passwords. Now it's usually SMS verification for every transaction (and sometimes for login).
Well up here in Canada I have never seen a bank with two factor auth. I would love to switch to one.
Instead we get online banking with password restrictions like: 1. 8 to 12 chars 2. No non-alphanumerics.
In Denmark its illegal for a bank not to use two factor auth.
It's pretty common for commercial banking... which is good because in the US the laws protecting you from loss due to hacking are much weaker for a corporate account.
Seriously, the banking industry is hardly a paragon of security. Many startups give you better ways to protect your cat pictures than the average bank gives you to protect your money.