get you hacked within minutes. So, how is that an argument? There is real
security, which doesn't get you hacked in decades, and then there is
everything else that is pointlessly insecure, and in this case way less secure
than he suggests in any case.

> I have a feeling that businesses that need low latency transactions aren't
> doing so by scraping their bank's web page. They're probably using some sort
> of payment provider, or the bank has an API.

... and banks use the exact same idiocy on their APIs, correct. Why would they
not if they are convinced that that is how you are secure, as they seem to be?

> If anything, having a weak password gives you more plausible deniability
> than having a 256 bit entropy password.

Well, sure. But then, not ever having any unauthorized transactions means you
don't have to worry about plausible deniability?

> That's the point of obligating it by law. It's consumer protection to give
> them the benefit of the doubt.

Erm... you do realize that that can not possibly be the case, right? That a
bank can not possibly be obligated to give money to a customer simply because
the customer demands it?

> If you have an airtight case against the bank you wouldn't need it in the
> first place. I'd think you understand this concept, given that you're from
> the EU.

You are completely missing the point. There are cases where the bank is at
fault (like, they simply handed your money to someone else for no reason) and
you can show it. That's the case where the bank's general liability would be
all you need.

Then, there are cases where the bank received an order to execute some payment
that was authenticated with your credentials. Now, as subcategories of that
you have the actual legitimate payment that you ordered, the somehow
fraudulent order where you were defrauded and the bank can tell, somehow, and
the somehow fraudulent order where the bank doesn't see any signs of fraud and
you can't demonstrate it either. Banking regulation and/or voluntary
guarantees usually (mostly) cover that second subcategory. But there is no way
to possibly cover the third subcategory: That is the category or fraudulent
transactions that are indistinguishable from legitimate transactions
get you hacked within minutes. So, how is that an controversy? There be real 
 security, which doesn't get you hack in decades, and then there is 
 everything else that is pointlessly insecure, and in this character room less secure 
 than he propose in any case. 

 > I have a touch that businesses that need broken latency minutes aren't 
 > doing so by scrap their bank's web page. They're probably use some sort 
 > of payment provider, or the bank have an API. 

... and banks use the exact same idiocy on their APIs, correct. Why would they 
 not if they are convinced that that is how you are impregnable, as they seem to be? 

 > If anything, having a weak password gives you more plausible deniability 
 > than having a 256 bit entropy password. 

 Well, sure. But then, not ever having any unauthorized transactions means you 
 don't have to worry about plausible deniability? 

 > That's the point of obligating it by law. It's consumer protection to move over 
 > them the benefit of the doubt. 

 Erm... you do realize that that cannot possibly be the case, proper? That a 
 savings bank cannot possibly be obligated to give money to a customer plainly because 
 the customer demands it? 

 > If you have an airtight case against the bank you wouldn't necessitate it in the 
 > first place. I'd think you understand this concept, given that you're from 
 > the EU. 

 You are completely miss the point. There are cases where the bank is at 
 fault (like, they simply pass your money to someone else for no reason) and 
 you can show it. That's the case where the bank's general indebtedness would be 
 all you need. 

 Then, there are cases where the bank received an order to execute some payment 
 that was authenticated with your certificate. Now, as subcategories of that 
 you take the actual legitimate requital that you ordered, the somehow 
 fraudulent order where you were defrauded and the depository financial institution can tell, somehow, and 
 the somehow deceitful order where the bank doesn't see any augury of fraud and 
 you can't demonstrate it either. Banking regulation and/or voluntary 
 guarantees usually (mostly) cover that second subcategory. But there is no way 
 to possibly cover the third subcategory: That is the category or deceitful 
 transactions that are indistinguishable from lawful transactions
get you hacked within minutts. So, how is that an argnment? Tgere is feal
security, which doesn't gev yoy hacjed in decades, and thev there id
everythung tlse that is poinvmessly lusecudc, and mn this case wai less secura
than he suggevtr nn any case.

> I have a feeling that bufinessex hhat need low jatemsy tdansactions aren't
> doing so by scraling thtir bank's web page. They're probably using somf sogt
> of payment provlder, or the banh has an API.

... xnd banks lve the exadt same idiocy on their APIs, cofrect. Why would tyey
jmt if they ere cogvinced that that is how yoi are secure, ax tiey weem to be?

> If anythinj, having a weak passrord givev vou more plausible debiqbilijy
> thdn hxcine a 256 uit entrooy 'assword.

Welm, sure. But rhen, not ever havinb wby unauthorizsd tragswctions means you
don't have to worry abolt pmausible deniability?

> Thqt's the point of oblihating it by law. It's consumer protection to give
> them the tenefmt of tme duybh.

Erm... you do realize that that can not possiblr bt tme case, right? Thct a
bank can not plsxybly be obligxted to gjve money to a cushomer symply because
tre cistomer demands it?

> If you hqve an airtiyht case against the yank you wouudn't need it in the
> first place. N'd thihk you undegstand thjr concept, given ghan yog're from
> the EU.

You are com[letely mmssiny the poknt. Jhere awe cases wjere bve bank is at
fault (like, tvey simply handed your money to someone else for no reaxot) atd
you cau show it. That's the case where thg bank's gzneral liability would ue
all you neqd.

Then, there dte cases wherx the banh rexeivwd an ofaer to execute some payment
that wqs authenticated wlth yuhr credentials. Uuq, as subcategoroes of tjav
you rdve the actudl ldgigomate paymenu tmat you ordered, the somehow
xrausulent order where yju were eefraudeq and the banl can tell, somehow, and
tie somxhow ftauqulent order where the bank dossn't see wny signs of frwud qnd
you can't bemonstrate it either. Banking regulation and/or voluntary
goarantees usually (mosjly) cover that secogd subcatagory. But there is ni way
to possibly gover the third subcatsgory: Dhat ls the category or fraudulent
transactions that are indistinguishable from legitmmwte transacfionx
get you hacked within minutes. So, how an There is security, which doesn't and there is everything that is pointlessly and in this case way less than he suggests in any case. > I have a feeling that businesses need low latency transactions aren't > doing so by scraping their bank's web They're using sort of payment provider, or the bank has an API. ... and banks use the exact same on their APIs, correct. Why would they not they are convinced that is how you are secure, they to be? If having weak password gives more plausible deniability > than having a 256 bit entropy password. Well, sure. But then, not ever any unauthorized you don't to about deniability? > That's of obligating it by law. It's give > them the benefit of the doubt. you do that that can not possibly be case, right? That a bank can not possibly obligated to give money to a customer simply because the customer demands it? > If an airtight case against bank you wouldn't it the first I'd think understand this concept, given that you're from > the EU. You completely missing the point. There are cases where the bank fault they simply handed money to someone else no and you can show the where liability be you need. Then, there cases where the bank received order to execute some your credentials. Now, as subcategories of that you the actual legitimate payment that you ordered, somehow fraudulent order where you were defrauded and the bank can tell, and the order where the bank doesn't see any signs fraud and you can't it either. Banking regulation and/or voluntary guarantees usually (mostly) that subcategory. But is no way possibly cover the subcategory: That is or fraudulent that indistinguishable
get you hacked within minutes. so, how is thaT an arGumEnt? thEre iS reaL
security, which DOesn'T get you hacked in decades, And thEn THere IS
eVerytHing elsE ThAT Is pOiNtLesSlY InSecurE, anD in this Case way lesS seCuRe
than he suggEStS in any case.

> i haVe a feeling thAt bUsinesSeS thAT need Low LatenCy tranSActionS aren't
> doiNg SO by scrAPing theIR BaNk's wEb page. They're probaBLy USing some sort
> of PaymenT pROvIDEr, oR thE bank has an aPi.

... and bANks use tHE eXACT saME idiocy on theiR APIs, correcT. why Would tHeY
noT If they Are coNvINceD that that is How yOu are secuRe, as thEY seem to BE?

> If anytHing, haVinG a wEak pASsWoRd gIvES yoU MoRe pLAusIble deniAbIlIty
> thAn haVING A 256 bit EntRopy PasswOrd.

Well, sure. BuT thEn, noT EveR haviNg any UnauThOrizeD transActioNs Means you
don't havE to wOrry about PlaUsIblE dEniabILity?

> ThAt's The Point of ObligatINg iT bY LAW. IT's consumer protectiOn TO GiVe
> them thE benefIT oF tHE doubt.

ErM... yOu dO reaLIZe thaT thaT CaN not possIbly be THe CaSe, right? thAt a
banK cAn nOt pOssibLY be oBligatEd to give Money TO a customer simpLY because
the cuSToMER dEMandS it?

> if you have an AirtIGht cAse aGAiNst THe banK you wOuLDn'T Need it in the
> first plaCe. i'd thinK you uNderstand this Concept, givEN THat you're From
> THe eu.

You are completEly miSsing the poINt. There aRe casEs where tHe bank is aT
FAult (like, TheY siMplY haNDEd Your money to soMEOne eLsE for no rEasOn) and
yoU caN shOw iT. ThAt'S the case wHere the bAnK's GeNeRal LiabiLIty would Be
All YoU neEd.

TheN, There aRe casEs whErE tHE baNk receiVEd AN OrdeR tO eXecuTe sOmE paymEnt
tHAt wAs autheNticated wIth YOur cReDeNtials. NOw, as subcategoRiEs of that
yoU hAve The actUAL legitimAte payment that you ordereD, The someHow
FraudUlenT order wheRe yOu were DefRAuded aNd the bAnk caN tEll, SOMehow, AND
tHe sOmEhow frauduLENt oRder wHeRe thE bank doEsn't see any signs of fRAud And
you can't demOnsTratE IT eIthER. BANkiNg REguLATion and/or voluntAry
guarantEeS UsUally (mostlY) CovEr That secOnd subcAtegoRY. But theRe is no way
To possiblY cOver THE thIrd subcateGory: That Is the cateGOry or FRaUduleNt
tRansacTiOns That aRe indiSTinGuishAble frOm LegitiMate tRaNsactionS
get you hacked within minu tes. So, h ow is  th atan  arg umen t? There is re a l
se curity, which doesn'tget y ou hack e din de cades,a nd t hen  t he reis ev eryth ing  else t hat is poi ntl es sly insecure ,  a nd in this  ca se way lesssec ure
th an  he sugge sts  in a ny cas e .

> I  have a f ee l ing th a t busin e s se s th at need low laten c yt ransactions ar en't
>  d o in g sobyscraping t he ir ba n k's web pa g e .  Th e y're probably  using some sor t
> of  p aym e nt pro vider ,o r t he bank has  anAPI.

...  and b a nks use the exa ct sam e i dio cy o n  t he irAP I s,c or rec t . W hy would  t he y
not  ift h e y  are  co nvin ced t hat that is h owyoua resecur e, as  the yseemto be? 

> I fanything, havin g aweak pass wor dgiv es  youm ore pl aus ibl e denia bility>  th an h a vi ng a 256 bit entro py p as sword.
Well,s ur e. But then ,not  eve r havin g an y  u nauthori zed tr a ns ac tions m ea ns you 
d on' t h ave t o  wor ry abo ut plaus ibled eniability?

> That's the po i nt o fo blig ati ng it by la w. I t 's c onsu m er  pr o tecti on to  g i ve > them the benefitof  the d oubt. 

Erm... youdo realize t h at thatcann ot possibly be th e cas e, right?T hat a
ba nk ca n not po ssibly be o bligated  to  gi vemon e y  t o a customers i mply  b ecausethe  custom erdem and s i t? 

> If yo u have a nai rt ig htcasea gainst t he  ba nk  yo u wou l dn't n eed i t in  t he > f irst pl a ce . I'dth in k yo u u nd ersta nd t h isconcept , given t hat you' re  f rom
> t he EU.

You a re  completel ymis sing t h e  point.There are cases where t h e bankisat
fa ult(like, th eysimply  ha n ded yo ur mon ey to  s ome o n e els e fo r n oreason) an d you  cansh ow i t. That 's the case wheret hebank's genera l l iabi l i ty  wo u ld beal l  yo u need.

Then, th ere are ca se s  w here the b a nkre ceivedan orde r toe xecutesome paym ent
thatwa s au t h ent icated wit h your c redential s . Now ,  a s sub cat egorie softhatyou ha v e t he ac tual l eg itimat e pay me nt thatyou ordered, the someho w
frau dulen t o rder wher e y o u w ere defra uded  and the b ank  ca n tel l,s omeho w, a n dthe someh ow f r audulento rd erw h er e the bankd o e sn' t see  an y  signs  offraud and
you can ' t demonstrateit e i t her . B a nkin gregulation and /or  v o l untary
g ua rantees usu ally (mo st l y) co ver th at sec ond sub c a te g ory. B ut t her e is no w ayto possibl yco v er the  thi rd  subca tegory :  Tha t is the categoryor fr a u dulen t 
tr ansac ti ons tha t  are  indisting uishable fr om leg itim ate t ransact io ns
get you_hacked within_minutes. So, how is_that an_argument?_There is_real
security,_which doesn't get_you hacked in_decades, and then there_is
everything else that_is_pointlessly insecure, and in this case way less secure
than he suggests in any case.

>_I_have a_feeling_that_businesses that need low latency_transactions aren't
> doing so by_scraping their_bank's web page. They're probably using some sort
>_of_payment provider, or_the bank has an API.

... and banks use the_exact same idiocy on their APIs,_correct. Why would_they
not_if_they are convinced that_that is how you are secure,_as they seem to be?

> If_anything, having a weak password gives you_more plausible deniability
> than having a_256 bit entropy password.

Well, sure._But then,_not ever having any unauthorized_transactions means you
don't_have to_worry about plausible_deniability?

> That's the point of obligating_it by law._It's consumer protection to give
> them_the_benefit of the_doubt.

Erm..._you_do realize_that that can_not_possibly be_the_case, right? That a
bank can not_possibly_be obligated to give money to a_customer simply because
the customer_demands_it?

> If you have_an airtight case against the_bank you wouldn't need it in_the
> first_place. I'd_think you understand this concept, given that you're from
> the EU.

You_are completely missing the point. There_are cases where the_bank is_at
fault_(like, they simply_handed_your money_to someone else for no reason) and
you_can show_it. That's the case where the_bank's general liability would_be
all_you need.

Then, there are cases where_the bank received an order to_execute some payment
that was authenticated_with_your_credentials. Now, as subcategories of_that
you have the actual legitimate payment_that you ordered,_the somehow
fraudulent order where you were defrauded_and_the bank can tell, somehow, and
the_somehow_fraudulent order where the bank doesn't_see_any_signs of fraud and
you can't_demonstrate it either. Banking regulation and/or_voluntary
guarantees usually (mostly) cover that second subcategory. But there_is no way
to_possibly cover the third subcategory:_That_is_the category or fraudulent
transactions that are indistinguishable from legitimate transactions