zlacker

>>thirty+(OP)
Mitnick was a hacker hero of mine in my youth. I think I’ve understood his role as jester prior to conviction less as I’ve grown older, but there’s something about the boyhood charm of being so divorced from the potential consequences of one’s actions that is almost unique.

Mitnick had so many stories that entranced the people around him. I heard one second hand of Mitnick dealing with a bank who had early voice verification software. Upon meeting the CEO he gave the executive his card and departed for the evening. Arriving back at his hotel, he called the CEO and asked him to read his phone number to him. The phone number contained all ten digits which Mitnick had neatly tape recorded so as to make the CEO’s voice reproducible. He then proceeded to use the bank’s vocal banking system to transfer $1 from the CEO’s account to his as the authentication mechanism was reading out your own account number in your voice.

When Mitnick arrived back in the board room the architect of the voice verification system was crestfallen and the bank CEO delivered a check on a silver platter.

Now how much of that tale is embellished I will never know as it was second hand, but that was the kind of whimsy Mitnick brought to our world.

Rest in Power.

>>josh26+W3
How would he have known the CEO's bank account number? Did the CEO write him a check at some point? Or maybe a bank's CEO traditionally gets account number 1…

>>tomjak+A5
> How would he have known the CEO's bank account number?

Welcome to the american banking system.

>>77pt77+LE
The european bank account numbers are often posted publicly. If you are a VAT payer, you're supposed to check that the account you send money to is registered with the business in the public registry. Otherwise you may be held liable for the receiver's tax fraud. Many companies also show them at their webpage to make it easier to get paid. See e.g. https://www.pre.cz/en/contacts/bank-details/

The account number should be just an ID, not authentication mechanism.

>>krab+TF
> The account number should be just an ID, not authentication mechanism.

Right? One of the many things (and I mean this without any hate whatsoever) I simply can't and will never understand about the US. A bank account number is your mailbox for receiving money. How does that country even operate when they build those mailboxes underground?

>>oli-g+ZG
You send the money to a literal mailbox instead. That’s how.

(Using a check, the very infrastructure we’ve been talking about!!)

>>sclari+X01
But then you've given out your bank account number, so the secrecy is bunk.

>>thfura+2f1
The US bank security system confuses me. To accept money, I need to give out my routing number and account number. Using those numbers, someone could theoretically withdraw money... Maybe... The whole system is built upon obscurity. Why do some stores need a pin on my debit card, and some do not? Why do online stores need my name and address, but IRL ones do not? How did that one online store charge me without my CVV? How can restaurants swipe my card now and charge me later?

I only send and receive money with Google/Apple Pay & PayPal at this point. This flow is reasonable (every transaction is authorised in a trusted location (ie: PayPal). Further transactions are impossible without additional authorization). It boggles my mind that banks & CC companies haven't made some standard for this. Would save them so much money in fraud protection.

>>intern+ZR1
And banks are still perfectly willing to issue personal checks, a form of payment that requires you to hand someone a piece of paper with your full name, address, bank account and routing info, your signature, and a brief handwriting sample.