seriously who is going to see your username AND happen to be a master hacker to sniff the network and gain access to your account? Even if someone gets both username and password, they still need access to your email address, then they would have to transfer money to an (authorized)account without alerting you .
Security
- Thread starter lilboy716
- Start date
Quote from Gringinho:
lilboy,
you are of course correct, and many of the current trading platforms do not have sufficient security in my view. SSL is truly weak and offers no comfort on it's own either.
When I was developing secure customer login I always included a security token which would be updated and passed along with every transaction. This would be a MD-5 checksum which was calculated on a password from a circular list of passwords and a timestamp to validate the time frame it would be allowed to use. The MD5 checksum is one of the fastest "encryption" methods out there - and it's lossy as a checksum. I won't explain further on this technique - but those who understand it get the point.
The point is that a password and SSL alone does not hinder anyone in mediating into your communication stream - or snooping.
...
So there might be hope for many of those laid-off IT experts out there - if daytraders truly become prolific in the markets once again - which I personally think will happen (is starting to already).
...
Well, enough rant I guess - most of this is probably way out of most traders fathom/reach anyway.
Great stuff -- keep it coming. There's actually a broker out there with software that because of a technical hitch makes you think that someone else has logged into your account. So while you're freaking out, the rep on the other end is telling you not to worry about it -- that message is happening because of so-and-so. Most brokers will tell you yup, we've got fault tolerance and redundancy and backup servers but yet the same shit happens over and over. Most probably do not understand the term "single point of failure" but yet today there goes someone's CME feed bouncing up and down like Paris Hilton.
But yeah, bottom line is that your broker (especially for a remote trader) does not really give a shit and in fact is probably secretly giggling if you blow your wad one day. Hey, didja see what happened to asstrader today?
so instead, the hacker just logs on to your accouunt, totally for his or her own amusement, and makes trades... this makes LOTS of sense...
or... this devious, mythical hacker we are all worried about steals your username and password. then he goes diving in your trash can and gets your social security number, address, blah.. blah.. blah... then he goes to the bank, flashes fake id, and opens an account in YOUR name... then he transfer YOUR money from your broker to the falsified, named bank account, takes the money, and runs...
what would YOU do, waste time trading somebody else's account for no gain, or commit real identity theft and make a profit?
if you have a substantial account, i would worry about the REAL criminal.
believe or not, there are traders AND criminals making a profit.
trade your own account and make a profit as well, or become a master cyber-criminal and make your living that way.
in any case, understand the risks and rewards, then stop sweating them, and inverst your energy in making some bucks.
btw: if your broker sends email confirmations of your trades, you can have them sent to your phone. at least you'll know if somebody is trading it. if the broker doesn't support that but has an API, you can do the same thing yourself. so, if you are really concerened about somebody trading your accout for you, at least you can get notification and intervene immediately.
or... this devious, mythical hacker we are all worried about steals your username and password. then he goes diving in your trash can and gets your social security number, address, blah.. blah.. blah... then he goes to the bank, flashes fake id, and opens an account in YOUR name... then he transfer YOUR money from your broker to the falsified, named bank account, takes the money, and runs...
what would YOU do, waste time trading somebody else's account for no gain, or commit real identity theft and make a profit?
if you have a substantial account, i would worry about the REAL criminal.
believe or not, there are traders AND criminals making a profit.
trade your own account and make a profit as well, or become a master cyber-criminal and make your living that way.
in any case, understand the risks and rewards, then stop sweating them, and inverst your energy in making some bucks.
btw: if your broker sends email confirmations of your trades, you can have them sent to your phone. at least you'll know if somebody is trading it. if the broker doesn't support that but has an API, you can do the same thing yourself. so, if you are really concerened about somebody trading your accout for you, at least you can get notification and intervene immediately.
and in any case, lilboy, i don't understand your argument.
you are worried about sombody stealing your username and password. you've decided this is bad.
you are not worried, as i understand it, about malicious trades or somebody stealing cash from your account.
soooooooooooooooo.... what is your concern? if they steal your username and password but don't do anything with it that worries you, who cares?
you are worried about sombody stealing your username and password. you've decided this is bad.
you are not worried, as i understand it, about malicious trades or somebody stealing cash from your account.
soooooooooooooooo.... what is your concern? if they steal your username and password but don't do anything with it that worries you, who cares?
malacious trades are of the utmost concern.
its harder to steel cash from your account as you should've known.
here's the deal: i am raising awareness of people using brokerage services. i can sniff my own packets, i can tell if things are being display in the open or not. i use my brokerage on my home computer, and theres only one hop in between the connection.
its harder to steel cash from your account as you should've known.
here's the deal: i am raising awareness of people using brokerage services. i can sniff my own packets, i can tell if things are being display in the open or not. i use my brokerage on my home computer, and theres only one hop in between the connection.
if it's awarness you want to raise, let's cover that.
() don't fund an account, any account, until you understand and agreee to the terms and conditions and you have weighed the risks vs. rewards. make an informed decision. you don't have to trade if the risks are too high for you. if worrying about hackers is going to disrupt your beauty sleep, put your money in a CD instead, or buy property, or open a business. at least you'll have a different set of worries.
() these risk we have been discussing are not particuarly new to the trading business. for years now, anyone with the proper account information and passwords could have done the same over the telephone.
() these risks exist not only at your broker. your web-managed bank account, your atm card, your 401k plan, your credit cards and rating, paypal, etc. are all at risk in the same way. with just a little information, anyone can open and account for you, or close one, or transfer funds, or make large, malicious payments with your electronic bill pay, destroy your credit rating by getting new cards in your name or overcharging your existing cards, get a driver's license with their picture but your name, address, and id number, etc, etc, etc.... there are many, many risks to your identity and financial resources in this digital age and the risk is not isolated to your brokerage account. let's be fair to the brokers. they are no better nor are they worse than the rest of the financial industry.
() what can you do? work with the best people and services avaiable. check your balances and transactions frequently. protect, as much as possible and practical, your personal information. put your money in more than one account so that the risk is distributed. check your credit rating periodically. understand the risks, be realistic, and live your life accordingly.
() don't fund an account, any account, until you understand and agreee to the terms and conditions and you have weighed the risks vs. rewards. make an informed decision. you don't have to trade if the risks are too high for you. if worrying about hackers is going to disrupt your beauty sleep, put your money in a CD instead, or buy property, or open a business. at least you'll have a different set of worries.
() these risk we have been discussing are not particuarly new to the trading business. for years now, anyone with the proper account information and passwords could have done the same over the telephone.
() these risks exist not only at your broker. your web-managed bank account, your atm card, your 401k plan, your credit cards and rating, paypal, etc. are all at risk in the same way. with just a little information, anyone can open and account for you, or close one, or transfer funds, or make large, malicious payments with your electronic bill pay, destroy your credit rating by getting new cards in your name or overcharging your existing cards, get a driver's license with their picture but your name, address, and id number, etc, etc, etc.... there are many, many risks to your identity and financial resources in this digital age and the risk is not isolated to your brokerage account. let's be fair to the brokers. they are no better nor are they worse than the rest of the financial industry.
() what can you do? work with the best people and services avaiable. check your balances and transactions frequently. protect, as much as possible and practical, your personal information. put your money in more than one account so that the risk is distributed. check your credit rating periodically. understand the risks, be realistic, and live your life accordingly.
I don't understand why brokerage firms that currently offer online services still don't get additional INSURANCE about this type of things: you know the use of SIPC is about widespread, why not use additional insurance to cover eventual customer damage by illegal trading activities, security breaches (internal (broker firm) or external (customer)), and so on?
Why customers must take all the risks of online trading (including internal risks)? I don't think this is fair.
I would like brokers to provide customers some complete trailing log (with IP numbers and so on) everyday, some additional insurance about internet and security risks, at least to reduce eventual big losses, and some additional security measures.