Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

There was actually a high-profile incident not too long ago with one of the big banks' online banking system. Users could view other people's account information just by incrementing an integer in the URL as I recall. It's not necessarily so much that banks are secure, but hacking them is much riskier than hacking Bitcoin sites, especially for white-hats.


Are you thinking of Heroku? Heroku isn't a bank.


It was probably Santander: http://www.h-online.com/security/news/item/Santander-s-onlin..., though there have been other instances of bad bank web practices.


Putting plaintext passwords in a cookie doesn't sound anything like incrementing an integer in a URL.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: