4 stories
·
0 followers

Ruling Raises Stakes for Cyberheist Victims

1 Share

A Missouri firm that unsuccessfully sued its bank to recover $440,000 stolen in a 2010 cyberheist may now be on the hook to cover the financial institution’s legal fees, an appeals court has ruled. Legal experts say the decision is likely to discourage future victims from pursuing such cases.

Choice Escrow and Land Title LLC sued Tupelo, Miss. based BancorpSouth Inc., after hackers who had stolen the firm’s online banking ID and password used the information to make a single unauthorized wire transfer for $440,000 to a corporate bank account in Cyprus.

BancorpSouth’s most secure option for Internet-based authentication at the time was “dual control,” which required the customer to have one user ID and password to approve a wire transfer and another user ID and password to release the same wire transfer. The other option — if the customer chose not to use choose dual control — required one user ID and password to both approve and release a wire transfer.

Choice Escrow’s lawyers argued that because BancorpSouth allowed wire or funds transfers using two options which were both password-based, its commercial online banking security procedures fell short of 2005 guidance from the Federal Financial Institutions Examination Council (FFIEC), which warned that single-factor authentication as the only control mechanism is inadequate for high-risk transactions involving the movement of funds to other parties.

A trial court was unconvinced, and last week The 8th Circuit Court of Appeals found essentially the same thing, while leaning even more toward the defendants.

“It’s a good opinion for banks [and] it’s definitely more pro-bank than pro-consumer,” said Dan Mitchell, a lawyer who chairs the data security practice at Bernstein Shur in Portland, Maine. “The appellate court found the same thing as the basic court. The customer was offered dual controls — that two people should be required to sign off on all transactions — and they were informed that it was important for them to take advantage of this. So, when [Choice Escrow] made an informed decision in writing not to use dual controls, the bank was careful to document that.”

Perhaps most significantly, Mitchell said, the decision could be a blow to companies trying to recover cyberheist losses from their banks. Bancorp South had asserted at the trial court level that its contract with Choice Escrow indemnified it against paying legal fees in such a dispute. The trial court dismissed that claim, but the appeals court said in its decision that the bank could recover the costs from the escrow firm.

“The bank had asserted a counterclaim that the customer should pay the bank’s legal fees,” said Mitchell, who battled similar claims in which Patco — a Maine construction firm — successfully sued its bank over a $588,000 cyberheist. “There’s no other federal circuit court case other than Patco that has gotten up to that level. The appeals court said the bank can now pursue its legal fees against the customer. And that may end up being the important part of this opinion in the long run if [plaintiffs are] looking at not only have to pay their lawyers to pursue a loss but also those of the bank.”

Charisse Castagnoli, an adjunct professor of law at the John Marshall Law School, said the appeals court decision means that indemnification is now the ‘law of the land’ in the 8th Circuit.

Castagnoli said she expects two results from this decision: that banks which don’t already have these clauses in their online banking agreements will add them; and that cyberheist victims will think more cautiously about bringing a lawsuit.

“This is the first time a court has ruled on fee shifting, and that will certainly have a chilling effect on litigation,” Castagnoli said.

A copy of the appeals court’s ruling is available here (PDF).

Read the whole story
pmaaaah
3994 days ago
reply
Share this story
Delete

JavaScript: the one true language

2 Comments and 4 Shares
Mozilla has an excellent guide "A Reintroduction to JavaScript". It's a good read, I even found a couple points that I'd been unclear on.

The thing about JavaScript is this. It was created back in the late 1990s as a non-serious scripting language, as the little cousin to "real" languages like Java. But something strange happened, it grew up to become a real programming language. It's now the preferred language for writing apps in the browser, overtaking Java. It's also a great server-side language. JSON, meaning data structures formatted in JavaScript, is replacing XML as the standard interchange format -- even when neither side is written in JavaScript.

JavaScript is the one language you can't avoid. No matter how much you hate the language, no matter how much you prefer a different language, you are going to end up dealing with JavaScript in some form.

Thus, instead of resisting the change, you have to come up to speed on it. The above Mozilla document is excellent at this. It doesn't waste time with concepts you already know. Instead, it assumes you are already a competent programmer in some language, and that you already have a familiarity with JavaScript, and then targets the meat of the matter.


Read the whole story
pmaaaah
4129 days ago
reply
Share this story
Delete
1 public comment
fredw
4126 days ago
reply
Awesome, good work from the MDN community. The list of contributors to the article is impressive.
Portland, OR

How Weev's prosecutors are making up the rules

5 Shares
Many of us believe that the conviction of Andrew "weev" Auernheimer proves that the system is corrupt, that the law can be arbitrarily applied to prosecute anybody. The rules are whatever the prosecutors say the rules are. There are one set of rules for the powerful, and another set for anybody who would challenge the powerful.

Today, prosecutors prove our theory correct. They submitted a 26,495 word brief in the appeal that does not conform to the Third Circuit's 14,000 word limit -- a limit that the defense struggled to fit within. In that brief, prosecutors arbitrarily redefined the Internet to prove that Weev (and friends) broke the rules. They liberally reinterpreted the rules of the Internet (the "protocols") to find Weev in violation -- while flaunting the rules of the court themselves.

User-agent rules


On page 23, the prosecutors describe the "hack", pointing out how Weev and friends...
changed the user agent in his Account Slurper program in order to trick the servers into thinking that he was using an iPad
That's not the rules of HTTP. The "user-agent" field is not intended to be a means of identification. Very clearly, the rules state:
This is for statistical purposes, the tracing of protocol violations [mistakes], and automated recognition of user agents for the sake of tailoring responses to avoid particular user agent limitations. .... The field can contain multiple product tokens...
Since nearly the beginning of the Internet, all major browsers (such as today's Chrome, Firefox, Internet Explorer, Safari) claim to be "Mozilla", the codename of the original Netscape browser from almost 20 years ago. This was originally done because servers would send different versions of webpages to Netscape and Internet Explorer. Back around Internet Explorer version 3, when Microsoft upgraded their browser with features compatible with Netscape, they added "Mozilla" to their User-Agent to trick web servers into giving Microsoft the (better) Netscape pages. That it's okay for Microsoft to do this, or for Google to do this, but not okay for Weev, is an arbitrary and prejudicial distinction made by the prosecutors, redefining Internet protocols.

URL rules


The same is true for the URL. You are probably reading this webpage using a web-browser. At the top is the URL for this page, which you can manually edit by hand. The reason you can edit this is because that is the hope and intention of the designers of web browsers. It means you can debug and fix URLs that don't quite work. It enables an additional way to browse a website by trying out new combinations in the URL. If a URL has "articleID=12" on the end, the intention is that you can edit this to retrieve "articleID=13". That's how Weev and friends were able to access the information AT&T had made public.

But while they can edit the URL, most people don't. For that reason, prosecutors insists that it's illegal. On page 32, they describe a hypothetical "judicial law clerk" who is a "reasonably sophisticated computer user". They point out that this clerk would search in vain for hyperlinks, and thus, not be able to access the information since such hyperlinks don't exist.

This is a clever trick of the prosecutors. It exploits the fact that the way the judge is going to handle this case is to give the brief to the young clerk who spends a lot of time on Facebook, where "heavy Facebook use" is the proxy for "reasonably sophisticated computer user".

But that's like saying that because you drive to/from work every day that you are a sophisticated driver, capable of going out on the race track. Or, it's like saying that because you eat a lot that you are a sophisticated cook. Just because somebody is an expert with Facebook doesn't mean they have any clue as to how computer works -- indeed, the entire point of the iPad is to appeal to the unsophisticated users. According to the government's reasoning, this two year old using the iPad is a "reasonably sophisticated computer user".

This is why I say that Weev was convicted of "witchcraft" rather than "hacking". The judges, juries, prosecutors, and law clerks don't edit URLs, user-agents, or write scripts. They don't understand it. By the Arthur C. Clarke rule, it's equivalent to magic. When you challenge the powerful, you are guilty purely because you did something the average unsophisticated user isn't capable of.

Legitimacy rules


The start of the brief goes to great lengths to describe how Andrew's company, Goatse Security...
is not, to put it mildly, a traditional security research company.
By this, of course, they mean it was just a couple of guys having fun rather than a large industrial firm with thousands of employees. But the reality is that over the history of vulnerability research, the vast majority of disclosures have been by "non-traditional" security researchers. Certainly, Goatse Security was very strange as a whole, but the core concept of discovering a security and reporting it is as traditional as traditional gets.

That's why so many of us rally to Weev's cause: we are disgusted and repelled by the "Goatse" side of things, but we are no different in terms of security research. We are frightened by how the prosecutors arbitrarily define who, and who isn't, a legitimate security researcher.

Who sets the rules


On page 64 of the prosecutor's brief is this outrageous paragraph:
Major technology companies today – Microsoft, Google, Facebook, PayPal, and Mozilla, to name a few – all pay bounties to white hat hackers who find flaws in their systems and thereby help keep them secure. The Government is not aware of any instance in which a security researcher who followed the rules of ethical hacking was prosecuted for violating the CFAA. Often, when a white hat hacker discovers and reports a security flaw, he is rewarded financially for his work by the company that he has hacked. But no one, not even a white hat hacker, gets to make his own rules.
It starts with an outright lie. It is not true that "major tech companies all pay bounties". Only a tiny few do -- indeed, only the ones listed. The rest don't. IBM doesn't. HP doesn't. Samsung does't. Dell doesn't. Amazon.com doesn't. Intel doesn't. Ebay doesn't.

And Apple doesn't. I point this out because this last week I've gotten a lot of PR for my website http://IsTouchIdHackedYet.com, where I am offering a bounty on Apple's new touch sensor precisely because Apple doesn't offer bounties. On this site, I am making my own rules. By all the prosecutor's reasoning, this is not "traditional" research. It is illegitimate, and therefore, I belong in jail.

I always make up my own rules. A week ago, I scanned the entire Internet. What are the rules of this? Well, the Internet is defined as an "end-to-end" network, so by that definition, it's allowed. But as we've seen, prosecutors don't care about how the Internet defines itself -- they just make up new definitions of the Internet. Scanning the Internet is actually a common thing for white-hats to do, but since many are afraid of arbitrary prosecution, they hide their activities. I'm transparent and open about it -- which means I'm potentially in violation of what prosecutors deem "traditional" security research.

This is again why the entire research community is afraid of the Weev ruling. We white-hats don't get to set the rules as to what constitutes legitimate, traditional white-hate research. It's the prosecutors who set these rules. Moreover, they are purely arbitrary: we won't know what they are until we've angered some powerful entity, and the police come to arrest us.

It is also important to point that AT&T offers no bounties. The prosecutors are making the bizarre argument that since AT&T didn't follow the "rules" by offering a bounty, that Weev belongs in jail. In other words, unless a company provides bounties, it's unethical to point out their flaws.

I love the middle sentence of the above paragraph, so I'm going to repeat it:
The Government is not aware of any instance in which a security researcher who followed the rules of ethical hacking was prosecuted for violating the CFAA.
This is circular logic, saying that people who follow the rules don't break the rules. When the prosecutors make the arbitrary decision that you've violated the CFAA, they'll likewise decide that you don't follow the rules of ethical hacking. Such circular logic is the basis for the prosecutor's entire argument: Weev is a bad guy because he's a bad guy.

Conclusion


What made the Internet is that creative thinkers broke the traditional rules. The Internet is an "end-to-end" and "packet-switched" network that is in complete violation of the rules of traditional telecommunications up until 1990. Google makes a copy of everyone's website whether they allow it or not. Facebook provides an enormously expensive service for free -- without it's customers realizing they pay in privacy. These giants all broke the traditional rules to create great things. That the powerful can break these rules, but unsympathetic characters like Weev cannot, is a threat to all of us. It's a threat to us personally when we anger the powerful. It's a threat to everyone else when the chilling effect stops innovation.

And finally, it's a threat to everyone because when products/services have vulnerabilities, no-one will be brave enough to point them out.







Read the whole story
pmaaaah
4264 days ago
reply
Share this story
Delete

Meet Mr. Money Mustache, the man who retired at 30 - The Washington Post

1 Share

Comments: "Meet Mr. Money Mustache, the man who retired at 30 - The Washington Post"

URL: http://www.washingtonpost.com/business/meet-mr-money-mustache-the-man-who-retired-at-30/2013/04/26/71e3e6a8-acf3-11e2-a8b9-2a63d75b5459_print.html


By Kelly Johnson,

To hundreds of thousands of devotees, he is Mister Money Mustache. And he is here to tell you that early retirement doesn’t only happen to Powerball winners and those who luck into a big inheritance. He and his wife retired from middle-income jobs before they had their son. Exasperated, as he puts it, by “a barrage of skeptical questions from high-income peers who were still in debt years after we were free from work,” he created a no-nonsense personal finance blog and started spilling his secrets. I was eager to know more. He is Pete (just Pete, for the sake of his family’s privacy). He lives in Longmont, Colo. He is ridiculously happy. And he’s sure his life could be yours. Our conversation was edited for length and clarity.

Q Interesting name you have there. What’s the story?

I imagine the Mr. Money Mustache character as this old-fashioned financial sage from days gone by. He runs his old western town with quiet wisdom: The business leaders from Wall Street seek his advice, and the mayor checks with him on issues of town policy. He takes time to dish out a wise lesson or two to the local children, occasionally, and with a sparkle in his eye, he flips them each a golden coin with the tip of his thumb. “Invest it wisely, children, and you too will grow to be Mustachians!”

So there’s that, and the fact that all those M’s just sound great together. Plus, the convenience of how Mustache rhymes with Cash — as in “You Must Stash your Cash.”

So you retired at 30. How did that happen?

I was probably born with a desire for efficiency — the desire to get the most fun out of any possible situation, with no resources being wasted. This applied to money too, and by age 10, I was ironing my 20 dollar bills and keeping them in a photo album, just because they seemed like such powerful and intriguing little rectangles.

But I didn’t start saving and investing particularly early, I just maintained this desire not to waste anything. So I got through my engineering degree debt-free — by working a lot and not owning a car — and worked pretty hard early on to move up a bit in the career, relocating from Canada to the United States, attracted by the higher salaries and lower cost of living.

Then my future wife and I moved in together and DIY-renovated a junky house into a nice one, kept old cars while our friends drove fancy ones, biked to work instead of driving, cooked at home and went out to restaurants less, and it all just added up to saving more than half of what we earned. We invested this surplus as we went, never inflating our already-luxurious lives, and eventually the passive income from stock dividends and a rental house was more than enough to pay for our needs (about $25,000 per year for our family of three, with a paid-off house and no other debt).

What sort of retirement income do you have?

Our bread-and-butter living expenses are paid for by a single rental house we own, which generates about $25,000 per year after expenses. We also have stock index funds and 401(k) plans, which could boost that by about 50 percent without depleting principal if we ever needed it, but, so far, we can’t seem to spend more than $25,000 no matter how much we let loose. So the dividends just keep reinvesting.

We also have hobby income occasionally — I love to build things, so I do some carpentry work for friends and family. Usually it is free, but I also get paid sometimes. My wife got a real estate license after retiring, and though she doesn’t accept real clients, she will occasionally help a friend buy a house, generating some commission there. More recently, even my hobby of writing the blog has started producing some cash, which I hope to reinvest and snowball into a big charitable operation as well as funding interesting projects related to the blog.

What motivated you to start the Mr. Money Mustache blog?

In a word, exasperation. After retiring at 30, my wife and I were subject to a barrage of skeptical questions from high-income peers who were still in debt years after we were free from work. Yet the reasons seemed so obvious: the bank-financed $30,000 cars and $2,500 road bikes, the 20-mile commutes, $50 haircuts and the $100 happy hours every Friday.

“Little” things that are only a few hundred dollars a month add up to hundreds of thousands of dollars shockingly fast. But the lack of this understanding of the numbers is what keeps most middle-class people from getting ahead.

You describe the typical middle-class life as an “exploding volcano of wastefulness.” Seems like lots of personal finance folks obsess about lattes. Are you just talking about the lattes here?

The latte is just the foamy figurehead of an entire spectrum of sloppy “I deserve it” luxury spending that consumes most of our gross domestic product these days. Among my favorite targets: commuting to an office job in an F-150 pickup truck, anything involving a drive-through, paying $100 per month for the privilege of wasting four hours a night watching cable TV and the whole yoga industry. There are better, and free, ways to meet these needs, but everyone always chooses the expensive ones and then complains that life is hard these days.

What are the different ways you think about debt?

People have become too complacent about debt, making piddly monthly payments on a high-interest credit card while they continue to go out and buy more luxury products for themselves, ensuring the debt is never retired.

To combat this tendency, I en­courage people to consider it a huge emergency, like running around with your hair on fire. Or like standing in an enormous cloud of killer bees, which are stinging every square inch of your body. Occasionally I’ll even have to pull out the old “cauldron full of boiling lava and poisonous snakes” metaphor to properly convey the urgency.

After internalizing these scary scenes, people develop the appropriate aversion to doing something like financing a new car, instead of waiting until they have cash to afford a used one.

Talk a bit about the power of habit.

It’s amazingly powerful. By the time you get to be a big fancy adult with a career and a house, your daily routine is basically just a collection of unconscious habits: You make coffee, commute by car, attend meetings and answer e-mails, shop in certain stores, watch TV and repeat. It becomes effortless. Your brain goes into autopilot. Unfortunately, this also means it becomes hard to make changes.

But different habits, while being equally effortless, tend to add up in a good way over time. If you have a $50,000 take-home pay but are in the habit of living on $25,000 and investing the rest, that will put you ahead by about $350,000 every 10 years after compounding. A habit of biking instead of driving can keep you lively and fit into your 80s while saving you hundreds of thousands of dollars as well.

The key thing to remember is once you establish the habit, it becomes effortless and even pleasant to stay in the groove — even while your friends think you are some kind of unimaginably frugal bike-riding superhero.

What to do if your spouse isn’t on board?

You’d be shocked at some of the conversions I have been hearing about recently. There’s a compelling logical, psychological and philosophical case for why living a simpler, less materialistic life makes us happier as humans.Far from being a sacrifice, spending less and saving more is actually an incredible life-boosting experience.

But there’s not much money in teaching people to spend less, so the job is left to people who no longer need to earn money, like myself.

Unfortunately, I’m handily outgunned by the $34 billion U.S. advertising industry, which is why your spouse is not yet on board.

However, by presenting the case with both logic and emotion, you can usually break a person’s mind free from its little Gucci birdcage.

A series of calm conversations paired with you yourself living the example of a simpler and heartier way of life is a hard thing to resist.

If a person still clings to consumerism? I guess you have the choice of agreeing to disagree, or seeking out a more open-minded person for your next love.

Is your life possible just because you grew up in Canada? (The Canadians are thrifty, no-nonsense people, no?)

I’d say we were back in the 1970s and ’80s. That country has more of a consensus-based culture with less hard-core individualism, and it is reflected in the government as well, with things like universal health care and higher gasoline taxes. But things have changed in the latest decade as the relentless oil boom has pumped up incomes, property prices and the mouth-frothing consumerism that goes along with such wealth.

Okay, so once you’ve paid off debt and piled heaps of money into savings, what do you do with it?

You’ve already gotten off track, in my book. Instead of thinking of “savings,” think of “investments.” You invest every bit of spare money you can get your hands on, as soon as you can. Like little green employees, each dollar bill needs to be kept at work for you at all times.

Back in the day, I would just empty out my bank account after each paycheck and distribute it into my investments of choice: Vanguard’s S&P 500 index fund, their small-cap value index fund, a bit went into paying off my mortgage early as well.

More advanced investors should read a book or two on investing and asset allocation. And people interested in being a landlord should consider owning a rental house or two (but only in a city with affordable house prices, which yield a good price-to-rent ratio).

Washington is clogged and expensive. Many folks who work downtown for the higher salaries live in the suburbs for more affordable housing and better schools. Do you think you can scale your approach for a place like this? Does it just take longer to retire early? Or is it better to move?

That’s a great question, because most people assume they are stuck wherever they live.

If you take a job in downtown Washington, make sure it’s for a good reason. Either it should pay well enough to allow you to live close to work and still save most of your income, or it should be in an occupation you can’t do anywhere else and you love it so much that you’re willing to be poor for it.

There are lots of tweaks you can make, too, like renting instead of owning a house, or earning big bucks while living in a small apartment, then escaping to freedom once you are financially well-off.

But always challenge the expensive-city option. This country is full of fantastic, gleaming cities with a low cost of living and nice climate and recreation options. Apply for jobs there. Move. There’s usually no need to be a small fish fighting for scraps in a big pond like Washington. So go big, or go elsewhere. One of the best decisions I ever made was moving 1,500 miles from my birthplace to live here in Colorado, for example.

Is mostly what you talk about lifestyle choices or do you think there are policy changes Washington could make that would encourage more people to live this way?

The great thing about this country is that we’re all free to go completely against the flow and prosper in our own way. But it would be nice if the government didn’t subsidize self-destruction quite so heavily, burdening its own citizens with inefficiency.

For example, we could change the tax policy to encourage energy conservation and discourage waste, while remaining revenue-neutral. Tax the hell out of gasoline to reflect the true cost of it, like every other country in the world does. Ensure that every road which receives federal funding places at least as much priority on bicycling as on personal autos.

While these changes would initially annoy people who are in the habit of driving, the shift away from spending almost all our money (and time) on transportation would feed back into the economy in the form of more productive, healthier and happier people, lower road costs and all sorts of other things.

I don’t think you can effectively invent government policies to limit the way marketing is done, but you could reduce income taxes and shift some of them to consumption taxes. And discourage consumer debt while increasing the incentive for capital investments.

You must really scrimp in your daily life. How do you eat well, for instance, and keep the food budget under control?

My family eats so well, it is almost embarrassing. Enormous gourmet feasts of fresh organic food. It doesn’t cost much because we prepare it ourselves at home rather than paying someone else to make it, and we buy some ingredients in bulk at stores like Costco.

Do you see frugal tendencies in your son?

At age 7, he’s definitely becoming a cute, little disciple.

He rides his bike to school, even when it’s 20 degrees outside. He prefers making his own toys with me in my workshop to buying them in the store, because he is rarely exposed to TV ads. So his piggy bank tends to accumulate in an uninterrupted fashion.

I hope for his sake that this trend continues.

You’ve built quite a following on the blog. How do you keep it from becoming a job?

Although it is a rewarding pastime, I try to put the blog last on my to-do list these days, in order to prioritize living the actual early retiree lifestyle that the readers are there to read about. If I stay home all day and write, I’ll quickly run out of adventures and frugality life lessons to write about.

How do you define the word ‘retirement’?

According to me, retirement means you no longer have to work for money. You then proceed to do whatever you like, without regard for whether or not it earns you money.

I try to promote the idea that rewarding, meaningful work is an important part of retirement for many of us. If you don’t allow work as part of “retirement,” many people say, “I’m never going to retire, because I like working.” And they use that as an excuse to always spend everything they earn, which leaves them job-dependent and addicted to high consumption for life.

Regardless of what you do, it’s better if you don’t need the money.

What’s your idea of a great vacation?

I really like Great American road trips, where we bring tents and mountain bikes and stay in a bunch of beautiful places, riding the wilderness trails in each. In big cities, we’ll still get a hotel in a nice spot and bike around to explore the city, but the real joy for me comes whenever I get a chance to put some effort into the vacation — either physical or mental, like figuring out how to make blackened fish tacos on a camp stove.

In short, what are the main ways to live well on less?

Embrace challenge and shun convenience for its own sake. Ask, “Will this really make me happier in the long run?” about all life decisions. Realize that happiness comes from accomplishment and personal growth, rather than from luxury products. Seek out voluntary discomfort as a way to become stronger, rather than running from it. Develop a healthy sense of self-mockery, and acknowledge that you are a wimp in many ways right now (and only by acknowledging it can you improve). Practice optimism. And of course, ride a bike.

That’s pretty high-level stuff. If you just want the meat and potatoes: Live close to work. Cook your own food. Take care of your own house, garden, hair and body. Don’t borrow money for cars, and don’t drive ridiculous ones. Embrace nature as the best source of recreation. Cancel your TV service. Use a prepaid cellphone. And of course, ride a bike!

Related stories: As economy recovers, the richest get richer Post Live: Kitchen Table Economics - a discussion on personal finance Michelle Singletary: The Color of Money

Read the whole story
pmaaaah
4412 days ago
reply
Share this story
Delete