News for hackers. Stuff that matters.
Re:The xz backdoor thing reminds me of a story by magicalhippo on Sunday March 31, 2024 @06:39PM (#39888788)
> You don't have to give your employer a bank account number

As a Norwegian that sounds so alien. They couldn't do anything but deposit money, so why wouldn't you?

Re:The xz backdoor thing reminds me of a story by jmb99 on Sunday March 31, 2024 @07:19PM (#39889147)
At least in Canada, the numbers provided for direct deposit are the same numbers used for direct/pre-authorized debit (i.e. withdrawals). So, while your employer likely wouldn’t abuse that information? People may be wary of giving out those numbers unless absolutely necessary, since someone could indeed drain their bank account. They’re also the same numbers that appear on cheques, so someone could easily forge a cheque in your name with those numbers.
Re:The xz backdoor thing reminds me of a story by magicalhippo on Sunday March 31, 2024 @07:54PM (#39889422)
> the numbers provided for direct deposit are the same numbers used for direct/pre-authorized debit (i.e. withdrawals)

Reading up on that, it seems similar in nature to our AvtaleGiro[1]. While indeed having my account number would allow a business to issue a AvtaleGiro request, it's just a request. I would then have to go to my (online) bank and approve it, including setting up a monthly withdrawal limit. So it can't happen without action on my part.

> They’re also the same numbers that appear on cheques, so someone could easily forge a cheque in your name with those numbers.

Cheques I don't know about because they were going the way of the Dodo even when I was young, but we did have BrevGiro[2] which was a way to transfer money. However it relied on the bank sending me serialized pre-filled forms, so someone would have to steal one of those as well to be able to withdraw money from my account.

[1]: https://no.wikipedia.org/wiki/AvtaleGiro

[2]: https://no.wikipedia.org/wiki/Brevgiro

Re:The xz backdoor thing reminds me of a story by jmb99 on Sunday March 31, 2024 @10:43PM (#39890404)
That’s the biggest difference - here there isn’t a request, the money’s just gone. I can of course go through the process of calling my bank, filing a fraud claim, waiting 6-8 weeks and then hopefully getting my money back, but that’s not particularly ideal. Especially since lots (most?) of the population is living paycheck to paycheck, and all that they have is probably sitting in the same bank account that they receive said paycheck in.
Re:The xz backdoor thing reminds me of a story by astrange on Monday April 01, 2024 @02:10AM (#39891319)
The median US household has $8k in checking+savings accounts, three months of expenses saved, and a net worth of $193k and therefore is probably not "living paycheck to paycheck" in the sense you meant. Also, "living paycheck to paycheck" is a made up status with no clear definition, invented by payday loan companies for lobbying purposes.

However, many Americans do say on surveys that they are doing it. This happens even if they say their income is $200k/year. The likely explanation for this is that nobody knows what it means and are answering something like "if I missed a paycheck I'd feel bad about it".

https://twitter.com/besttrousers/status/1753260817389162516

A funny thing that happens with this discourse is that it comes up all the time, and every single time a hundred people reply those numbers are a trick because of outlier rich people, and then it turns out none of them know what a median is.

Re:The xz backdoor thing reminds me of a story by kortilla on Sunday March 31, 2024 @06:48PM (#39888881)
Apart from the paper trail side of it, some people just really hate banks and don’t have an account.
Re:The xz backdoor thing reminds me of a story by xorcist on Sunday March 31, 2024 @06:53PM (#39888928)
I really hate banks, but I hate not being paid even more.
Re:The xz backdoor thing reminds me of a story by rad_gruchalski on Monday April 01, 2024 @05:29AM (#39892239)
One can get paid with cash. That’s the point of cash. No need for a bank. But don’t worry, the bureaucrat comes for that too.
Re:The xz backdoor thing reminds me of a story by alwayslikethis on Sunday March 31, 2024 @07:36PM (#39889298)
In the US, I'm fairly sure your bank account number (routing and account) can be used to withdraw money.
Re:The xz backdoor thing reminds me of a story by forrestthewoods on Sunday March 31, 2024 @06:45PM (#39888844)
Because you’re trying to plant backdoors you don’t want any paper trail?

Almost everyone does direct deposit. But it’s not a legal requirement for an employee to be paid that way.

Re:The xz backdoor thing reminds me of a story by magicalhippo on Sunday March 31, 2024 @08:05PM (#39889476)
> Because you’re trying to plant backdoors you don’t want any paper trail?

Good point, good point...

I went to check, and it seems we've just recently plugged[1] that hole here in Norway. Salary and other benefits must be paid to a bank account now.

[1]: https://www.gpokonomi.no/2022/01/26/forbud-mot-kontant-utbet...

Re:The xz backdoor thing reminds me of a story by hobobaggins on Sunday March 31, 2024 @08:46PM (#39889709)
why is that a hole?
Re:The xz backdoor thing reminds me of a story by cynix on Monday April 01, 2024 @01:05AM (#39891080)
> why is that a hole?

Presumably to avoid this:

> Because you’re trying to plant backdoors you don’t want any paper trail?

Re:The xz backdoor thing reminds me of a story by jeffbee on Sunday March 31, 2024 @07:20PM (#39889155)
In America they can and do also take money out of your account, to correct errors supposedly, but sometimes also in error. I still get paid on paper to this day because to me the terms of the direct deposit agreement are overbroad.
Re:The xz backdoor thing reminds me of a story by zanderwohl on Sunday March 31, 2024 @06:55PM (#39888950)
Sorry, what does being Norwegian have to do with it? Going to the physical bank with a physical check seems like too many steps no matter what country you're from.
Re:The xz backdoor thing reminds me of a story by magicalhippo on Sunday March 31, 2024 @07:56PM (#39889434)
I don't assume banks work the same everywhere. Perhaps there's a good reason that I don't know about. Hence my question.
Re:The xz backdoor thing reminds me of a story by indrora on Monday April 01, 2024 @04:48AM (#39891993)
In the US, if you know someone's routing/bank number, name, and address, you can write cheques in their name.

There's companies that make their money on selling (now, usually older folk) literal books of cheques. One of the ways you can pay is literally for them to write themselves a cheque from "you" that gets processed digitally.

The US is a strange banking system wherein I have had the unpleasant experience of putting my card into the reader at a 7-11 and it just... Not work. Why? Nobody knows. ApplePay sometimes works -- some readers know how to handle it, others lose their shit and crash.