Device identification in online banking is privacy threat, expert says
SAN FRANCISCO--A widely used technology to authenticate users when they log in for online banking may help reduce fraud, but it does so at the expense of consumer privacy, a civil liberties attorney said during a panel at the RSA security conference on Thursday.
When logging into bank Web sites, users are typically asked for their user name and password. But that's not all that is happening. Behind the scenes, the server is taking measures to identify the device being used in an attempt to verify that the person logging in is the person whose account is being accessed under the assumption that most people use the same computer for banking.
Wachovia, which recently merged with Wells Fargo, tags the consumer's computer with a unique identifier, said Chris Mathes, an information technology specialist in online customer protection at the bank.
The technology not only can be used to allow legitimate customers into Web sites, but also to block computers that have been targeted as "bad actors," said Todd Inskeep, a senior vice president for the Center for the Future of Banking at Bank of America.
Another device fingerprinting technology provided by 41st Parameter is similar but doesn't tag the computer. Instead, the technology figures out the degree of probability that the computer accessing the site is the one that should be accessing it by querying the computer for things like time zone, language, browser type, Flash ID, cookie ID and IP address, said Ori Eisen, founder of the company. If enough of the answers match, the account can be accessed.
The 41st Parameter technology is being used by 120 large e-commerce companies, including the top five banks in the U.S., USAirways and Continental Airline, Eisen said in an interview.
Even though none of the information gathered during a log-in is personally identifiable, the bank shouldn't have to collect regular data on when, how often and from where a consumer accesses a bank account, said Jennifer Granick of the Electronic Frontier Foundation. Such information can be compiled with other more sensitive information to create profiles and cross referenced to learn more about consumers, she said.
For instance, the bank could learn who a consumer's roommate is if the same computer is used regularly to access different accounts, Granick said. Consumers also could be deemed suspicious for breaking with their patterns on deposits or withdrawals or the information could be sold to advertisers, she added.
"There is very little privacy protection in the U.S. for this type of information," Granick said. "We don't want it shared with affiliates that do advertising." There should be restrictions on how long the bank will keep the data, who it can share it with and for what purposes, she added.
Eisen said his technique was more "privacy friendly" because it doesn't assign identification numbers to devices. The questions posed to computers by his technology are akin to what WebTrends and Google Analytics find out from computers for Web analytics purposes, he said.
Granick wasn't convinced, noting that even without a unique device identifier, the bank is still able to monitor consumer transactional patterns.
Right as the session was ending, Louie Gasparini jumped from his seat in the audience to make a comment at a microphone set up for the question-and-answer session.
"The privacy issue is encumbering banks," who have a fiduciary obligation to prevent fraud, said Gasparini, who said he used to work in Internet banking at Wells Fargo and helped create Device ID at RSA, the security division of EMC.
Another attendee had a different perspective.
"The concerns are not overstated. There are fundamental deficiencies in privacy law," said Andrea Matwyshyn, assistant professor of legal studies and business ethics at the University of Pennsylvania's Wharton School. "If an end user license agreement contractually reserves the right of a company to collect data for fraud prevention purposes and if this data is then sold as a secondary revenue stream, a privacy concern would clearly exist."
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
If the worst thing they are going to do with it is more effectively market products and services to me, what is the real evil? Wouldn't spam be less annoying if it was actually for products and services targeted to your personal interests and needs instead of some cryptic email ad for viagra. This seems like a fair trade off for not having my money siphoned out of my account by some hacker.
I remember a couple years ago when I was returning a rental car after my car was in shop, and when my credit card was hit with the third charge in 20 minutes (gas, car return, repair bill), it was declined. When I called the credit card company, they said it was because those charges were suspicious. Since I only ever used that card for airline tickets and online computer parts, I was outside my profile. Was I ticked off? Heck no.
I see this device ID profiling as another extension of the same kind of artificial intelligence. I like it.
In the past my CC company called me up to make sure a charge was legit. Kudos to them.
There have been far too many examples of corporate types acting irresponsibly, illegally, or immorally to just hope all will behave nicely.
I work for a financial institution and by law, we are required to have safeguards in place to verify the identity of our members both in person and online. It's called "Multi-Factor-Authentication". So they place this reg. on us, then tell us we're infringing? Who are these nutjobs? We use RSA to authenticate our members online and we do not store, nor do we have access to, the information regarding what PC our members are connecting from, and quite frankly we don't care. It's the least of our worries.
I've had people complain that we are spying on them because they are asked security questions or are asked to further authenticate themselves when logging in from another PC...this coming from the same people who don't know what a browser is, aren't aware that updating (or having) AV is necessary, and can't tell you what operating system they have. Yep, we're spying on you. It's not like we hold your money, have your account number, ssn, address, telephone #, or anything like that. And you are worried we're stealing your information via online banking, or we know what computer you're using? Really?!
If people are this paranoid then perhaps they should bury their money in the backyard, maybe put it under their mattress, or dare I say it, not use online banking? Would they rather us just remove the safeguards? I, for one, am glad we use this technology. It's sad but true that this sort of thing is necessary in order to prevent fraud, but we may as well accept it and carry on.
The processes discussed here don't include RSA key fobs, but rather extracting information from a user's browser or computer to authenticate the user. If that is done without proper disclosure and protections, it is a problem.
A bank has a tremendous amount of personal information, and clients agree to permit that. So long as that information and the client's activities are not used for non-bank marketing, I find nothing to complain about.
Banks may use info for other purposes such as advertising their services as the article states. But, as some have said previously, if it keeps me safe then I don't really see the problem. Now, I fail to see how this part of the article holds any real weight.:
"Granick wasn't convinced, noting that even without a unique device identifier, the bank is still able to monitor consumer transactional patterns."
I say great! Monitor my transactional pattern and call me if it looks suspicious, what is the harm? We can argue all day about this, but if by some chance this is a breach of privacy then I'm sure we can come up with a better way of doing it. One would be to put regs on the banks to only allow them to use what information is gathered via online banking for security verification purposes and no more (as it should be). Or, an "opt-out" policy for customers to allow the bank to use info as they see fit, etc. I saw that the article stated that a bank CAN possibly do this, but I don't see where it said that any bank IS using this information for these purposes.
Don't let the PORN web sites find out about this!!!
Hacked Passwords will be a thing of the past!!!!
1. This technology is more than two years old (so its not news)
2. The information gathered is not that sensitive. Any site you visit gathers most of this.
3. If you ask your Bank what kind of a person you are (which is privacy sensitive) they only know you from your credit card transactions, (off course most of them know your civilID, passport etc..) your income your loans etc..
4. A more privacy sensitive profile of yourself is held by google (if you have any google account). This info is available to google.
5. Personal profiles available to the public for one self can be built if you have a facebook , or myspace or any other community network account.
Get real people.
Those smart a... lawyers should have filed a lawsuit against Microsofts invasion of privacy (through indirect control of their product running on my and your computer, and against the illegality of EULA'S, as that's what they are, an ILLEGAL. Microsoft is spying on and controlling our computers to the point where they can just switch them off.
God, what an arrogant company....
- by LouieGasparini April 28, 2009 12:13 PM PDT
- This is a great discussion, glad to see it being vetted here. Seems to me that the overwhelming consensus here is an endorsement for fighting fraud with these tools. This is good.
- Like this Reply to this comment
-
(21 Comments)We should encourage innovation in this area. More needs to be done to combat fraud.
Lets not handcuff the good guys. Privacy here means keeping my secure assets private between me and my selected service providers. If they can use better techniques to identify the money movement request is from me and not a fraudster, then this is good. My privacy IS protected.
Louie Gasparini
Self