I've been trying to keep up with what has been going on with regard to John's issue late last week with coComment and Citibank, and I wanted to post an update today after reading this post by Pete Spire Lindstrom of Spire Security on his blog, about how John hasn't "acknowledged" his participation in this situation.
While I will "agree" to correct John in saying that he didn't mention in his post that he obviously posted the message to Citibank through its online messaging system, he did say to me, on multiple occasions, that he did it by accident the first time, and thought nothing of it until he happened to log in and see that he had coComment updates later on last week. I don't disagree that John was obviously the "push" to what went on in his situation - as were three other unsuspecting users who just so happened to not blog about it, and potentially don't know, even now, that this happened with their messages - but that doesn't hold Citibank (or coComment, or John) harmless. Pete insinuates that someone else wrote John's post, which most certainly isn't the case, and I'll 100% vouch for him as a colleague and friend. Working for a public relations agency, I think that both of us know better than to go off on unfounded attacks on companies when we haven't at all tried one way or the other to get answers. In addition to calls from his end to Citibank's technical side, we've both corresponded a number of times with the bank's technical staff, and I've gone back and forth with coComment a bit myself. The thing I think that Mr. Lindstrom has chosen to ignore is that we *only* posted this because while a browser-based function such as this is the responsibility of the user, it doesn't mean that it should be able to do what it does, hence our lack of "blame" on either coComment or Citibank - or ourselves, really. The reason that Citibank was isolated and mentioned, more than anything, was that John tried this at two other financial institutions that he works with, and I tried it with my primary bank. On zero occasions, with those institutions, did this functionality work, based on policies that those sites had set up.
To answer Pete's last question, blockquoted here:
As I mentioned, if John can demonstrate how Citibank could have somehow protected against this (without a client-side footprint), then I will happy retract this statement, as I am sure he will once he reads this post (I was so careful to get the spelling right ;-)).
I'm not positive that myself - nor John - has enough detailed security knowledge beyond what most of us who've developed a Website with any secure needs have, but after spending time on the phone with some of Citibank's technical team who was on this issue over the weekend, I have a decent gist of understanding this. What I would pose to Mr. Lindstrom, in this case, is that if Citibank isn't able to "protect against this," then why is it that Wachovia, Commerce Bank, and ING Direct were all able to do so? Considering the fact that Mr. Lindstrom has obviously read all of John's post, I'm not sure why he chose to glaze over those facts.
As for the fact that this is a "new toy" for John, it actually isn't, and this was something that was honestly stumbled upon with no ill intent after using it for some time. The gist here was that no one would have expected that this sort of thing would work, especially considering the "option" for coComment to snag the text wasn't available in other secure situations. If it were, I believe that we would have heard many many more examples of security concerns regarding it by now, given the number of bloggers who've given it a whirl. Now doing some casual searches you will see some items where people have mentioned different types of incidents, but nothing at a bank, as far as I can tell.
As for the PR angle, I hesitate to grasp the misunderstanding that Lindstrom has when he says "but this is completely bizarre to be thinking about PR agencies in the face of a security concern." Oh, really? Well, considering John went the security route - on his own volition - in addition to us contacting coComment to let them know this was out there, which they promptly deleted before ever thinking about blogging about this, only to get nowhere, which led to the attempts to get in touch with the company's public relations team just to make them aware of the situation. This is something that, in our jobs, we're always looking out for, i.e. a blogger noting something about a client in the middle of the night. The calls were more about letting them know that this was feasible - and different - on the Citi site, rather than hostile towards them alone.
So while Pete Lindstrom may be right about the fact that John didn't say that he did err in not unchecking the box for coComment to do this, he misses the point that the option to use coComment in this situation was so out of the norm for when it is usable that it was passed by not only by John, but other Citibank customers as well. Based on spending a little time perusing Lindstrom's blog and site this morning, I'm sure that his security credentials are on point, and obviously are well beyond mine - or John's - will probably ever be. But I think that if he had spent five minutes trying out coComment in similar situations, he would have seen that this isn't feasible in all secure situations, and that this was an issue that was "shared" by both the user, the software, and the site. I don't want to be in the position where we're throwing anyone - or everyone - under the bus here, but I think the fact of the matter here is that there is a problem. Saying that "the user made an error and it's his fault" makes me want to say that we should say the same thing to people who choose to use Windows systems over Mac systems - because of what we statistically know about security concerns between the two - are at fault. It doesn't mean that the user is the only person to "blame," it simply points out that there is an issue that needs to be fixed. If it shouldn't be pointed out that potentially thousands of coComment users could be doing this - accidentally, or mistakenly, by believing the software would never allow them to do so (sure, it's blindly, but it happens) - then I'm not sure what we should be raising red flags about. Lindstrom can talk semantics all he wants - it's his blog, his opinion - but if something like this is feasible to do, then it's a "security concern" that those involved can talk about.
[update] Just one more thought. While I do believe that there is something different being done on the other banks mentioned above and in previous posts, something that was said on coComment's official blog about being able to blacklist sites that shouldn't be able to store comments has got me thinking - is what some of the bank security has built into it on some of those sites only half (or one third, given security policy, third-party extension, and human error possibilities) of the issue, and should we be more concerned about what implications using such a thing has, more than anything? Obviously coComment offers a client-side option where you can make your blog work with the system, but obviously that can't work in a negative option-fashion. As in, your site is indexed unless you say not to, or someone blacklists you. Thoughts? I'd be really curious as to what security policies for SSL and whatnot disallow something like this logging to function, or not.
[update 2] I've updated this post from the original, as Pete's last name is Lindstrom, not Spire. Thanks for the update in the comments, Pete!