The responsible netizen can try to get the contact information of someone who can close that hole, and let them know about it. If they ignore that, the responsible netizen can then inform securityfocus.com, the BBB, or other relevant organization, and if the company is STILL not closing the security hole, the responsible netizen will alert the media (after first switching to a different bank).

And no, happening across an unprotected URL that link browsing wouldn't hit isn't hacking any more than making a U-turn in someone's driveway is trespassing. It's the pulling into the driveway, getting out, and rattling doorknobs and checking windowsills that I'd consider trespassing, and it's using misconfigured public web pages and proxy servers for access to internal networks that I'd consider hacking.
-Steve

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/70/11537#11537