Hacker News Reader

Comment by crimsdings | Hacker News Reader

I work for a classic bank in Europe in development.

To unlock my laptop - I need a boot password - then I need a finger print scan - after that a password, after that a 2fa app. Then I need to connect to a VPN .. 2fa again. My laptop locks within 1 minute of inactivity. 30% of my CPU and RAM get hogged by our security suit constantly. My USB ports are disabled for data. I understand it's windows and windows can get compromised - it's just very unlikely that it gets compromised to a level where you could actually cause damage.

View on HN

If your USB ports are disabled for data how do you plug in a mouse and keyboard?

EDR software on the laptop controls what is and isn't allowed. It'll be disallowing USB removable storage devices etc, while still allowing standard HID (keyboard, mouse).

They can even block all but allow-list certain vendors and models, but because USB is an unauthenticated standard - an attacker can easily spoof any vendor or model. So best not to rely on that and instead block all of certain types of USB device.

Don't BadUSB attacks typically use HID to enter malicious keystroke sequences?

So?

No ones going to disable mice/keyboards.

If the point was to eliminate all possible ways of compromising the device, they'd just put the device in the shredder.

You have to balance having a usable and functional thing with the risks involved.

What a nightmare, I think the bank might just be better off paying the occasional ransomware rather than operate like this.

absolutely not a nightmare but necessary in places that are serious about their shit. paying off ransomware isn’t an issue at all, if my bank got hacked I would pull money out pretty much the next morning and same would be true for hoardes of others even though our money is fdic insured.

Why would have more than the maximum FDIC ensured amount (200k) sitting in one bank?

FYI each of the top 10 banks in the US have been hacked before, and they’re still doing ok.

Reply on news.ycombinator.com