'Rapport' Security

joe134

masonic wrote: »

This is what I get when I click on the green bit at the left of the address bar...


If you can't do that, you might want to think about upgrading your browser, if only to use for internet banking. If I click More Information, I can go through and view the actual certificate, but all the necessary information is in that window.

What is happening on the HSBC page is that the page asking for the user ID is not secure. However, when you press the log in button, a secure connection is set up before the user ID is transmitted to HSBC. The problem with that is you don't know what is going to happen until after you click the button. Many sites used to do this when servers weren't very powerful and there was a big overhead involved with encrypting pages. Nowadays there really is no excuse - servers should easily be able to handle sites that are entirely encryped and leaving things as HSBC has just makes life difficult for users.

Edit: As an aside, and bringing the thread vaguely back on topic, if I had Rapport installed, I don't think it would have let me take that screenshot because Rapport goes to even greater lengths to prevent any information on the site being eavesdropped.

Hi, Got it. As you say, it,s browser. I tend to use aol,s. When I use IE, I can get cert, but only after I have entered IB number, so have to rely on Rapport or Wow, as I do anyway.Use IE, probably go back to Firefox, thanks for the lesson.caio

joe134

joe134 wrote: »

Hi, Got it. As you say, it,s browser. I tend to use aol,s. When I use IE, I can get cert, but only after I have entered IB number, so have to rely on Rapport or Wow, as I do anyway.Use IE, probably go back to Firefox, thanks for the lesson.caio

ps It is browser, got firstdirect no probs on IE.Just tested screen capture using Rapport. I detected it straight away. Gave me the option to allow or deny. Fair enough

spenderdave

For a secure 'first page' for HSBC internet banking use https://www.hsbc.co.uk/1/2/ as your bookmark. And you should have a big green blob in your address bar showing the extended security. In Opera I can click on that, or on the security lock on the left and it shows me all the certificates. If your browser is not showing you any padlocks then you really ought to upgrade your browser..

And I see they now have a Rapport nag screen on that page, UGHHHHHHH

joe134

spenderdave wrote: »

For a secure 'first page' for HSBC internet banking use https://www.hsbc.co.uk/1/2/ as your bookmark. And you should have a big green blob in your address bar showing the extended security. In Opera I can click on that, or on the security lock on the left and it shows me all the certificates. If your browser is not showing you any padlocks then you really ought to upgrade your browser..

And I see they now have a Rapport nag screen on that page, UGHHHHHHH

Whether I use IE or AOL browser, HSBC do not show a padlock until I enter DOB+PIN.page First page is always unsecure, no lock showing.Thanks for other log in details.I have IE8. PS, Just tried that tip, even works on AOL, however, on IE8. rapport puts it,s own padlock on browser instead, AOL padlock on bottom, even IB page., I will use your tip from now on though, thanks again,How come HSBC don,t use that as default?

masonic

spenderdave wrote: »

For a secure 'first page' for HSBC internet banking use https://www.hsbc.co.uk/1/2/ as your bookmark. And you should have a big green blob in your address bar showing the extended security. In Opera I can click on that, or on the security lock on the left and it shows me all the certificates. If your browser is not showing you any padlocks then you really ought to upgrade your browser..

That https page is only partially encrypted. Content is being received over http, hence Firefox and IE correctly identifying the page as only partially encrypted and not validating the security certificate. Maybe Opera behaves differently?

Edit: Actually, it is slightly worrying if Opera really is showing partially encrypted pages as secure because it allows the possibility that a secure page could contain a non-secure web form and still validate.

atypical

masonic wrote: »

That https page is only partially encrypted. Content is being received over http, hence Firefox and IE correctly identifying the page as only partially encrypted and not validating the security certificate.

Firefox & IE8 behaves in the same way to Opera on that page; they all validate the certificate and give a green address bar marking.

masonic

atypical wrote: »

Firefox & IE8 behaves in the same way to Opera on that page; they all validate the certificate and give a green address bar marking.

Aha! That is indeed the case... when you turn on javascript. Oops!

joe134

masonic wrote: »

Aha! That is indeed the case... when you turn on javascript. Oops!

Just out of curiousity, being as this is not open source software but freeware paid for by the banks, if one stops using the bank or banks supplying the download free, does one have to pay for it?or even uninstal it? If so how much and from where?:p

masonic

joe134 wrote: »

Just out of curiousity, being as this is not open source software but freeware paid for by the banks, if one stops using the bank or banks supplying the download free, does one have to pay for it?or even uninstal it? If so how much and from where?:p

Anyone can download it from the Trusteer website and use it for free. The banks seem to be paying for automatic integration with their websites and customised installation.

joe134

masonic wrote: »

Anyone can download it from the Trusteer website and use it for free. The banks seem to be paying for automatic integration with their websites and customised installation.

Cheers Masonic, it,s working ok up to present,still in conjunction with all my usual security though. got the hang of certification now.ciao