Click. Connect. Communicate.

Kill the Password: Why a String of Characters Can't Protect Us Anymore

This summer I learned how to get into, well, everything. With two minutes and $4 to spend at a sketchy foreign website, I could report back with your credit card, phone, and Social Security numbers and your home address. Allow me five minutes more and I could be inside your accounts for, say, Amazon, Best Buy, Hulu, Microsoft, and Netflix. With yet 10 more, I could take over your AT&T, Comcast, and Verizon. Give me 20—total—and I own your PayPal. Some of those security holes are plugged now. But not all, and new ones are discovered every day.

Mat Honan, whose entire digital life was picked apart by hackers, has some thoughts on password security, fighting the last war, and what we can do to make it better.

[Full article at Wired.com]

Security and Privacy Plague Mobile Web's Forward Motion

A new article from eMarketer examines concerns that consumers have expressed about mobile - chief among them, privacy and security. 

by Jimmy Marks

It used to be that "The Internet" was something you used in your home. You had to have a computer connected to the web via cable. Then came the idea that the Internet was a practical business tool - email revolutionizes communication! High-speed Internet makes websites more robust! Wi-Fi is the new guard - the web without wires, in every Hotel, Airport, Starbucks and McDonald's in your neighborhood. 

Mobile is the latest wave on the shore. The same Internet that used to demand that we buy large tower CPUs and big monitors now only requires us to have a smartphone and our thumbs. But there's something troubling about that - it's the same Internet. Which means the same problems and the same fears. 

Take a look at this chart from eMarketer. There are concerns among smartphone users about apps that track their various patterns (you've already heard about the iPhone tracking issue to be sure). Smartphones and tablets emit and receive data - what does that data say about the user? Is the picture flattering? 

When it comes to moving your financial institution forward with mobile, how are you allaying concerns about security? Did you do a good job of getting your customers to trust your OLB and website? If not, try to recover the fumble for mobile - it could make or break you in the long run. 

 

Keeping an Eye on your Web Presence

by Ron Daly

With all the talk about growing your brand these days, managing reputation risk is becoming more important. Imagine there was a clause in the lease or deed of your branch that allowed someone to buy it out from under you and completely replace you. In minutes, your branch is gutted and replaced with a chop shop. Customers coming in to handle their business are baffled - the sign and location are the same, but why are these guys stealing our hubcaps? 

In real life, such incidents are unlikely. On the Internet, however, it can and does happen. Organizations and businesses let their URLs and domains lapse and they're snapped up by disreputable businesses and spammers. The Financial Brand pointed to a perfect example of how NOT to manage your online presence(s) in this recent post. TIAA-CREF let the domain rights to one of their special micro-sites lapse and the domain was bought out from under them by...well, just go read their article. It'll stun you. 

We've seen similar issues arise with folks who switch Twitter names or Facebook pages. They make the switch, a spammer takes over their old name and starts spamming their followers. It's remarkably easy to lose control of your domain names and your social media accounts. What's worse, the fact that the management of these accounts and URLs is inexpensive relative to how much it can cost you in customer dissatisfaction. 

I'm going to be very direct and lay it all out there for you: you need to have the day your URLs expire very clearly marked. The same is true of your hosting - one of the worst things is a site pulled down for non-payment simply because a check wasn't mailed or a credit card number changed. Your webmaster(s) should stay on top of these issues and should be able to tell you, on demand, when your renewal dates are. 

How do you avoid the TIAA-CREF issue the Financial Brand discussed in their post? One FB commenter has the right idea: 

Bonnie: 
July 14th, 2010 at 7:54 am

In some cases, maybe it would be better to create a page on your website, instead of creating a separate microsite with its own unrelated URL, for a temporary promotion.

Sane advice. A special domain for a special promotion can be effective, but you need to treat it with the same care as you would your day-to-day customer-facing website. 

Go find out when you need to renew your domains today. You'll be glad you did tomorrow. 

Social Finance - Is It Working?

by Jimmy Marks

Look at your watch. Let eight seconds go by. Boom - another social media consultant has just appeared and has come up with an article about how much impact social media has on people's finances. 

It's getting a little crazy. It seems like every time we turn around, we get one more guy saying that users of X social media site are Y% more likely to put their money in your credit union than any other human being alive. Whoops, another eight seconds went by, that's another guy yelling about how all those Facebook fans you have are the same as alternative capital!

Let's get serious for just a second. We've been talking social media for the last two posts (if you haven't read them, go do it). Come to think of it, we've been talking about social media for the last two YEARS. But we've never really taken the time to look at the impact "social finance" and whether or not there were numbers and trends you could count on when it comes to social media and online finance. 

America (Banking) Online

Louis Hernandez at Open Solutions wrote an article (It Takes a (Global) Village: How to Use Social Media - CUJournal, 4/19/10) about social media. Some interesting facts about deposit balances and social network users (most of which, it seems, were culled from a report by Raddon Financial Group): 

• MySpace users have the lowest amounts on average, with $11,891. 
• LinkedIn users has the most with $29,794
• Twitter users had $20,562 on average
• The average Facebook user has $19,339, but daily Facebook users average about $16,586. 

I found these numbers surprisingly high, given that we only started seeing a resurgence in savings in the past year-and-a-half or so. 

I differed to Ron (Daly, my boss), who said "Ask what the average amount is among people who want nothing to do with this stuff." He's betting it's going to be a lot more. Anybody got numbers, comment on this article and let us know. 

Other interesting numbers regarding getting financial advice via social:

• Only two percent of consumers have interacted with their FI while visiting a social networking site.
• Three percent would be interested in taking advice from a blog or SM site. 
• Only four percent said they had solicited advice about finance from a social media site. 

Two, three, and four percent? That's terrible. Is it because there are few FIs online and they're doing a bad job of social media, or is it that people aren't interested in "friending" B of A or their chief banking institution? (Yeah, B of A's Twitter has 7,000 followers, give or take, but I'm doubting all their followers are customers with issues, and with 53 million customers, you're looking at <.013% of customers being helped by their Twitter account.)

Some fresh perspective from Jeffry Pilcher's Financial Brand blog, which ran a "Datahead" article about online banking and social finance (his data's from Forbes, Mintel and ComScore to be clear): 

• 76% of online banking users have visited a branch in the past two months, while 68% have visited an ATM and 37% have called their call center. Mr. Hernandez's article says there's been a drop-off in branch visits even between '08 and '09, but 76% is still plenty high. 
• 75% of members/customers don't realize their bank/CU has online banking. Half of those that DO realize there's online banking USE online banking. That's 12.5% of consumers that are actively using OLB on average. But 87% of those are accessing OLB more than once per week.
• Half of all online banking users have mobile internet on their phone and less than half of those access their bank's services online from said phone - so, on average, about 23% of consumers are accessing their bank's site via mobile. 
• 65% of members wanted to get emails about their accounts(!) while only 8% wanted account updates via social media. 

On this evidence, I'm willing to make a few guesses about where social media fits in the big picture. 

1) Social media is good for ad hoc feedback, event coordination and notification, casual chat and (maybe) some selling. But most folks don't want advice from their social networks. And it's not specifically the networks, it's the people using said network. 

Think about it - do you want to talk about your Roth IRA or your Mortgage with the person who keeps sending you "Which Twilight Character Are YOU!?!?!?11?!" Quiz on Facebook? No, you don't. At least, I HOPE you don't. You trust a few people in this world to tell you what you should do with money, and that conversation doesn't have to happen in front of an audience of hundreds.

According to this article from eMarketer Daily, the number of people using social media is going to be growing to about 66% by 2014. Getting a foot in the door now is smart, given that the trend is increasing and the risk is relatively low, but expecting it to be "the fix" for your institution is unrealistic. People don't start a financial relationship with some bank or CU that they found on Facebook. They go find their bank on Facebook because they already have a relationship with them. 

People are loyal to a dependable product first, its associated brand second. Slap a member or customer with $200 worth of fees and all the social media in the world won't make a difference - they'll feel cheated and complain, and might even leave. Doesn't matter if they brought it on themselves -they're going to say it's your fault.

2) OLB, email and websites all need to be better. There's a reason you started offering online bill pay/banking, eStatements, eLerts and so on. It's because the more people are leaning on your online channel, the less they have to come all the way to the branch to deal with their money issues. Little things like transferring money between accounts and making payments are time sucks for a branch - let people work it out from home. 

Emails, eStatements and online notices are popular (it's why we exist), but we still have people who are on the fence about communicating with members via email. Why? What's stopping you? You don't have to put a ton of personal info into the thing and you aren't spamming anyone. "We might get phished," you say? Yeah, you might. But if you're actively engaging members with emails and getting them accustomed to what an email from you looks like, you're training them about what the real messages look like versus a fake one. Come on, people, it's 2010. "I'm scared of email" stopped being a valid excuse in 1998. Get in there.

If your OLB, emails and websites aren't up to snuff, you're missing out. This is Web 1.0 stuff, and 2.0 is about to hit the bricks in favor of Web 3.0 (does that blow your mind, because it should). You're going to see the big banks and their big websites increase functionality in the next few years, and as Robbie Wright of CU Innovators recently said: 

I will immediately think poorly of a product if they have a crappy looking website. crappy site=crappy product

less than a minute ago via CoTweetRobbie Wright

Let's just cut to the chase: you have a budget of $1 million. You can spend it on your websites and online banking, or on your social media initiatives. You can only spend it these two ways, and you can split it any way you choose. What are you going to spend it on, knowing what you know now? 

Talk to me, people.

Nations vs. 'Net - Online Diplomacy

by Ron Daly 

Let's say, for just a moment, that Google was a country. It's not so crazy - they're already dabbling in alternative energy. So let's say for just a moment that Googlevania comes to pass. 

Chief export? Search Advertising. 

National Security? Constantly upgraded! 

Taxes? You can live for free, but you can live BETTER if you upgrade. 

Seems like it works for them now, and how can you not like a country with the motto, "non exsisto malum" (that's Latin for "Don't Be Evil"). 

I bring it up because of recent events in which national governments are getting into squabbles with the titans of the computer age. Sure, back in '98, the Browser Wars were raging and then-Attorney General Janet Reno took on Microsoft for bundling Internet Explorer with Windows 98. Twelve years later, Microsoft is being vilified not here at home, but in France and Germany. French and German officials are insisting that people stay away from Internet Explorer as their browser, citing security issues with the most popular browser on the market. Clearly, Microsoft is upset about this. From the BBC article: 

Mr Cluley said that switching away from IE could create other problems, particularly for companies. 

"Some web-based applications may not work at all if you're not using Internet Explorer." 

Microsoft is currently working on a patch for the problem, but a spokesperson said it could not commit to a timeframe.

This comes on the heels of news that Google (not Googlevania, just regular Google) would pull out of China if the Chinese government continued to upset the delivery of emails, via Gmail, to Chinese activists. This would deal a major blow to the "Great Firewall of China", the network of blackouts and blocks placed on content by the Chinese government that prevents certain information from being accessed by chinese citizens. 

France and Germany insisting users ditch IE8? Google pulling out of China over conflicts of interest? That means that Microsoft and Google are major factors in the national security and human rights policies of these countries. To what degree does "Laissez faire" apply anymore? And are these considered "international incidents", as they involve American corporations? Are they "trade disputes"?

Give us your thoughts in the comment section.

The Decoy, The Bait, and the Smarter Twitter User

by Jimmy Marks

Growing up in a rural community, you get used to hunting and fishing terms and techniques. Two such techniques I've seen used to great success are decoys and bait. 

The decoy is a preferred method of staying out of the sight of waterfowl. Lulling them into a false sense of safety with fake ducks or geese and getting them to draw closer so you can fire is a skill that many successful hunters learn early. Bait, obviously, is a key part of the fishing equation - without tempting bait, it's tough to draw a fish's attention. While these methods are important to hunters, they're even more important to Spammers. Regrettably, they're just as effective online as they are in the outdoors.

A number of credit union and finance Twitter accounts have been compromised lately. Our own Twitter account, twitter.com/DMI_CUSoapbox, received a number of direct messages from our followers/friends imploring us to click links and enter our personal information. Thankfully, we ignored most of these links and paid attention to the Twitter explosion that followed.

"Accounts hacked!" followers exclaimed. 

"Do NOT click the link," others noted. 

And from one or two Twitter accounts being compromised came three or four. And from all that hubbub came a stinging reminder: 

SPAM will always be around to ruin the party. 

Stocking Up...

by Ron Daly

This week is Hurricane Preparedness Week. Here in Virginia, an area that is commonly soaked by the weather systems that push up from the Gulf, we have a Tax Exempt holiday in which we are allowed to purchase certain items tax free (see the .pdf of items here). 

I think this is great, and not just because I love deals. It's great to have a kit prepared for ill weather, especially for situations in which you might not have power or communication for a while. Some of the things on our tax exempt list: 

Can I See Your ID?

by Ron Daly

When you work in online services, issues of trust and reliability are on the forefront of any discussion you have about your product and how it will be perceived by users. E-mail marketing, for example, suffers from the perception that messages sent won't make it to the inbox. DigitalMailer's spent nine years getting white listed by the largest ISPs in the world, so we can answer most critics with a high rate of delivery and a set of standards and best practices that keep words like SPAM out of our vocabulary. 

Ebay, Amazon, Netflix, - they all had to take into account that they'd be doing business behind a curtain. When you buy from someone online, whether they're the vendor or they're acting as a middle-man, they would need to establish privacy regulations and a level of dependability in their services. 

What if the system worked both ways? 

The Heartland Hack and You

by Jimmy Marks

I've written articles about password troubles before, but when it comes to any security smarter than that, I defer to those of greater experience. 

Ron, for instance, looks at the break-in from the POV of a former credit union CFO. He wrote a good article yesterday for CU Soapbox (click here). An excerpt: 

...I've had small breaks (80 member accounts affected) and fairly big breaks (400 member accounts affected). There's the estimated ~$15 you spend reissuing cards and closing accounts. And then there's the ~$10 you spend on credit monitoring on the accounts. That's ~$25 per account, so at worst it's about $10,000 that I've had to account for after a breach. And that's why, recently, there's a thought that's been troubling me.

The thought that the breach of Heartland Payment Systems has the potential to affect up to 100 million accounts. Click here for the CU Journal article.

100 million! One. Hundred. Million. I'm hoping the math makes sense for you here, because 100 million times $25 equals $2.5 BILLION. In losses and monitoring and trouble and waste.

It's a troubling aspect, that you'd be costing millions, if not billions, in damages. 

Rob had some issues with the break-in, too. Being the CIO/Security Specialist at DigitalMailer, he knows a thing or two (or two million, really) about security standards.

"Happiness" is a Smoking Gun.

by Jimmy Marks

We all know about Ron's article earlier in the week about the Twitter break in. And we all know the implications of an easy-to-guess password. But just what WAS that password? 

"happiness". 

The hacker himself offered INTERVIEWS about his hacking acumen over an instant messenger interview. To quote the article from All Things Digital (a division of WSJ online - click here): 

"The hacker, who goes by the handle GMZ, told Threat Level on Tuesday he gained entry to Twitter’s administrative control panel by pointing an automated password-guesser at a popular user’s account." 

And that's all it took to put Twitter in a twist. 

Happiness, by the way, is nine lower-case letters long. According to the password strength analyzer from Mandylion Research Labs (you can download it for yourself - click here), the password would take six days or less to guess with one "guesser" in play. That decreases dramatically when ten guessers are used (from six days to fifteen hours). 

So...how secure is your password?