Online banking security- WTF

[amir_j]

Signed up for online banking with Santander. No physical card reader used like Barclays do, no RSA key chain code thing either.

1) They post you a customerid which online is changed to a word of your choice 5- 16 characters
2) they post you a passcode which online is changed to a word you like 8-16 characters
3) they post you a registration code which is changed online to a 5 digit code

Have these people not heard of keyloggers! Muppets.

[DocJock]

They will also ask for a dedicated phone number so that you get an SMS with a OneTimePassword (OTP) for transactions.

[amir_j]

DocJock said:

They will also ask for a dedicated phone number so that you get an SMS with a OneTimePassword (OTP) for transactions.

Now that sounds a bit better- Is this only applicable from the second time you login? as just did a transfer and went straight through.

[Mojooo]

Natwest ask you for your passwords by inputting randon ones and only a few at a time

i am glad you dont have to usethe pshyical card reader to login with natwest

[sjg]

First Direct are similar - user ID, three letters from your password, plus a passphrase. I like it, I'm not going to carry around some physical token just to get in, and would consider changing banks if they tried to force one on me.

If you're worried about keyloggers, don't use online banking from an untrusted machine - and if you're really paranoid, bring up the on-screen keyboard and type them in with your mouse.

[amir_j]

Guys- thats fine if you are clued up on PC security and have firewalls etc etc

but 1) there will always be some new virus which may get through
2) What about if you are travelling and need to use a internet cafe or hotel pc etc etc

Much prefer to have a physical reader.

[Mr E Driver]

Abbey have asked me a couple of times for the one time pass number sent by text, the intermet banking three passwords is/was fine with me.

[mrmr96]

sjg said:

First Direct are similar - user ID, three letters from your password, plus a passphrase. I like it, I'm not going to carry around some physical token just to get in, and would consider changing banks if they tried to force one on me.

If you're worried about keyloggers, don't use online banking from an untrusted machine - and if you're really paranoid, bring up the on-screen keyboard and type them in with your mouse.

I'm with Nationwide and their system is acceptable:
- Login requires ID/password/secret code
- Moving money between your own accounts requires no furher authentication
- Moving money outside your own accounts gives you a code to tap into your card reader (reader active with chip/pin) and then the card reader gives a response code which you have to put into the website.

90% of the time I'm doing stuff with my own accounts and savings, the other 10% of the time it's no big issue to use the reader.

[amir_j]

mrmr96 said:

sjg said:

First Direct are similar - user ID, three letters from your password, plus a passphrase. I like it, I'm not going to carry around some physical token just to get in, and would consider changing banks if they tried to force one on me.

If you're worried about keyloggers, don't use online banking from an untrusted machine - and if you're really paranoid, bring up the on-screen keyboard and type them in with your mouse.

I'm with Nationwide and their system is acceptable:
- Login requires ID/password/secret code
- Moving money between your own accounts requires no furher authentication
- Moving money outside your own accounts gives you a code to tap into your card reader (reader active with chip/pin) and then the card reader gives a response code which you have to put into the website.

90% of the time I'm doing stuff with my own accounts and savings, the other 10% of the time it's no big issue to use the reader.

+1

Barclays requires the reader code to login as well so little chance of some russian or nigerian getting anywhere at all.

[Engineer1]

Lloyds has a nice one, the id, and password are typed in the 3 charachters selected randomly from your security code are selected from drop down lists.

[anonymous-user]

Engineer1 said:

Lloyds has a nice one, the id, and password are typed in the 3 charachters selected randomly from your security code are selected from drop down lists.

Yep, drop down list can't be logged??

[JohnnyPanic]

Dave_ST220 said:

Engineer1 said:

Lloyds has a nice one, the id, and password are typed in the 3 charachters selected randomly from your security code are selected from drop down lists.

Yep, drop down list can't be logged??

Well, not with a key logger on the Lloyds site. AFAIK they have non-breaking spaces before the values so that you have to use the drop down with the mouse or cursor up/down.

I quite like the system.

If paranoid you can keep a password safe on a USB stick (I use KeePass portable, and also have a copy in a dropbox just in case). You can open this from your USB drive and copy/paste any passwords. The only trail you'll leave on a PC is the password you typed into the Password safe, which you can change as soon as you're on a trusted PC if you so choose.

[lestag]

amir_j said:

DocJock said:

They will also ask for a dedicated phone number so that you get an SMS with a OneTimePassword (OTP) for transactions.

Now that sounds a bit better- Is this only applicable from the second time you login? as just did a transfer and went straight through.

transfer between your accounts probably wont
there may be a default limit (say 100 pounds) when transfering money to an acccount not yours, before the OTP by SMS kicks in.
You may be able to lower this limit online.
(this is how my bank works ... but im in NZ)

[ymwoods]

I wish HSBC did some sort of physical reader. we get some crappy software that is pretty much a key logger in its self. It monitors what you type and then if it detects you typing a password that resembles one on another site (not just the HSBC site) it tells you off.

[jon-]

American express was the best. When I first registered for their online service they refused to let you have a password LONGER than 8 characters!!

[Chimune]

Kaspersky AV has a virtual keyboard which allows you to input any passwords, using only mouse clicks. Seems a good way of avoiding the problem.

[jon-]

Chimune said:

Kaspersky AV has a virtual keyboard which allows you to input any passwords, using only mouse clicks. Seems a good way of avoiding the problem.

Windows has one too, it's called the on screen keyboard.

[beano500]

ymwoods said:

I wish HSBC did some sort of physical reader.

Not sure I understand how any of these systems work, but I use the Black Horse as mentioned above; drop downs. I also use the The Hong Kong and Shanghai... but they sent me a little plastic thingy that generates a code - is this not what you get?

[elster]

ymwoods said:

I wish HSBC did some sort of physical reader. we get some crappy software that is pretty much a key logger in its self. It monitors what you type and then if it detects you typing a password that resembles one on another site (not just the HSBC site) it tells you off.

They do.

The issue I have is that with the business account several people access it from different locations.

Which is a pain with 1 fking code generator.

[ymwoods]

elster said:

ymwoods said:

I wish HSBC did some sort of physical reader. we get some crappy software that is pretty much a key logger in its self. It monitors what you type and then if it detects you typing a password that resembles one on another site (not just the HSBC site) it tells you off.

They do.

The issue I have is that with the business account several people access it from different locations.

Which is a pain with 1 fking code generator.

well I havn't got one...just put my banking code in, my DOB and 3 numbers from my password then done