Halifax reward account online now, and the old accounts....

LongTermLurker

KickandRun wrote: »

Could you not write "story" in a word document with all your passcodes hidden in the sentences. Then when you log in, cut and paste the relevent codes - or is that a bit OTT?

A good password contains a mixture of letters in upper and lower case, numbers and special characters, such as $%# etc. Key loggers aside, if you only use letters your password will be "guessable" within seconds using automated login tools. To give you an idea, any password found in a dictionary would be found within 2 seconds or so - obviously the harder job would be to guess the username.

You would be hard pressed to hide a "word" with such a combination in a story without it looking obvious what you were doing.

(edit - an even better password is a misspelt one )

masonic

KickandRun wrote: »

Could you not write "story" in a word document with all your passcodes hidden in the sentences. Then when you log in, cut and paste the relevent codes - or is that a bit OTT?

It's possible to just type out the whole alphabet/numbers/symbols into a document and just paste in a password letter by letter. Many keyloggers monitor the clipboard, though, so it isn't much more secure.

masonic

LongTermLurker wrote: »

Key loggers aside, if you only use letters your password will be "guessable" within seconds using automated login tools. To give you an idea, any password found in a dictionary would be found within 2 seconds or so - obviously the harder job would be to guess the username.

That isn't the case for most online banking sites, where only a few (typically 3) incorrect entries will lock the account. Brute force attacks can only be applied where an unlimited number of login attempts are allowed.

butterfly72

Karma4All wrote: »

Oh, & I'm not that impressed with the online security, your stuffed if there's a key logger on your machine.

I did have a key logger on my machine. they managed to take 2K out of my A&L account but not my halifax!!

I phoned Halifax and they were really very good, blocking my account immediately and informing me what to do next. Better than A&L, who I had to ask to block the account and ask to be put through to security!!!

LongTermLurker

masonic wrote: »

That isn't the case for most online banking sites, where only a few (typically 3) incorrect entries will lock the account. Brute force attacks can only be applied where an unlimited number of login attempts are allowed.

True, but the principle stands that the password should include alphanumerics and meta characters

masonic

LongTermLurker wrote: »

True, but the principle stands that the password should include alphanumerics and meta characters

To be honest, in that situation I don't really think it holds water...

Take an 8 character password made up of an alphabet of either alphanumeric/symbols (approx 92 characters), alphanumeric (62), alphabetic (52), lowercase alpha (26) or numeric (10). The probability of guessing the password in 3 attempts is as follows:-

Alphabet size - Probability
92 characters - 0.000000000000058%
62 characters - 0.0000000000014%
52 characters - 0.0000000000056%
26 characters - 0.0000000014% (or 1 in 70 trillion)
10 characters - 0.000003% (or 1 in 33 million)

I'd imagine that many people would consider the purely numeric password to offer adequate security. You are five thousand times more likely to win the lottery than for a fraudster to guess your lowercase alphabetic password. The improvement offered by adding mixed cases, alphanumeric characters or symbols would be imperceptible. However, if your password is very short, increasing the size of the alphabet used will partly compensate for that fact. However, password length is the real key to strength.

Karma4All

masonic wrote: »

To be honest, in that situation I don't really think it holds water...

You are of course right, a brute force attack would not be appropriate for that application. I think in all fairness, LongTimeLurker was making the general case for strong passwords.

The other thing that irritates me is when call centres ask you to give your DOB, postcode, mothers maiden name, password in the case of Sky! Why can't they ask for a few random letters from one of them? I've taken to putting a phrase that would not stand out in the conversation to ear-wiggers (ie "can U repeat that") if I can. I suppose I should only phone them from the privacy of my home if I'm that worried I guess.

Chameleon_Factor

Bit new to all this.

Am I right in thinking that I can't open any of these accounts if I already have a current account with another bank?

Thanks,

CF

LongTermLurker

Chameleon_Factor wrote: »

Bit new to all this.

Am I right in thinking that I can't open any of these accounts if I already have a current account with another bank?

Thanks,

CF

Yes, you can, in theory, have as many current accounts as you like. Unlike some, Halifax don't insist on you using it as your main account, though you do have to feed it £1000pm to get the fiver.

Your only limitation will be down to credit searches when it comes to them offering you an overdraft.

freezspirit

Out of interest when does the £5 go into the account? Is it the first of the month or on the day I opened the account?