Making Sense of Mismatched Certificates? 322
Ropati writes "I bank with capitalone.com. Recently I went to log in to my credit card account, and my browser reported that the site certificate didn't match the web site I was on. [Expletive.] I'm wondering if I am getting a poisoned DNS URL. I have to log in and do my banking, so I accept the mismatched certificate. The banking site is complete, my transactions are listed but that doesn't mean there isn't a man in the middle attack here. I am still curious how much I have exposed my banking assets." Read on for more, and offer advice on how to interpret what sounds like a flaky response from the bank.
Ropati continues "On the Capital One login page, there is a Verisign link on the page to check that the website is suppose to match. So I click on the verification icon and I am rewarded with a link to Verisign. They report that this web site certificate is for onlinebanking.capitalone.com not the servicing.capitalone.com where I log in. Is this the mismatch my browser reported. I know nothing about certificates.
I call Capital One and ask them to fix the problem. If this was a browser issue on my part, then the Verisign link should match. The tech support supervisor, Joe — XRT413, said he couldn't do anything about it and he couldn't escalate the problem to someone who could.
So my questions are: Are the certificates a mismatch or is my browser bellyaching for nothing? Is the certificate mismatch a security hazard? If someone poisoned my local DNS routers would it be obvious in the URL? How would I prevent such a thing? If everything was working correctly, would the certificate alert me to DNS poisoning, or is this just cosmetic security?"
Not nothing. (Score:5, Informative)
This is a misconfiguration on their end. EV certificates, the ones that turn your address bar green and coax turtles into doing happy dances, are really expensive. It's my guess that they've either reused a certificate on another system, or one of their developers made a mistake in how the site and server cluster is configured. It's certainly something to complain about.
If you're ever in doubt about the validity of the certificate or security of a transaction, however, DON'T DO IT!. This goes for standing at an ATM in a shady neighborhood or doing business online.
Re:Not nothing. (Score:5, Funny)
Dude, post your login details and I'll check it out for you.
Re: (Score:3, Insightful)
I don't know why anyone has their money in large banks anymore. Move it to a local credit union and let those large bank fuckers die out. "Too big to fail" my ass. They haven't been paying FDIC for the last 10 years since "it wasn't necessary".
Re:Not nothing. (Score:4, Insightful)
There's a quadrillion dollars in Derivatives. (That's not a hyperbole).
Many large banks hold over a trillion dollars in Credit Default Swaps.
All CDS contracts have a universal default provision.
As much as it pains us all, these banks really are too big to fail. That needs to be fixed. We simply cannot have corporations that are so essential that we taxpayers must "insure" them. But that's tomorrow's fight. Today we just need to survive.
Re:Not nothing. (Score:4, Insightful)
Derivatives contracts (Score:3, Interesting)
Re: (Score:3, Insightful)
a) You are a private individual who doesn't have time to do a detailed analysis on your insurance company's balance sheet. A very large bank, on the other hand, should know how to look at AIG's balance sheet and determine how liquid they are. They have people who know and understand finance.
b) The type of disasters that could cause people to make claims on their fire hazard insurance canno
Re: (Score:3, Insightful)
The way to fix it, basically, is massive socialism to carry people through the hard times of losing most of their retirement, their houses, and their jobs. We can move back to a more capitalist system in the future if it ever looks like a good idea.
Or simply prosecute for fraud.
They were providing securities with money they didn't have -- how else but fraud can one interpret that that they never intended to pay out regardless of circumstance?
Re:Not nothing. (Score:5, Insightful)
The funny thing is is that people think the guys getting screwed are the homeowners who got to live in a home they never would have been able to afford in normal times.
The people who got screwed are all the foreigners that bought these assets thinking their money was safe AAA rated stuff. Now they are being told that they bought a bunch of worthless garbage.
The real problem now is that they have caused an incalculable amount of damage to the reputation of our financial system as being a safe place to invest money. The government has to bail all these people out to show that they will stand behind all these too big to fail crooks and make good on their lies in order to maintain confidence.
Re: (Score:3, Informative)
Insuring them may present no tangible benefits to you, but letting them fail is certainly going to present tangible harm. Example: When Lehman Brothers failed unexpectedly, many money market funds were adversely affected. These funds then sold their other assets into the corporate bond market, flooding it and essentially shutting it down. Because the market was shut down, many large corporations were faced with the probability of not being able to make payroll, as they were unable to get cash from their
Re: (Score:3, Insightful)
Actually forebearance and big penalties later -- is another option. That or Nationalization for a temporary period to get investigators in, clean them up, and hand them back to different leadership and shareholders.
Maybe if the current shareholders take a hit, they'll learn to do proper oversight of the Board of Directors "next time"...
There's LOTS more options than "failure". The issue right now is in the government being CONSISTENT about how they're going about it. One bank allowed to fail, another pro
Re: (Score:3, Insightful)
"Too big to fail" my ass.
There is still hope. They are rapidly becoming small enough to fail.
Re: (Score:3, Interesting)
I don't know why anyone has their money in large banks anymore. Move it to a local credit union and let those large bank fuckers die out.
If you check your routing numbers, you might just find that those local credit unions, and other local banks, are clients of the "big banks". My credit union is/was a client of Wamu.
Re:Not nothing. (Score:5, Funny)
My login details are username:tkw954 password:*********
Hey that's weird. Slashdot must automatically replace your pw with stars.
Re:Not nothing. (Score:5, Funny)
You can hunter2 my hunter2ing hunter2. You can't see hunter2!
Re:Not nothing. (Score:4, Funny)
That's odd, it shows a different number of stars than your password really is. Guess that's to avoid giving even its length away. Clever!
Re: (Score:3, Funny)
Re:Not nothing. (Score:5, Insightful)
Well, but both certificates were for capitalone.com subdomains. In this case, I wouldn't worry too much about it. I'd complain, but it's more of an annoyance than a security risk.
I'd worry a lot more if one certificate was for capitalone.com and the other for capone.com or capitolone.com or capital1.com or something like that. Then you've got a problem.
Re:Not nothing. (Score:5, Insightful)
Bitch, don't excuse. The whole point of this exercise was to allow the customer use the site without putting their info in danger and in a manner that doesn't require having a degree in "teh internets" to get through.
It should never be the customer's responsibilty to bring a maginfying glass to the certificate and manually verify that these were just subdomain mismatches and not some clever capitalone.com vs capitlone.com spelling that means to look correct to someone just scanning the screen. That is a security risk, whether or not it is currently exposing your info, it's training you to expect that sort of problem and to ignore it the same way people ignore the dialog boxes XP and VISTA pop up on errors.
Re:Not nothing. (Score:5, Insightful)
Yep yep. Buying a new cert for every subdomain is wildly expensive, so these sorts of errors happen reasonably often.
In a lot of cases the subdomain may be separated from the main domain only for possible load balancing issues, so it's doubly not worth getting a specific cert for a subdomain which may never take off.
In the end it's a problem because the consumer gets used to accepting bad certs as a matter of course, and that leads to people accepting "capitolone.com" instead of "capitalone.com". Basically the registrars need to be pimp slapped a bit: certificate registration shouldn't cost anywhere near what it does, certificates should be purchasable for whole domains, etc.
Re: (Score:3, Funny)
No no no, at godaddy they're only 29.95!!!! Only the highest quality stuff for the bank!
Subdomain certs (Score:3, Insightful)
They are. You don't have to buy a new cert for every subdomain. If you have a lot of subdomains to secure the best solution is to get a wildcard certificate.
Re:Subdomain certs (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Better to get a signing certificate, so you can create and sign your own subdomain certificates. Those are expensive, but Capital One should be able to afford one.
Better yet, screw VeriSign, they should self-sign and give the user a print out of the certificate fingerprint when they open an account, and have the website walk them through downloading, verifying, and installing their certificate when they register for online banking.
Re: (Score:3, Informative)
mod parent up!!! (Score:3, Interesting)
Self-signing is the only sensible way to use certificates.
CAs should only be used in the same way that USians use notary publics. The certificate should be treated like a notary's seal. (And priced the same.)
But the CAs can't even behave like notaries until they get proper time stamping implemented.
The standard itself was never debugged, and every purveyor of snake oil fudges whatever part of the standard that gets in the way of their patent formula.
Sorry to be negative, but it gets kind of fatiguing, watch
Re: (Score:3, Insightful)
Its obscurity 2.0 - Security through poverty.
Re: (Score:2)
Wildcard certificates do exist [digicert.com] and aren't that expensive. We use them and they seem to work fine for most things (with 1 or two non-HTTP-server exceptions)
Re: (Score:2)
Re:Not nothing. (Score:5, Informative)
No CA is (currently) issuing wildcard EV certs. I personally understand the convenience of the wildcard cert, but I do also accept and support the practice of disallowing wildcards in high security applications.
EV certificates are available with multiple Subject Alternative Names, though so the whole "dropped www." or a couple of virtual shouldn't be a big deal if things are done correctly. Unfortunately they aren't and some sites (paypal) that are using EV SSL certs don't even bother with this simple feature.
The correct failsafe implementation which will always result in a no-prompt situation is to ensure that you only deploy EV certificates on an IP addresses that have only one DNS name. You then deploy a frontend redirection server on a second IP using a wildcard SSL cert that occupies the alternative dns names for the namespace of the original app. This server will pass cert checks more easily and then redirect to the EV server with its specific dns name which will then show the green bar. Any existing deep links to the application on an incorrect DNS name will be handled correctly and any direct references will work in the future. There are of course implications for securing said redirection proxy, but they aren't really that hard to overcome.
Re: (Score:2)
Re:Not nothing. (Score:5, Informative)
Well, it's good to worry any time there is a mismatch. It can be easy to fake legitimate looking URL's using UNICODE characters and such.
Consider something that looks like like:
https://onlinebanking.capitalone.com/login/.tsdk.cn?login
The whole first part could be the host name: "onlinebanking.capitalone.com/login/" and the domain is actually "tsdk.cn". This would be using the UNICODE symbol for mathematical division that looks like a forward slash. It looks like a capitalone.com domain even though you're going through some scammer site. Marlinspike talked about this exact attack at Blackhat 09.
Re:Not nothing. (Score:5, Interesting)
Also, lets not forget that a while back some children hacked into Comcast's DNS registrar with nothing more than an unsophisticated Social Engineering ploy.
If the capitalone domain registration ever became compromised, 'hijackeddomain.capitalone.com' would have the same 'root' domain as capitalone.com, but could be pointed at a hackers server in timbuktu.
Just because the domain is 'capitalone.com' does not necessarily mean that everything set up with a vanity off of it is hosted, owned, or operated by capitalone (or more importantly; that they're not owned and operated by someone who possesses malicious intent, be it a disgruntled capitalone employee or otherwise).
Last, the aforementioned domain registration social engineering end-around could theoretically be pulled to obtain a legitimate SSL Certificate. Maybe not specifically by targeting Verisign (at least, not as easily as other companies, I'd venture a guess), but any number of the other more generic and less valuable companies like GeoTrust are all plausible to target with this sort of ploy.
Re: (Score:3, Interesting)
Perhaps it would help--for some of us, at least--if browsers indicated how many sections of the domain matched (with the comparison performed from right to left)? After all, the browser won't be fooled by such trickery.
In the submitter's case:
Cert: onlinebanking.capitalone.com
Site: servicing.capitalone.com
2 sections match, this is probably safe (but proceed cautiously)
In the parent's case:
Cert: onlinebanking.capitalone.com
Site: onlinebanking.capitalone.com/login/.tsdk.cn
Danger! 0 sections match. This
IE 8 does! (Score:3, Informative)
It looks to me as though IE 8 does just this. The matched part of the url is in a bolder face than the rest of the address. Cool!
Re: (Score:3, Insightful)
This is why I train new users to look for the domain name at the bottom right of the status bar next to the lock in Firefox, because it's too hard to explain to a beginner how to parse an https URL and the browser takes care of all the tricks in extracting the domain name that you're connecting to.
Re: (Score:3, Interesting)
This will become a greater issue as unicode domain names come into prominence. I believe that right now while Firefox "decodes" any unicode so that the characters look like the underlying hex (or something) so that a non-english character can NOT be confused for a real one.
For instance in certain fonts lowercase "L" (l) looks EXACTLY like an uppercase "i" (I). In others it doesn't. Now in your example that can't happen, but what about www.travelocity.com or www.traveIocity.com? (I used a capital "i" in t
Complaining is kind of pointless. (Score:4, Insightful)
You're end up in some call center and the agent will have no clue what you're talking about -- they will recommend clearing cookies, restarting the browser (and maybe switch to IE). The message will never get up the food chain. The only real way to get the message is to close your account and switch to a bank that takes sucurity seriously.
Re:Complaining is kind of pointless. (Score:5, Interesting)
WARNING: RANT...
I hate to say it, but I agree that you'll never get anything fixed by a call center. I've worked in call centers and the people who work there generally have no way to speak to anyone who can fix a problem, even in a "tech support" call center. Also, since they either get paid per call, or at least get docked pay if they aren't actively answering incoming calls, then they have no incentive to fix anything. In fact, they have a big disincentive against fixing anything since it will take away from their pay check and they likely hate the company too much to do it on their own time.
Also, I've been on the other side doing development and it's a similar problem there. It's very easy to make a simple typo or other mistake and never know the difference. No one in the call center ever tells you that the customer is having a problem, so you don't know that something needs to be fixed. So even though it might be a 1 minute fix for you, you'll never know that it needs to be done. There was a bug in this one software that had been there for 3 years, and the workarounds were even in the documentation to train new call center employees. Once a developer finally got it, it took seconds to fix. The customers suffered for 3 years for a few seconds of someone's time. Now I realize you can't fix every bug, all the time, but if the right people don't know about it, then it will never get fixed.
The real problem, IMHO, is that large companies treat their support/customer service departments like they are a drain on the company rather than a way to increase your reputation, thus outsourcing, low pay, strict rules, etc.
Because of this I prefer to do business with smaller companies or, even better, in person. If you're a "real person" standing in line at a bank, the teller is more likely to fix a problem than if you're just a number on a screen and a squeaky voice on a phone. But in-person is so inconvenient in this world of constant multitasking.
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
...I've been on the other side doing development and it's a similar problem there. It's very easy to make a simple typo or other mistake and never know the difference. No one in the call center ever tells you that the customer is having a problem, so you don't know that something needs to be fixed....
I ran into this problem when I worked for Digital Equipment Corporation, and came up with a solution. I was the one from our software development group who went to Colorado Springs to train the telephone support troops. I developed a rapport with them, and they allowed me read-only access to their call logs for the product. I would pass bug reports to the rest of the development group. In addition, I was able to provide feedback to the support people about incorrect or incomplete responses to customers.
Re:Not nothing. (Score:5, Insightful)
You find it amusing. I find it reason to sack your sorry ass.
Security is a chain of referential components designed (and hacked at constantly) in the attempt to ensure safety. Civilians don't know a bad certificate from a live hand grenade, and both can blow up in their face. Security is a state of mind-- if you have one. Lotsa people don't and rely on cogent web developers for their safety.
Re: (Score:3)
Re:Not nothing. (Score:5, Insightful)
Can't agree more. See this example of a MITM attack. [mozilla.org]
Re:Not nothing. (Score:5, Insightful)
Exactly. When you proceed despite an SSL error, you most likely are falling victim to a screw-up on the bank's end, but you are possible falling victim to a MITM attack. There is no way for you to know conclusively.
That's really the end of the discussion.
Re: (Score:2)
But it happens a lot (Score:2)
I guess if we all complained until we were blue in the face, businesses -might- make more of
Browser issue (Score:4, Interesting)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
That also takes about six seconds of the company's time to fix by adding two lines to an .htaccess file. A problem that simple should never require the customer to wonder if their financial data is in harm's way.
Re: (Score:2)
Re: (Score:3, Insightful)
Oooh, so close! the parent said "domain.com" not "https://domain.com. Thus you would be entering an http site (by default). Your .htaccess would then redirect to "https://www.domain.com".
If he typed in "http://domain.com", then yes, you would be correct.
No (Score:5, Funny)
It's all a scam and we're all laughing at you. While spending your money. Thanks for the good times.
Answers (Score:5, Informative)
Hello, IT, have you tried turning it off and back on again?
Ah... another tech support call. Sure, what's the problem?
Are the certificates a mismatch or is my browser bellyaching for nothing?
Yes. And maybe yes too.
Is the certificate mismatch a security hazard?
Common sense would suggest it wouldn't be in a big popup dialog labeled "WARNING" if it wasn't.
If someone poisoned my local DNS routers would it be obvious in the URL?
No.
How would I prevent such a thing?
Stop clicking "Okay" or "Yes" to every security warning you don't understand.
If everything was working correctly, would the certificate alert me to DNS poisoning, or is this just cosmetic security?
If the certificate isn't properly signed, a warning like the one you were presented with should throw a dialog box in the web browser.
Re: (Score:2)
IMO the browser should just block access to the site. Then they have to fix it. Why implement security features that throw up warnings the user is expected to ignore? That's a rhetorical question, please don't try to justify this behaviour.
Re: (Score:2)
The problem is that things that are self-signed get dumped into the same buckets as bad ones. So any gear I have that I want to get to with a self-signed certificate, I have to click through all sorts of warnings to get to an HTTPS session, and in your scheme, they'd just lock me out of my networking gear. And you think that makes sense?
Re: (Score:2)
Your argument is another "the user is stupid" assumption, those are getting out of hand. If I tell the browser to do something, it should f**king do it.
Re: (Score:3, Insightful)
"If the certificate isn't properly signed, a warning like the one you were presented with should throw a dialog box in the web browser."
*Nothing* from a web site should throw a dialog in a web browser. Dialogs are annoying things that block your entire application. They make it all to easy to create denial of service attacks (just keep throwing dialog boxes). They are also easy to click away by mistake (just hitting enter in an entirely different application seems to do it).
I love the way FF3 shows you that
Eh ? (Score:2)
My browser has no problem with their cert. And Im using a particularly picky browser (firefox 3.07).
A non-story?
Re: (Score:2)
It seems to have been fixed already.
I would not worry about the problem when 1) onlinebanking.capitalone.com is working as it should be and 2) when the certificates of onlinebanking.capitalone.com and the misconfigured servicing.capitalone.com match.
Also, the top level domain is the same, you it seems far fetched that the DNS is configured incorrectly. That is, IF you are using internet from a relatively safe location, otherwise your routing and DNS may be attacked quite easily.
It's fixed, but that does not
Re:Eh ? (Score:5, Insightful)
Capital One IT staff: "Oh shit, we're on /."
2nd C1 IT staff: "Oh fuck. I'll bet it's the certificate."
*phone rings*
"Oh shit, it's the CTO's number."
CTO: "Why the fuck are we on slashdot's front page?"
And presto, Capital One's certificates have been fixed.
It's not like they're the only bank, you know (Score:5, Insightful)
Seriously, there's a bank on every corner. Unless you have some compelling reason to stay with Capital One, open an account elsewhere. You don't even have to close your Capital One account -- save it as a backup.
That's what I did when Bank of Texas (aka Bank of Oklahoma) added so-called "security questions". The first time I failed at answering "What was your first pet's favorite food?" (or something similarly stupid), I changed my direct deposit to put $1 a paycheck there, and move the rest to an account at a financial institution with a better understanding of Internet security.
Speaking of financial institutions, why are you still banking at a for-profit (ha!) institution, anyway? I've got one credit union that doesn't charge an overlimit fee on my credit card, and another that's paying over 4% interest on my checking account. Why can they do that? Because they didn't take stupid risks 10 years ago. I should know -- they wouldn't give me a home loan. The bank that did was first in line for a taxpayer bailout [cbsnews.com].
Re: (Score:2)
It's nice seeing blatant honesty! Very funny. I see you've not had a problem paying your internet and slashdot subscription fees. ;)
Re: (Score:2)
Like I tell the kids... the big rocks [appleseeds.org] go in the bucket first.
Re: (Score:2)
That's what I did when Bank of Texas (aka Bank of Oklahoma) added so-called "security questions". The first time I failed at answering "What was your first pet's favorite food?" (or something similarly stupid), I changed my direct deposit to put $1 a paycheck there, and move the rest to an account at a financial institution with a better understanding of Internet security.
My Credit Union does this too. I just treat it like a second password. I actually sat down with the manager and talked to him about it.
Probably not a problem, but... (Score:2)
A mismatch at the third level of the domain name is probably a configuration screw-up on Capital One's part. It shouldn't be possible for a third party to get a certificate for a capitalone.com subdomain.
If, however, somebody did get a certificate for onlinebanking.capitalone.com, then Capital One's only defense is to change the subdomain they use and hope that people who've been hit by a DNS poisoning or other man-in-the-middle attack pay attention to the certificate mismatch.
A few things about SSL (Score:5, Interesting)
The first thing to note is that SSL covers the host-to-host connection and is ignorant of higher-level protocols. There are a couple of things which can cause SSL mismatches:
1) SSL cert is set up to one hostname that the machine services, but site is on another. The SSL negotiation happens prior to the host headers being processed. This could be solved by browser controls (i.e. do a rDNS lookup on the cert's host and make sure it matches the IP you are connecting to), but this ends up causing other, more serious issues, because different sites on the same server could be controlled by different parties. Hence if you have a shopping cart, I could re-use your cert on my shared site on the same box, spoof your page, and steel credit card numbers. So the browser behavior is correct.
2) The SSL cert could have been accidently re-used (unlikely).
My general rule is that if the hostname's TLD matches with the cert (capitalone.com), but the most host-specific portion does not (servicing vs online banking), this is reasonably (though not completely) safe to ignore. Revoked certs should ALWAYS be treated with suspicion because you don't know why it was revoked. Expired certs.... Well, it depends. There are other things that can cause certs to be improperly shown as expired so that demands more careful consideration.
Re: (Score:3, Informative)
SSL cert is set up to one hostname
The parent is for all intensive purposes is correct. Class 3 SSL certificates are assigned to a common name (foo.com). Unless the certificate contains a wild-card, it ill not work for bar.foo.com. It will however work for foo.com/bar.
It sounds like the bank in question has a Class 3 for CN=bank.com and their webapp is located at online.bank.com. The browser caught the mismatch and throws a warning.
Please alert the webmaster of the institution with a full description of the error.It's easy to resolve
Re: (Score:2)
The cert I got was good. Maybe they repurposed some servers around in the pool of servers behind load balancers, and one or more didn't get their certs updated for the new purpose (e.g. changed from "onlinebanking" to "servicing"). Or maybe the OP really did have a MitM attack.
Pure genius! Say the quiet part loud! (Score:5, Funny)
This reminds me of an story. A friend and I were moving a heavy couch and at an inopportune time he got flustered and said 'Hold on, we need to put this down and take a break'. We did, finished moving it later and that was that.
About 6 months later out of the blue he explained to me that he had to put the couch down because the apparently strained a bit too hard and pooped his pants.
I have no idea why he told me, much less told me 6 months later. He was kind of a weird guy.
The moral of this story is:
If you do something embarassing or stupid and privately get away with it, don't tell anyone.
my company's secure login for employees (Score:2)
has a mismatched certificate. something like www.ourdomain.com not matching subdomain.ourdomain.com
i don't know enough about SSL and certs to tell you that subdomain, as opposed to domain, mismatches are exploitable. but i know in my particular instance, its just laziness on my company's part, and it smells like someone just dropped the ball on a configuration at capitalone
i know in my company's case i complain about it, but nothing ever gets done about it (until we get exploited i bet)
significant spaces (Score:4, Funny)
What is "Cap It Alone"?
Doesn't sound like a website I'd entrust my financial information to...
Now you know... (Score:2)
Now you know why I no longer bank with Capital One. They not only are really not concerned at all with their security, but they really could care less about you; their customer. I had nothing but issues with them and just closed everything up and moved on.
Doesn't surprise me... (Score:5, Informative)
An ID Thief opened a Capital One account in my name. They had my name, address, SSN, and DOB, but got my mother's maiden name wrong. Capital One approved the card anyway. Then, when the thief immediately changed the address (from mine to another address), before even activating the card, it didn't raise any red flags in their systems. Then, when the thief tried to get a $5,000 cash advance on the card (still not activated), it didn't raise any red flags in their systems (though they denied the advance). Then, when I called them, they refused to give me any information on the theory that I could "go and shoot the guy and they would be liable." Instead, I had to have a police officer call a special "cops number." The police officer called that number and got a recording which apparently no one ever returned phone calls from. At every step of the way, Capital One seemed to be going out of its way to protect itself *from* me and my ID Theft investigation instead of caring about the fact that it was an accessory to ID theft. Needless to say, I won't ever do business with Capital One again.
Re: (Score:2)
What did you expect Capital One to do? Reject the seemingly valid app because they got your mother's maiden name wrong? That question is there for verifications purposes after the account's already open and you call customer service. How would Capital One know your mother's maiden name to verify that for account opening purposes?
I do agree that trying to change the address before card activat
Re: (Score:2)
Needless to say, I won't ever do business with Capital One again.
Maybe, but someone with your name, address, SSN, and DOB will likely be banking with them again in the near future.
Re: (Score:2)
At every step of the way, Capital One seemed to be going out of its way to protect itself *from* me and my ID Theft investigation instead of caring about the fact that it was an accessory to ID theft.
That's really no surprise - the entire reason the term "identity theft" was created was to redirect responsibility from the banks for being accessories to fraud. Nobody steals an identity, they steal money from the bank by exploiting weaknesses in the bank's system. But call it identity theft and the fact that it was the bank's failure to protect itself adequately against fraud is not so immediately obvious and that since your identity was involved it is at least partially your fault.
Re:Doesn't surprise me... (Score:5, Informative)
I was going to reply with my own tales of Capital One woe, the $500 credit line with the $50 overlimit fees, the annual fee they charged after I cancelled, the continuing flood of "offers" (with worse and worse fine print). But I can't, because I'm laughing too hard at the banner ad at the top of the page.
I've run-not-walked from Capital One ever since my one and only experience with them, and if this situation (and their bannermania) is any indication, everyone else should too.
Re: (Score:2)
The same thing could happen at any bank.
It's bad, but Capitalone is no different.
"Then, when the thief tried to get a $5,000 cash advance on the card (still not activated), "
This happens all the time from legitimate customers.
Curious why you think they should give you all that information based on a phone call.
That would mean someone could claim to be you and get your banking information.
That handled that part in a way that minimizes chances at social engineering through that vector. That was a good thing.
"
It worked for me (Score:2)
It worked for me. The server certificate I got was valid (issued 2008-10-02, expires 2009-10-15, for "servicing.capitalone.com"). There could be many problems causing this.
http://skapare.ipal.org/servicing.capitalone.com.cert.general.png [ipal.org]
One is that the actual server (of many servers they are running through load balancing port redirectors) you connected to doesn't have the right certificate (e.g. they didn't install the new one on all servers ... maybe new servers coming online and the update of renewed
Re: (Score:3, Informative)
Banks? Seriously? (Score:5, Interesting)
I don't really understand why any individual with regular "banking" needs would use a bank today. Credit unions are non-profit, and generally, because of their structure, are run much better than banks are. My credit union has been impacted 0% by this banking mess stuff. I'm earning 4% on my PERSONAL CHECKING account, and not paying any fees. I also have all of my business accounts, and my mortgage with my local credit union.
Credit Unions: Like banks, but cheaper, non-profit, less corrupt, no over-paid executives, and not out to screw you over.
Ropati writes "I bank with capitalone.com... (Score:2)
well, there's your problem right there
was it the retro arcade game commercial that suckered you in?
admittedly, they nailed the music on that one perfectly
The obvious solution... (Score:3, Insightful)
Right conclusion, wrong procedure (Score:3, Informative)
OK, your bank screwed the pooch and you should complain - LOUDLY - until it's fixed. You should also look for a bank that understands basic internet/web concepts like "SSL cert's CN must match DNS hostname" -- I fear for the rest of their infrastructure.
That said, you were logging into your bank, which presumably holds a large percentage of your cash assets, you received a SSL error and you continued the transaction?
You deserve to have your account cleaned out for reckless disregard for the security of your financial information. Go to a brick-and-mortar bank, or call them on the telephone (*gasp*) if your banking is so urgent.
Re:Right conclusion, wrong procedure (Score:5, Insightful)
"You deserve to have your account cleaned out for reckless disregard for the security of your financial information. "
no no NO. No one deserves that, stop pandering the insurance companies line.
If you car is not locked, you don't deserve to have it robber, if you leave a window to your house, you do not deserve to be robbed. if you windows are easily breakable, you do not deserve to be robbed. If you were a short skirt, you do not deserve to be raped.
You deserve to live in a world where you don't have to lock everything.
Verisign ? (Score:2)
MOre proof (Score:2)
that real massive online and electronic banking will fail.
There are more and more way to compromise systems technically and socially due to the nature of computers.
There's something very wrong here. (Score:5, Informative)
Something strange is going on here. Capital One's main site [capitalone.com] returns a certificate for the correct domain, but the certificate is invalid. This isn't a wrong-domain issue; the cert is bad. CN="www.capitalone.com", the dates are valid, the issuer is Verisign, but it won't validate in Firefox. Our own system, SiteTruth, which uses OpenSSL, also indicates it's no good. But neither Firefox nor OpenSSL is producing a useful error message. It looks like this certificate is either corrupted or bogus.
The location ("L") in the cert is Glen Allen, VA. Capital One has a facility in Glen Allen, according to Google, and it looks like a huge warehouse. So that's probably their data center, at 4871 Cox Rd, Glen Allen, VA - (804) 270-4104.
A traceroute ends at "capitalone-gw.customer.alter.net", which doesn't mean much one way or the other.
Their stock has dropped from 55 to 12 since September 2008. If you have any money in there above the FDIC insurance limits, get it out now..
capitalone.com (Score:3, Funny)
Here's an idea (Score:4, Insightful)
Re: (Score:3, Informative)
Great for phishing sites, totally useless for man-in-the-middle attacks.
Re: (Score:3, Informative)
Electronic Banking is Regulated: COMPLAIN (Score:3, Informative)
Electronic banking is heavily regulated. If you feel your concerns are being taken seriously by the bank you need to head on over to the federal reserves website and file a complaint. The Federal Reserve will forward the complaint to the correct regulating facility and banks will respond or be fined.
http://www.federalreserveconsumerhelp.gov/ [federalres...erhelp.gov]
Re:Looks fine to me (Score:5, Informative)
Seconded. The certificate is correct.
I don't know what that verisign link is all about but it is useless.
You certainly cannot trust information within a web page to verify the identity of the server.
Click on the the little 'lock' icon on the bottom right corner of your browser to inspect the certificate.
Re:Looks fine to me (Score:5, Interesting)
Exactly. They were stupid. They gave a server an alias, and didn't realize that it will throw an error to the clients. It probably worked fine in their dev environment though, where they probably accepted the wrong cert and saved the exception because they got tired of clicking the link. :)
Being that he ignored the error, didn't view the cert to see what it was really assigned for (and continued on to give his login information), it proves that most users don't really care, and will provide their security credentials regardless if they've been warned that there is a problem or not. The cert could have been for bad_haxor_inc.ru, but since he didn't look, he doesn't know.
We have to assume that it's a mixup with the servicing.capitalone.com and onlinebanking.capitalone.com hosts, but we don't know.
Why didn't they just buy a wildcard cert? They're so much easier to work with. :)
Re: (Score:3, Informative)
Re:Looks fine to me (Score:4, Informative)
Similar thing happens whenever I try to log into my virginmobile account. https://virginmobileusa.com/ [virginmobileusa.com] has a certificate for www.virginmobileusa.com