|
|
Post by solicitorious on Jan 4, 2017 9:56:42 GMT
I have become aware of and very concerned about the propagation of browser extensions/helpers on the wider forum. While I have no evidence to impugn the motives of any individual who has "offered" such tools so far, it remains a fact that the mechanism of these add-ons is identical to what are known as "Man-in-the-Browser" attacks, which can bypass all security of banks and financial institutions. p2pindependentforum.com/post/160347/threadThe mods have taken note and are trying to formulate a policy. My view is NO, NOT EVER should this forum encourage the use of ANYTHING which purports to modify a platform while the user is logged in to his/her own account. The risks are too obvious, and well-documented. As P2P matures and grows it is inevitable that security threats will multiply. We should always be vigilant to such threats, which of course may include attempts to "social engineer" the acceptability of such threats, by peer pressure, adopting the guise of experts, etc by elements on the forum. I expect representatives of the platforms would also wish to add their input, as a matter of urgency. |
|
|
|
Post by d_saver on Jan 4, 2017 10:06:37 GMT
As a 30 odd year IT veteran, I'd like to temper that a bit.
Of course, if you are not familiar with these things, have any doubt whatsoever, do not use them. It is not work the risk.
However, the contributions of a few on the forum, one in particular on the SS board are completely open. They include a notice of the risks, but anyone with an understanding of code can _very_ easily read what the code is doing, what might be possible and what it actually does.
If in doubt, don't touch it, but I would not like a statement such as you posted to tarnish the work of a few genuine and welcome efforts here.
My advice, if using code such as the one posted for SS is to read it. If you do not understand what it is doing, do not use it. TURN OFF AUTO UPDATE.
Vigilance and a healthy does of scepticism should keep you on the safe side.
|
|
|
|
Post by GSV3MIaC on Jan 4, 2017 10:13:44 GMT
/mod hat off FC already did - they gave tacit approval to Lonerifle's scripts (which involve pretty complex javascript injection into FC webpages). SS are certainly aware of the 0risk scripts, and have made no comment (or attempt to defeat them). Personally I have no problem using Grease/Tamper monkey to automate boring things that the platform failed to do for me (obviously I'd prefer the platform to do it) AS LONG AS I can eyeball the script (or wrote it myself), keep it on my own PC (no remote access, and no 'auto update'), and accept that if it goes pear shaped it is my own fault. The web stopped being a safe/friendly place when JS escaped into the wild, but it's a bit late to re-bottle the genie now (he's too useful). Yes, 'if you don't understand what you are doing, probably better to not do it', but you'll have a hard time selling that to the 98% of internet users who think it is done with magic. And if people are going to run the scripts (they are) I'd rather they were posted publicly for peer review than 'passed around in plain cover by email and PM'. I guess it should be made clear that the forum doesn't champion / warrant the scripts in any way, and that there are, for sure, risks in everything (even telling IE or Firefox it can remember your password for you). p.s. that's in reply to the OP .. d_saver typed faster than me! |
|
|
|
Post by solicitorious on Jan 4, 2017 10:23:16 GMT
As a 30 odd year IT veteran, I'd like to temper that a bit. Of course, if you are not familiar with these things, have any doubt whatsoever, do not use them. It is not work the risk. However, the contributions of a few on the forum, one in particular on this board are completely open. They include a notice of the risks, but anyone with an understanding of code can _very_ easily read what the code is doing, what might be possible and what it actually does. If in doubt, don't touch it, but I would not like a statement such as you posted to tarnish the work of a few genuine and welcome efforts here. My advice, if using code such as the one posted here for SS is to read it. If you do not understand what it is doing, do not use it. TURN OFF AUTO UPDATE. Vigilance and a healthy does of scepticism should keep you on the safe side. The "notice of the risks" was he didn't know, despite his optimistic username, what they were... Hardly encouraging, but it didn't seem to stop a lemming-like rush to install his widget. Take note also that the author is located in a far-off continent. You can dress it up however you like, but most people here are not "30 odd year IT veterans" and sometimes may need a little protection from themselves. In any case, you don't refute any of my basic contentions regarding the advisability and risk of using these "gifts".
|
|
|
|
Post by d_saver on Jan 4, 2017 11:22:23 GMT
As a 30 odd year IT veteran, I'd like to temper that a bit. Of course, if you are not familiar with these things, have any doubt whatsoever, do not use them. It is not work the risk. However, the contributions of a few on the forum, one in particular on this board are completely open. They include a notice of the risks, but anyone with an understanding of code can _very_ easily read what the code is doing, what might be possible and what it actually does. If in doubt, don't touch it, but I would not like a statement such as you posted to tarnish the work of a few genuine and welcome efforts here. My advice, if using code such as the one posted here for SS is to read it. If you do not understand what it is doing, do not use it. TURN OFF AUTO UPDATE. Vigilance and a healthy does of scepticism should keep you on the safe side. The "notice of the risks" was he didn't know, despite his optimistic username, what they were... Hardly encouraging, but it didn't seem to stop a lemming-like rush to install his widget. Take note also that the author is located in a far-off continent. You can dress it up however you like, but most people here are not "30 odd year IT veterans" and sometimes may need a little protection from themselves. In any case, you don't refute any of my basic contentions regarding the advisability and risk of using these "gifts". There is risk in everything we do. People investing in p2p especially better be aware of this. There is certainly risk in installing any third party software, visiting web sites, crossing the road, etc. I totally agree with you. If you do not understand the risks or cannot quantify them, stay away. It's a personal opinion, but I do not agree with the general philosophy of blocking something that might be dangerous for the protection of all, however uneducated they might be in the area concerned. I am sure 0risk stated the risks as unknown to cover himself of every eventuality, as pretty much any software license does if you read it. There are some clever people here. If someone posts some source code openly and there are gaping security holes in it, I would be surprised if that wasn't discussed. Per the last post, if the source code is posted openly here and you see no negative comments after months of use, that's about as good and safe as you are going to get (IMO). Certainly, if it were closed source or a third party web site I was giving my credentials to, etc., no way I would likely touch it... Again, anyone not quite following along would best be advised to stay away. In all my time with a ridiculous number of clients, I would say in excess of 90% of the security issues were a case of users doing something stupid. I agree that users should always proceed with a dose of caution, but I think a call for the ban of such scripts on the forum would not stop people using them and would do more harm, given they may become less visible and transparent and possibly less reviewed by people who might advise others of the risks you mention.
|
|
registerme
Member of DD Central
Posts: 6,184 
Likes: 5,991
|
Post by registerme on Jan 4, 2017 11:32:59 GMT
It's an interesting and useful debate, so thanks to solicitorious for starting it (and better depersonalised and not platform specific as well). I'd like to add a few other, perhaps more mundane, points for consideration:- How is the code maintained and updated? What happens if the author goes awol? Who supports users of the code? What happens if usage results in a DDOS attack on a platform? What happens when a platform changes its site and breaks such code? What happens if some takes the code and uses it on another platform / the tool's usage proliferates? Should auto-update be turned off by default? If it is, how are new releases of the code managed? What happens if there is a security breach? |
|
|
|
Post by solicitorious on Jan 4, 2017 11:54:37 GMT
|
|
|
|
Post by bracknellboy on Jan 4, 2017 12:04:16 GMT
....... There are some clever people here. If someone posts some source code openly and there are gaping security holes in it, I would be surprised if that wasn't discussed. Per the last post, if the source code is posted openly here and you see no negative comments after months of use, that's about as good and safe as you are going to get (IMO). .... ......I agree that users should always proceed with a dose of caution, but I think a call for the ban of such scripts on the forum would not stop people using them and would do more harm, given they may become less visible and transparent and possibly less reviewed by people who might advise others of the risks you mention. MOD HAT OFF (in case of doubt, esp. as this is under discussion by staff) I would agree that - given that a genie is out of the bag (to mix metaphors) - it is significantly better to have such things posted out in the open where the source can be reviewed, and it can be discussed. It is highly unlikely that the forum would be able in practise to ban the sharing of such via the forum - even if it was deemed desirable to do so - it could be done behind the scenes. So even if we wanted to ban we could not police and as such from a security point of view better in the open. MOD HAT ON There are however other concerns for the forum. For example, could use of such cause breach of platform Ts and Cs, and if so where does that leave the "forum" if it is in effect acting as a vehicle for distribution of such ?
|
|
|
|
Post by GSV3MIaC on Jan 4, 2017 12:38:01 GMT
/mod hat off I don't think there is a crime of 'assisting in the breaking of T&Cs', which are between users and platforms. If a platform objects to the automation I am sure they will let us know about it (there are several sets of automation already running, to check things like SM availability). In reply to registerme .. How is the code maintained and updated? .. by the original author, or anyone who takes over (but only the original author can edit the 1st post in the thread which is where the 'official version' is supposed to abide. What happens if the author goes awol? .. support stops, unless someone wants to take it over Who supports users of the code? .. the original author, or anyone who wants to offer (free) advice. No warranty was offered or implied. The SS script seems to be groupware .. several people have already chipped in free improvements. What happens if usage results in a DDOS attack on a platform? .. The platform pulls the plug on offending IP addresses (FC, SS and others have done this in the past in response to 'over frequent polling for changes'). What happens when a platform changes its site and breaks such code? .. see 'how is code maintained'. There is a small, but non-zero, risk that the platform could make a change which had 'very bad result for script users' (especially anyone who went for full automation) .. e.g. if they change the place which tell the script 'You have £x of this loan', then an automated script could keep buying and buying and buying and never see it had got any. None of the public scripts have implemented 'auto buy', but some FC bots certainly do. What happens if some takes the code and uses it on another platform / the tool's usage proliferates? .. up to the platform(s) .. if they feel it is having negative impact they a) tell users, and if the user persists then b) pull the plug on the IP address(es), or adopt a defensive posture (like reCaptcha on SS, to as least hamstring a bit the SM bots). Should auto-update be turned off by default? If it is, how are new releases of the code managed? .. Definitely. I thought 'auto update off' is the Greasemonkey/Firefox default (?), Tampermonkey/Chrome appears to need reining in? New release should only be installed when the user says so .. anything else is very dangerous (despite what we are told by Java, Adobe, uSoft, Mozilla, etc etc?!) What happens if there is a security breach? .. Bad stuff, about the same as if a platform gets hacked, or the forum ads start serving malware again. Basically any time you "open up" a system to permit good stuff to happen, you enable a quantity of bad stuff to happen too (and you get an interesting debate about which bits are which!). Tamper/Grease monkey opens up the browser and gives a lot of control back to the users (instead of the web page authors). Scope for good/bad in equal measure. |
|
|
|
Post by solicitorious on Jan 4, 2017 12:40:26 GMT
And if they multiply uncontrollably, or metastasise [as they surely will, given time]? Who is going to take responsibility for monitoring them in all their versions for evermore?
A glance at some of the recent threads gives a glimpse of the future, with god-knows-who collaborating on modifying this stuff almost the instant it is released!
e.g.
"None is issued by the script. I have those "BLOCKED BY CLIENT", and I believe it is the Adblock extension. No problem there.
But this gtm.js may be interfering. It seems something like Google Tag Manager. Do you have any extension with the name resembling Tag Manager or GTM ? Try disabling it to see if that's the issue."
Do this? Try this? No problem? Disable this? Press this?
Anyone understand any of it? What could possibly go wrong?
We know P2P is risky-enough. Why introduce and promote further uncontrolled risk?
Let these geniuses play - at their own risk, in their own bedrooms - while others encourage the platforms to give their customers the secure functionality we request.
|
|
SteveT
Member of DD Central
Posts: 6,873
Likes: 7,918
|
Post by SteveT on Jan 4, 2017 12:55:19 GMT
(Mod hat off)
No-one is forcing anyone to install or use such a browser extension or script. Indeed, it looks like it would involve a fair bit of personal time / effort to do, so it's not something people are likely to do unintentionally.
Arguably this forum already "encourages" risk-taking amongst its members by openly discussing the potential profits to be made through P2P lending (especially at the riskier / unsecured end of the spectrum). Personally I have no problem with the way this particular script has been explained and shared for "informed personal use"
Bottom line is that if you don't understand what you're doing then don't do it.
|
|
fp
Posts: 1,008
Likes: 853
|
Post by fp on Jan 4, 2017 13:03:45 GMT
I would love to sit back and let a script do all the work for me, but I do not understand how it works as I don't understand code, although i've never tried to, and as a result would never try and use the scripts, I would hope anyone else in my position would take the same approach.
For someone who does understand code, and can see how the script does its thing, then it should not be a problem.
|
|
daveb4
Member of DD Central
Posts: 220
Likes: 116
|
Post by daveb4 on Jan 4, 2017 13:25:55 GMT
My biggest risk in P2P as I see it is someone or thing getting into the platform or my account and taking my money. Therefore I diversify across loans AND platforms.
I do not understand script so therefore do not use it as well as the risks as above.
I just hope the platforms IT can cope with any risks attached to these scripts?
|
|
stevio
Member of DD Central
Posts: 2,065
Likes: 894
|
Post by stevio on Jan 4, 2017 14:35:34 GMT
Appreciate the discussion, although put forward a little forcibly, I think due to concern more than anything else
Warrants a large WARNING text at the top of that thread at the very least in the meantime
We have a lot of expertise on these forums - maybe the moderators could ask someone with such expertise to 'keep an eye' on the (these threads) so users are kept fully aware of the risks involved? After all, the forum is here to help others
I would like to ask - do browser extension's that monitor websites for changes (and effectively keep you logged in) have any risks people need to be aware of?
|
|
james
Posts: 2,205
Likes: 955
|
Post by james on Jan 4, 2017 16:06:00 GMT
I would like to ask - do browser extension's that monitor websites for changes (and effectively keep you logged in) have any risks people need to be aware of? If, like the tools specific to P2P linked to here, they have entirely readable source code and are reasonably small and simple they are as sensibly safe as those P2P tools are, without need for significant concern. In general the direct financial site risks would come from things like an ability to change bank account details and withdraw money or to make secondary market transactions to benefit a crook. Those are vulnerabilities in the P2P platform more than in the tool that might exploit them. The main risk issues aren't so much direct tool issues but rather the creation of different classes of customer depending on tool use or not. That can compromise the value of the platform to others and lead to the platform effectively rewarding and encouraging use of the tool. Better to eliminate the benefit of the tool with platform tools that a platform can manage and provide to all customers at the highest levels of security.
|
|
