The CBR intends to oblige Internet banking users to provide information on the IP addresses of all their devices.
A PDF document containing the draft instruction on introducing changes to the Bank of Russia Regulation of August 19, 2004 N262-P “On the identification of clients and beneficiaries by credit organizations in order to counteract the legalization (laundering) of proceeds from crime and the financing of terrorism. ”
According to this project, banks that provide services of remote access to a bank account (Internet banking) must, in advance (when filling out an account opening form), receive from the client information about which IP addresses, as well as MAC addresses, will have devices from which the user will access the Internet banking.
It is not known, however, how they propose to implement the MAC address check, how you can specify the IP address if it is issued by the provider dynamically, and what to do to those who use Internet banking from different places (at home, in the office, in cafes, airports, and so on).
Again, it is not entirely clear whether it is possible to specify data about an intermediate node independently configured for access to Internet banking and other Internet services (for example, VPS with a configured SSH tunnel or VPN). And what if just to specify all possible IP addresses (2 32 , that is 4 294 967 296)?
')
Over the past two days, Artyom Yeiskov (banki.ru) and even Alex Exler managed to write about it.
It remains to add that the draft instruction is, of course, not yet an indication, and there is always the possibility that such dubious decisions will be further abandoned. But, given the general atmosphere - even if they do not refuse, it will not surprise anyone.
At the moment, the project is in the state of expertise in order to identify the provisions that contribute to the creation of conditions for the manifestation of corruption (expertise in corruption) .
According to the page on the website of the Central Bank of the Russian Federation, expert opinions on this project should be sent to the Department of Financial Monitoring and Currency Control at the following address: ksa3@cbr.ru .
Letters are accepted until October 16, 2012 .
An example of such a letter can be found at idiot.fm .
Thanks int80h for the info.
According to this project, banks that provide services of remote access to a bank account (Internet banking) must, in advance (when filling out an account opening form), receive from the client information about which IP addresses, as well as MAC addresses, will have devices from which the user will access the Internet banking.
It is not known, however, how they propose to implement the MAC address check, how you can specify the IP address if it is issued by the provider dynamically, and what to do to those who use Internet banking from different places (at home, in the office, in cafes, airports, and so on).
Again, it is not entirely clear whether it is possible to specify data about an intermediate node independently configured for access to Internet banking and other Internet services (for example, VPS with a configured SSH tunnel or VPN). And what if just to specify all possible IP addresses (2 32 , that is 4 294 967 296)?
')
Over the past two days, Artyom Yeiskov (banki.ru) and even Alex Exler managed to write about it.
It remains to add that the draft instruction is, of course, not yet an indication, and there is always the possibility that such dubious decisions will be further abandoned. But, given the general atmosphere - even if they do not refuse, it will not surprise anyone.
What can be done
At the moment, the project is in the state of expertise in order to identify the provisions that contribute to the creation of conditions for the manifestation of corruption (expertise in corruption) .
According to the page on the website of the Central Bank of the Russian Federation, expert opinions on this project should be sent to the Department of Financial Monitoring and Currency Control at the following address: ksa3@cbr.ru .
Letters are accepted until October 16, 2012 .
An example of such a letter can be found at idiot.fm .
Thanks int80h for the info.
Source: https://habr.com/ru/post/284782/
All Articles