Quote from GTS:
Jim, you don't know the validity of my credentials any more then other posters on this thread so really the burden is on you to investigate any statements made and come to your own conclusions. If you routinely rely on anonymous internet postings as the primary basis for making important decisions then you get what you deserve. Again - personal responsibility.
Frankly I find your passive aggressive posting style rather juvenile and I'm not talking just about this one thread. I will not be drawn into your little game where you dictate the argument and attempt to control the discussion.
More security is a good thing but security is always a trade-off between reducing risk vs. cost, convenience, etc.
IB is taking a positive step with this announcement. Asking them to implement umpteen additional different measures to prevent a hacker from doing things to your account after they have gotten control of your machine with TWS already logged in is not the right approach to the problem.
The right approach is to prevent a hacker from ever getting control of your machine in the first place which is not such an impossible task as implied by an earlier poster.
SL65, there are always new malware coming out and there are exploits that haven't been published but how would any of that affect your trading machine? You do have a hardware firewall that is blocking all unsolicited incoming traffic, right? You don't use your trading computer for email or browsing random web sites do you? Basic stuff here, not rocket science. Now, how did the hacker get the trojan on your machine so that they could hijack your TWS session?
GTS,
I thought it was well established, among IT security professionals, that the best approach is to use multiple layers of protection, in case something goes wrong with any one of the layers. You argue that we should rely on only one layer, and assume that we can prevent anything from going wrong with that one layer. You argue that we should assume we can, always and infallibly, prevent a hacker from taking control of our trading machine; and that we should not make any attempt to protect against a hacker who has done so.
I'm sorry, but I have zero confidence in your assurances, and I agree with the others that multiple layers of security are needed, and that security measures should attempt to protect a customer even after a hacker seizes control of the customer's machine.
I think that if you could support your argument on the basis of true expertise, you would not need to descend to personal criticism, name-calling, and childish accusations.
You also, as to the topic, misunderstood me. I do not, as you suggest, "routinely rely on anonymous internet postings as the primary basis for making important decisions". I instead questioned your own argument that we should rely on
your credentials as the basis for accepting
your recommendations.
I think I posed some important and challenging questions, which you have not addressed. I am sure many of us would appreciate it if you could re-read my previous posting and address the questions I raised about your credentials and your risk assessment. I presume you have ignored my questions, because the weakness of your position leaves you unable to answer them.
Quote from jimrockford:
So we should believe your risk assessment, because you are in the IT security field. Is it your belief that everybody having credentials equal to your own, or greater than your own, agrees with your risk assessment? If yes, then doesn't this conflict with other professional viewpoints already previously expressed in this thread? If no, then doesn't disagreement between the experts undermine your argument that we can rely on your credentials and reassuring words?
Another issue: Your posting could be interpreted to say that a hacker cannot loot an IB customer's brokerage account, unless he gets control of the customer's machine using a custom malicious program developed to interface with the API. I don't believe it was your intent to make such a statement. I suggest you clarify so that people who do rely on your credentials won't misunderstand you.
