News for hackers. Stuff that matters.
Re:The xz backdoor thing reminds me of a story by astrange on Sunday March 31, 2024 @06:09PM (#39888522)
You don't have to give your employer a bank account number, but they still have to pay you.

Quite unusual for a tech contractor though.

Re:The xz backdoor thing reminds me of a story by magicalhippo on Sunday March 31, 2024 @06:39PM (#39888788)
> You don't have to give your employer a bank account number

As a Norwegian that sounds so alien. They couldn't do anything but deposit money, so why wouldn't you?

Re:The xz backdoor thing reminds me of a story by jmb99 on Sunday March 31, 2024 @07:19PM (#39889147)
At least in Canada, the numbers provided for direct deposit are the same numbers used for direct/pre-authorized debit (i.e. withdrawals). So, while your employer likely wouldn’t abuse that information? People may be wary of giving out those numbers unless absolutely necessary, since someone could indeed drain their bank account. They’re also the same numbers that appear on cheques, so someone could easily forge a cheque in your name with those numbers.
Re:The xz backdoor thing reminds me of a story by magicalhippo on Sunday March 31, 2024 @07:54PM (#39889422)
> the numbers provided for direct deposit are the same numbers used for direct/pre-authorized debit (i.e. withdrawals)

Reading up on that, it seems similar in nature to our AvtaleGiro[1]. While indeed having my account number would allow a business to issue a AvtaleGiro request, it's just a request. I would then have to go to my (online) bank and approve it, including setting up a monthly withdrawal limit. So it can't happen without action on my part.

> They’re also the same numbers that appear on cheques, so someone could easily forge a cheque in your name with those numbers.

Cheques I don't know about because they were going the way of the Dodo even when I was young, but we did have BrevGiro[2] which was a way to transfer money. However it relied on the bank sending me serialized pre-filled forms, so someone would have to steal one of those as well to be able to withdraw money from my account.

[1]: https://no.wikipedia.org/wiki/AvtaleGiro

[2]: https://no.wikipedia.org/wiki/Brevgiro

Re:The xz backdoor thing reminds me of a story by jmb99 on Sunday March 31, 2024 @10:43PM (#39890404)
That’s the biggest difference - here there isn’t a request, the money’s just gone. I can of course go through the process of calling my bank, filing a fraud claim, waiting 6-8 weeks and then hopefully getting my money back, but that’s not particularly ideal. Especially since lots (most?) of the population is living paycheck to paycheck, and all that they have is probably sitting in the same bank account that they receive said paycheck in.
Re:The xz backdoor thing reminds me of a story by astrange on Monday April 01, 2024 @02:10AM (#39891319)
The median US household has $8k in checking+savings accounts, three months of expenses saved, and a net worth of $193k and therefore is probably not "living paycheck to paycheck" in the sense you meant. Also, "living paycheck to paycheck" is a made up status with no clear definition, invented by payday loan companies for lobbying purposes.

However, many Americans do say on surveys that they are doing it. This happens even if they say their income is $200k/year. The likely explanation for this is that nobody knows what it means and are answering something like "if I missed a paycheck I'd feel bad about it".

https://twitter.com/besttrousers/status/1753260817389162516

A funny thing that happens with this discourse is that it comes up all the time, and every single time a hundred people reply those numbers are a trick because of outlier rich people, and then it turns out none of them know what a median is.

Re:The xz backdoor thing reminds me of a story by kortilla on Sunday March 31, 2024 @06:48PM (#39888881)
Apart from the paper trail side of it, some people just really hate banks and don’t have an account.
Re:The xz backdoor thing reminds me of a story by xorcist on Sunday March 31, 2024 @06:53PM (#39888928)
I really hate banks, but I hate not being paid even more.
Re:The xz backdoor thing reminds me of a story by rad_gruchalski on Monday April 01, 2024 @05:29AM (#39892239)
One can get paid with cash. That’s the point of cash. No need for a bank. But don’t worry, the bureaucrat comes for that too.
Re:The xz backdoor thing reminds me of a story by alwayslikethis on Sunday March 31, 2024 @07:36PM (#39889298)
In the US, I'm fairly sure your bank account number (routing and account) can be used to withdraw money.
Re:The xz backdoor thing reminds me of a story by forrestthewoods on Sunday March 31, 2024 @06:45PM (#39888844)
Because you’re trying to plant backdoors you don’t want any paper trail?

Almost everyone does direct deposit. But it’s not a legal requirement for an employee to be paid that way.

Re:The xz backdoor thing reminds me of a story by magicalhippo on Sunday March 31, 2024 @08:05PM (#39889476)
> Because you’re trying to plant backdoors you don’t want any paper trail?

Good point, good point...

I went to check, and it seems we've just recently plugged[1] that hole here in Norway. Salary and other benefits must be paid to a bank account now.

[1]: https://www.gpokonomi.no/2022/01/26/forbud-mot-kontant-utbet...

Re:The xz backdoor thing reminds me of a story by hobobaggins on Sunday March 31, 2024 @08:46PM (#39889709)
why is that a hole?
Re:The xz backdoor thing reminds me of a story by cynix on Monday April 01, 2024 @01:05AM (#39891080)
> why is that a hole?

Presumably to avoid this:

> Because you’re trying to plant backdoors you don’t want any paper trail?

Re:The xz backdoor thing reminds me of a story by jeffbee on Sunday March 31, 2024 @07:20PM (#39889155)
In America they can and do also take money out of your account, to correct errors supposedly, but sometimes also in error. I still get paid on paper to this day because to me the terms of the direct deposit agreement are overbroad.
Re:The xz backdoor thing reminds me of a story by zanderwohl on Sunday March 31, 2024 @06:55PM (#39888950)
Sorry, what does being Norwegian have to do with it? Going to the physical bank with a physical check seems like too many steps no matter what country you're from.
Re:The xz backdoor thing reminds me of a story by magicalhippo on Sunday March 31, 2024 @07:56PM (#39889434)
I don't assume banks work the same everywhere. Perhaps there's a good reason that I don't know about. Hence my question.
Re:The xz backdoor thing reminds me of a story by indrora on Monday April 01, 2024 @04:48AM (#39891993)
In the US, if you know someone's routing/bank number, name, and address, you can write cheques in their name.

There's companies that make their money on selling (now, usually older folk) literal books of cheques. One of the ways you can pay is literally for them to write themselves a cheque from "you" that gets processed digitally.

The US is a strange banking system wherein I have had the unpleasant experience of putting my card into the reader at a 7-11 and it just... Not work. Why? Nobody knows. ApplePay sometimes works -- some readers know how to handle it, others lose their shit and crash.

Re:The xz backdoor thing reminds me of a story by noduerme on Sunday March 31, 2024 @07:05PM (#39889038)
I'm a tech contractor. I prefer payment by check from my clients. Most can't or don't want to set up direct deposit for a part time contractor. Amounts are too large for Zelle, and I don't want to pay the fees for paypal or credit card processing if I can avoid it.

My clients usually issue paper checks online. Their bank prints the check and mails it. My receiving address is my bank, which deposits checks for me when they arrive.

Re:The xz backdoor thing reminds me of a story by jabiko on Sunday March 31, 2024 @07:13PM (#39889095)
Maybe I'm a bit to naive since I don't know the US banking system, but at least in the EU you just need to tell someone your IBAN and Name and they can transfer money to your account. Is it that much harder in the US?
Re:The xz backdoor thing reminds me of a story by toast0 on Sunday March 31, 2024 @10:16PM (#39890261)
There's a couple things going on in the US, IMHO.

Yes, you can get wire transfers or ACH at most banks with a routing number and account number. But wire transfers usually cost money to send, and sometimes cost money to get. Generalized ACH transfers usually come through a service provider, and that costs money too.

Also, the same numbers can be used to credit and debit an account, and also to forge checks. So giving your payment credentials (or writing a check) is a security risk. I'm a little fuzzy on details, but someone at my employer at the time (Facebook) had my payroll data on a device in a laptop bag that got stolen in San Francisco, and as a result I had to be hyper vigilant on checking for unauthorized transactions (or get a new account number, but that's more disruptive, assuming the theft was just normal SF theft, like it probably was)

Re:The xz backdoor thing reminds me of a story by nikita_789 on Monday April 01, 2024 @11:48AM (#39895449)
it is much easier to use Arbonum, which is a payment system that works all over the world
Re:The xz backdoor thing reminds me of a story by eddd-ddde on Sunday March 31, 2024 @07:08PM (#39889058)
That is so weird. What is there to set-up about deposit? Can't they just input your account number and send you your money?
Re:The xz backdoor thing reminds me of a story by skywhopper on Sunday March 31, 2024 @07:13PM (#39889092)
It’s even easier to do it the way described. The banks are printing and mailing and processing the checks, which they can do with high efficiency. From the payor’s pov, it’s easier not to worry about tracking account numbers and just using the address which they already know.

And the payee doesn’t need to share their bank info.

Re:The xz backdoor thing reminds me of a story by eddd-ddde on Sunday March 31, 2024 @07:18PM (#39889135)
Surely a check takes longer, right? "Printing, mailing and processing" doesn't quite scream efficiency to me.
Re:The xz backdoor thing reminds me of a story by eszed on Sunday March 31, 2024 @09:45PM (#39890092)
It does. The US banking system is still predicated on paper checks, however, and efforts to change that face considerable inertia. There have been posts on HN explaining how (insanely) it all works.
Re:The xz backdoor thing reminds me of a story by cayde on Monday April 01, 2024 @03:15PM (#39897974)
ACH takes days to weeks to clear anyway, especially if new sender or large amounts = untrusted. There is no real exception handling so you are given the amount on credit.

https://engineering.gusto.com/how-ach-works-a-developer-pers...

(From parent) > And the payee doesn’t need to share their bank info.

And this is a US concept where having the magic numbers lets you pull any amount you want, with no ability to have a "push only" number...

Re:The xz backdoor thing reminds me of a story by drexlspivey on Sunday March 31, 2024 @09:12PM (#39889900)
> From the payor’s pov, it’s easier not to worry about tracking account numbers and just using the address which they already know.

The account number is on the invoice..