When is a safety deposit box not a safety deposit box?

For 25 years or so I've had a safety deposit box (SDB), where I keep valuables like birth certificates, savings bonds, passports, stock certificates, etc. It's in a bank about 5 miles from where I live, and I'd like it to be at a more convenient location. It's also at a bank where I no longer have any other business, and I think one of these days they may decide they don't want my safety deposit box business, since they have a limited number of boxes and would like to offer them to other customers.

So my current bank (PNC) just opened a branch that's reasonably convenient, and has "Express Storage Boxes" (XSB), which are similar to but not the same as a safety deposit box:

• XSBs are inside the bank, but not in a vault with a big door & lock (which is also presumably fire proof).
• XSBs can be accessed without talking to a bank staffer any time the bank is open.
• XSBs don't require a signature card to access.
• The customer has both keys to the XSB, and there's no "bank key" required for access.
  

So an XSB seems like a fairly poor cousin to a safety box. But as a security specialist, I think about risk management.

What are the threats that a safety deposit box is supposed to protect against, and how well does it actually protect against them?

• Fire - an XSB is protected by the standard fire protection system in the bank, while a SDB is inside a (somewhat) more fireproof vault. Or at least I assume the vault is more fireproof - it's hard to tell by simply walking in, and asking too many questions might not be a good thing. Banks don't believe in security by openness!
• Flood - probably no difference here.
  
• Theft - divide this into "bank hours" and "after hours". During bank hours, the requirement for matching signatures provides some (minimal) measure of protection for a SDB, as does the requirement for a bank key. However, the bank key is frequently just kept in an unlocked desk drawer right outside the safe, so it's probably not providing much protection. After hours, the vault (presumably) provides some extra measure of protection for the SDB, although the bank itself presumably has cameras, alarms, etc. which would protect the XSB. Both have the same level of protection against insider (bank employee) theft, since they both require the customer's key to open the box, unless the lock is drilled out which would be pretty obvious.

It isn't obvious to me whether a real safety deposit box is worth the additional aggravation, but it just seems wrong to put my stuff in a box in the bank that anyone could walk over and touch. Is the big vault door just feel-good security, or is it truly offering an extra measure of security, given the cameras and sensors that protect the whole of the bank?

Of course there's the issue for both XSB and SDB if the lock gets drilled out, but I'll put that risk aside for another day...

2004 & 2008 - Four Years and A Million Miles

Tuesday I joined 1.8 million of my closest friends for the celebration of President Obama's inauguration. (As Rachel Maddow says, it just feels good to say it.) It was the nation's biggest party - 50% larger than the previous record, Lyndon Johnson's 1965 inauguration, according to the Washington Post.

But more than the number of people is the feeling. In 2004, I went to the inauguration war with my (then) 18 year old daughter to protest against the war in Iraq. With heavily armed police and military on every corner, it felt like we an occupied country under an oppressors thumb. (Some might argue that in fact we were.) The police and military were tense and it showed.

By contrast, this week's inauguration was a love-in - a very cold one, but an amazing feeling of optimism for the future. There were far more police and military than there had been four years ago, but we all felt that they were there to protect us - and they seemed relaxed and happy to see the crowds. Yes, it was cold and noisy and very very very crowded -but there's no way to avoid the infectious feel of celebration.

My daughter, now 22, her partner, and I arrived just before noon, so we were a mile from the Capitol, almost at the Lincoln Memorial. Anyone who watched the inauguration on TV had a better view than we did - we watched on the Jumbotrons set up along the National Mall. Was it worth going? Absolutely! Feeling the excitement, and knowing that 50 years from now we'll look back and know that we were there when America turned the corner - priceless!

(My son and his friends, by contrast, arrived at the Mall at 4am - something they would never do for a class! - and were as close to the front as people without tickets could get. They could see the stage, but not the individual people.)

And now the work begins. We'll all find things that we disagree with President Obama as he pushes through his agenda. But a new day has started, and I feel more optimistic than I have in a long time.

A good idea, badly done

According to a Computerworld article, "Starting Jan. 1, Visa Inc. is requiring all new fuel-dispensing machines being installed at gas stations around the U.S. to support the Triple Data Encryption Standard, a mandate that is designed to make it harder for identity thieves to steal debit card data from gas pumps by shielding the personal identification numbers (PIN) of customers."

While using strong encryption (such as 3DES) is a good idea, it's too bad that's the focus - breaking the encryption is not a very effective way to steal credit card numbers. Far easier is one of a hundred other methods - breaking into the server where the credit card numbers are stored, installing a "skimmer" to read the credit card at the gas pump, hacking the software, etc.

Seems to me that Visa needs a better risk assessment methodology...