Banking Via Twitter? 193
In the latest example of how just because you can do something doesn't mean you should, one credit union has decided to offer a new feature, dubbed "tweetMyMoney," that allows members to interact with their accounts via Twitter. Can't wait for the next version, "tweetSomeoneElsesMoney." "tweetMyMoney, available exclusively to Vantage members! With tweetMyMoney, you can monitor your account balance, deposits, withdrawals, holds and cleared checks with simple commands. And, you can even transfer funds within your account. It's all available on Twitter, 24/7!"
two words (Score:5, Insightful)
"Hey, I know what'd be great!" (Score:5, Interesting)
I can guarantee something very much like the above took place in their marketing department shortly before this was built. I've spent 10 years listening to this from marketing geeks - nothing more dangerous than a new technology half-understood.
Re:"Hey, I know what'd be great!" (Score:5, Funny)
Now I only have to fit the nigerian scam letter in a 120 characters tweet... and they can, in one or two simple click, send me the money!
Can't you see the advancement ?
Re:"Hey, I know what'd be great!" (Score:5, Funny)
Re:"Hey, I know what'd be great!" (Score:5, Funny)
Yeah, does the bank also have a branch in Second Life? Come on man, Second Life, it's the future! Even CNN has an office there!
Oh wait, it's not 2007 anymore...
Funnily enough... (Score:2)
Re: (Score:2)
We weren't so lucky... last year the department head where I was happened to be quite keen on Second Life and managed to sell it as a good idea to the rest of the organization. So, while a major project was tied up in the initial phases and there was nothing else to do, several of us were assigned to work on a "presence" in SL. Quite a bit of work was done, but I can't tell you if it ever got out of the "concept" stage because I left that organization shortly after. (*gasp*, what a shocker!) And no I am
Re:two words (Score:4, Funny)
That's right folks, this is indeed the Apocalypse.
Re: (Score:2, Funny)
How disappointing to find out we live in such a pussy-ass universe. I want some fire and brimstone, or at least a few nuclear detonations.
Re: (Score:2)
Re: (Score:2)
(Notice: Neither step involves leaving the basement.)
Re: (Score:2, Insightful)
Re:two words (Score:5, Informative)
Re:two words (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
I wonder how long that will last.
In their desperation to get people to switch accounts, most UK banks make it relatively easy to switch accounts -- they'll move all your direct debits (automatic bill payments) and so on.
A few years ago, when I opened my student account, I got a free 5-year railcard (gives 33% off train fares, worth over £100, I've saved way more than that).
I switched accounts 6 months after I graduated.
Re:two words (Score:4, Informative)
Obligatory post, really:
"But, what could go wrong?"
Re: (Score:3, Funny)
I was laughing . . . until I realized it was my bank.
Suddenly the humor in it escapes me.
Two words (Score:4, Funny)
Epic FAIL!
Re:Two words (Score:4, Funny)
Or the LOLCats version
http://bighugelabs.com/output/lolcat6528288a5fbaabe890a88dbfecccb45635d9ef59.jpg [bighugelabs.com]
Re: (Score:3, Funny)
Your epic fail is having an epic fail.
Page not found (/.d already?)
Re: (Score:3, Informative)
Yeah, apparently that site deletes the generated images after an hour or so. It showed a cat on a keyboard and said "I'm on ur Twitter" at the top, and at the bottom, "Sendin monee to Switzerland."
Moderation (Score:2)
I have mod points for this comment but I can't find the "+1, Recursive" option?
Re:Two words (Score:5, Funny)
Twitter meets banking: a whale too large to fail.
Transactions need 3 elements to be safe... (Score:4, Insightful)
1. Target needs to be authenticated to the user. This should require some positive action, as opposed to relying on certificates which are mostly ignored and whose provenance is not as strongly assured as was initially advertised.
2. Customer needs to authenticate to the target. Passwords are not enough since humans can remember approximately 1 password only, and only if they use it constantly. The authentication should change and replays should be rejected.
3. Customer must affirm details of the transaction before it is committed. This too must use some method that is changeable and disallows playback.
Ideally a transaction will have all these elements in one idempotent package, the way for example a check might if the signature were a better biometric than it is and if the signature were checked always. That is however technically awkward on a net, so the 3 elements listed may need to be separately done. Omitting any of the elements allows different classes of attacks. If all the elements are present and tied together, attacks become very hard. Also, note, step 3 makes it largely irrelevant whether the customer is declared not-present afterwards or not. It serves also to terminate the transaction. Whether another transaction is begun or not is for the most part immaterial. (A method I have advocated to accomplish these would allow several transactions to be tied together if desired, in one session, but there would always be a "signature" or "affirmation" step for each, even if the initial authentication steps were recent enough to continue to use them.)
This needs hardware. However it can be done very cheaply; the hardware needed can in quantity be had for perhaps $3 a copy, possibly less, even as electronics. Paper approximations could be far cheaper still.
Re: (Score:2)
1) User sends random string to bank
2) Bank encrypts with private key (impostors won't have this)
3) User decrypts encrypted message with the bank's public key and checks against the original random string. If they are the same, the authentication is successful.
Now, someone needs to create a Twitter implementation.
Re: (Score:2)
"relying on certificates which are mostly ignored"
Re: (Score:2)
Re: (Score:2)
There's nothing wrong with certificates.
You just need the browser to not include all the broken ones, and potentially have a "bank mode" that only uses a CA run by your actual bank.
Better hope that it's secure. (Score:4, Insightful)
This seems like a GREAT way to lose all your money quickly.
I guess after it happens, you'll at least have something to really tweet about (as opposed to the fact you bought the new Brittney Spears album - no one cares!).
Re: (Score:2)
Are you sure about that? [kovideo.net]
Nobody loves me, but my mother,
And she could me jivin' too.
Re: (Score:2)
"See anything seriously wrong with this story?" (Score:5, Insightful)
How about the very idea of banking by twitter? What twit thought THAT one up??
I don't need Twitter for that -- I just call the bank and talk to a human.
Now we see why the banking industry is so screwed; it's run by morons.
Re: (Score:3, Insightful)
"Welcome to [...] telephone banking. Please enter your account number, followed by hash"
beep boop beep biip boop beep beep boop baap
"Please enter the fourth digit of your PIN"
boop
"Please enter the last digit of your post code"
beep
"In the word 'money', 'N' is in position three. In your password, what position is 'F' in?"
boop
"Your balance is £1234.56. Press 1 to..."
I feel more comfortable communicating with a robot.
(Having said that, I've only ever checked my balance. I'm not sure I'd do anything more t
Re: (Score:2)
Right now what is missing on craigslist is the ability to safely do confirmed transfer of large purchases. With fake bank checks the norm now, their is no way, even face to face, to say you got my $5000 I got your car, transaction complete (that I know of, short of $5000 in bills, then your both ripe for robbery.) Paypal was close at one point, but you give a single piece of info your email, and you get back a single piece of info email confirmation to that email (just a spoofed paypal email, skip the mid
Re: (Score:2)
Didn't add, the phone call to the bank needs to be private as well. Caller-id is too easy to spoof, so then you give out enough details to confirm your ID that whoever is within ear shot to know how to access your account as well. So you have to get privacy from the person your doing business with, but neither side can trust mid transaction for the other to leave to verify transfer...
Re: (Score:2)
I'd do it the same way I've always done something like that...a car at least. I go down to the BANK, and let them handle the transaction. If not a bank check to bank...I like a wire transfer ev
Re: (Score:2)
I don't need Twitter for that -- I just call the bank and talk to a human.
You obviously don't do much banking. Or handle business accounts. Or do much company-reimbursed travel or entertainment. Or handle one of a hundred other things for which calling the bank every hour is not reasonable.
Now we see why the banking industry is so screwed; it's run by morons.
No, it's run by people that realize they make the most money off of people that do lots of banking, handle business accounts, do company-reimbursed travel, and other things for which contacting the bank IN PERSON every hour or so is not reasonable. People that "call the bank", on the phone, ar
uh oh (Score:5, Funny)
Re:uh oh (Score:5, Funny)
> Tweet: you're broke. :) Thank you for choosing stupidity banking.
And, Its gone... [vodpod.com]
Re: (Score:2)
Not anymore you don't. Poof!
tweet = text (for most part); step backwards (Score:2)
Re: (Score:2)
You want to interact with your bank with a richer GUI than just text messages.
You mean, like show pictures of coins and bills for people whom are uneducated enough to not understand numerals or arithmetic?
Re: (Score:2)
Re: (Score:2)
Pffft (Score:5, Funny)
120 characters isn't big enough for my account balance.
Re:Pffft (Score:4, Funny)
Re:Pffft (Score:5, Funny)
He's from Zimbabwe you insensitive clod!
Re: (Score:3, Funny)
I'd Prefer to Bank via MySpace (Score:5, Funny)
A new joke every day! (Score:4, Interesting)
Dear Vantage customer, our free joke service will send you a tweet every day with a new hilarious joke. Please tweet "#tran $1000 f1 t123456" to @myvcu to start!
What's so bad? (Score:4, Insightful)
Lots of OMGWTF!!! responses here, but having looked over the information they're providing (balances, holds, cleared checks, etc) and noting that there's no transmission of account numbers, PINs or other identifying information, I'm not seeing a major problem.
Just because you can have a knee-jerk reaction doesn't mean you should.
Re:What's so bad? (Score:5, Informative)
While the public messages get all the press, people who don't use twitter may not realize that you can send direct messages [twitter.com] on twitter, which are private. That's what this system is using.
Re:What's so bad? (Score:5, Interesting)
While the public messages get all the press, people who don't use twitter may not realize that you can send direct messages on twitter, which are private. That's what this system is using.
Private? Yes. Encrypted? Not so much.
Re: (Score:2)
sounds like their is a secure solution Cryttr [codeplex.com] mostly does that. although I am not sure this would really accomplish what you wanted unless the bank was willing to exchange keys with you as well.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
What's the point of involving twitter if you're sending a direct message? Why not just send the message directly and skip the step of sharing your message with twitter? Private? In what sense is a message that you send unencrypted to a company you have no contractual relationship with private? If Twitter isn't using your messages to somehow make money I can't imaging why not. They may not have a good plan, but I can't believe they don't have some scheme in mind to make money off of your messages.
If you feel
Re: (Score:3, Informative)
Re: (Score:2)
I have a password requirement for this kind of information from my bank. I'm not sure I'd want these kinds of information in public space.
I imagine attackers would find this to be of high value:
1) You can reasonably identify and even physically locate Twitter users
2) This information tells you the status of their bank account, along with usage data that gives one the idea of when it is most ripe (after payday, before the bills come out automatically)
3) This information could be used to predict your physica
Re: (Score:3, Insightful)
Let me show you why this is a bad idea. Even if it is just 'check 153 cleared' or 'ATM: amt withdrawn 300 dollars'.
'Hi this is XYZ from ABC credit agency we see that you have 300 dollars cash right now in your hands and you owe us 2389 and 48 cents please swing by and pay us'.
Or how about
'Hey I know where Jim lives and he has 300 in cash on him right now lets go rob him'.
Or how about
'We can glean information about peoples bank accounts from their twitter accounts and then connect it thru advertising' 'Monk
Re: (Score:2)
It's a dumb idea. You can do any of those things (at least with my bank) on your cell phone or even POTS. All you have to to do is call the bank and talk to a human.
Re: (Score:2)
there's no transmission of account numbers, PINs or other identifying information
To set it up, those must be entered at least once. Which means they are being called SOMEWHERE in the process of using it on twitter. Which to hacker, means it can be accessed.
If Twitter can be hacked, your banking information can be stolen. Simple as that.
And I don't mean, login to your twitter, transfer the money, haha its gone,
I mean, login to twitter, get your info, go to your banks site, login there, haha its gone.
Re: (Score:2)
Twitter from Nigeria! (Score:3, Funny)
Twitter + Banking (Score:2, Funny)
Twanking
I will be Twishing your details
Re: (Score:2)
"Twanking" -- okay, I nearly spit up my coffee. Thank you.
Re: (Score:2)
Genius.
I hope that becomes the official name.
Re: (Score:2)
I think the term Twinking [wikipedia.org] would be more apt :)
Tweet money to my account (Score:2, Funny)
Tweet: SELECT All Money FROM All_Accounts TO My_Account NOW!
List of banks? (Score:4, Insightful)
Is there a list of banks that support this? Just so, you know, the intelligent people can move their cash OUT of these banks?
Not seeing the point (Score:4, Insightful)
I don't see the point of the service, but then I don't use Twitter.
I also don't see the point of all the critics. Everyone alludes to how easily someone can steal your money with this. Ok... how?
I see a bunch of functionality where you can monitor your account status. The only thing I see that mentions affecting your account status is transfering money within your account. I guess that's enough that you could mess with someone, but where's the profit motive? You're going to commit wire fraud just to piss someone off?
Re: (Score:2)
Just off the top of my head, does Twitter require that one uses HTTPS to access it? MITM.
Re: (Score:2)
Nope. Just HTTP.
Twitter is not secure. It doesn't pretend to be.
Re: (Score:2)
You didn't answer my question.
I'm not asking how you would subvert the system.
I'm asking how you would profit from subverting the system.
Yes, Twitter is insecure. And?
Re: (Score:2)
Re:Not seeing the point (Score:5, Insightful)
Why would you purposely introduce another entity between you and the bank? A decidedly non-secure entity.
Re: (Score:2)
You're going to commit wire fraud just to piss someone off?
Yes. Maybe you're not worried if someone finds out the details of your bank accounts, but I am!
Re: (Score:2)
More allusion and still no explanation.
Go read what the service provides, and explain specifically what valuable information you think someone can intercept in this way. "Details of your bank accounts" is too vague to mean anything.
Re: (Score:2)
With tweetMyMoney, you can monitor your account balance
'nuff said, my balance is very important and I'm sure it is also important to many others.
likely outcome predicted 152 years ago (Score:2)
Harper's had the foresight to publish [google.com] an anthropomorphized metaphorical tale of the interactions between Twitter and banks, some years ago:
Don't forget about TwitPay (Score:3, Informative)
Site: https://twitpay.me/ [twitpay.me]
Basically you attach your twitter account to your paypal account, then you can send money to any other twitter user with a simple message to that effect.
Of course, the catch is that the money never actually gets transferred until you "settle" the account. It just keeps a running tally for everybody, then you settle and pay the whole shebang at once.
Re: (Score:2)
No potential for massive abuse there... Nooooooo...
Seriously, I think that anyone who goes into marketing should immediately be shot for the good of society.
Judge Orders Twitter Acct. Disabled (Score:5, Insightful)
One more gateway for hackers (Score:2)
This sounds to me like "another hole in the wall".
Re: (Score:2)
Here's another thought: what if twitter.com gets hacked? I'm sure there's lots of other juicy stuff there, but why would anyone encourage you to post your financial details on a 3rd party server? Whoever had this idea should be shot and then hanged alive as an example for other "bright" marketers.
Web page defaced ? (Score:2)
I get it.. it's SO enormous.. and since we're not April 1st, I can only conclude the web site was hacked and some witty nerd pranked them..
Ah ah.. tweet banking.. uh uh.. funny..
--Ivan
gotta love twitter pr (Score:2)
It's as if they made people forget about this little thing called the Internet. Pretty soon they will tell me that I can look at lol cats and porn via twitter and expect me to be super excited.
financial open information intersection (Score:2)
when I first read this description, I thought it was about people using twitter to by open and public about their money.
In most other parts of the world the Internet is driving companies and products to "out-open" each other. more transparency wins, more obvious pricing models win, easier services win. People who are more open and more public about their lives are more successful generally (though its not clear which are the causes and which are the effects).
This drive toward open has not reached financia
I have only one thing to say (Score:2)
This idea is truly for the birds!
Re: (Score:2)
Holy crap... (Score:2)
Since the launch of our new MyVantage online account management system in April, many members have asked for a mobile banking solution. We'r
And this is what you've come up with? Not ... I don't know, secure email, hell even text messages... no, we'll use twitter for submitting private banking info? And oh, just happen to share it with the twitter corp as well? Genius, pure genius.
Yo Dawg (Score:2, Funny)
wow (Score:2)
this has got to be the dumbest idea from a financial institution since that guy from the anti-identity theft company gave out his social security number and then has funds withdrawn from his account and credit cards opened in his name...
Spent a bit of time in banking industry (Score:2, Interesting)
Your First Tweet After Using This (Score:2, Funny)
Obligatory South Park Reference... (Score:3, Funny)
Why this is a bad idea (Score:2)
Does anyone else worry about sending sensitive information over a service like Twitter, which has had security issues in the past? And, assuming this works over DMs, what if a user instead accidentally uses a reply or just a straight Twitter post? What sort of information have they just inadvertently exposed?
Security issues in the past (Score:2)
Is there any means which has ever been used to communicate sensitive information -- including contracted couriers, the USPS, telephones, and in-person oral conversations -- that has not "had security issues in the past"?
Re: (Score:2)