Password Tools - Invalidate Banks T's and C's

Undisputedtruth

Stompa wrote: »

I said that from their response it sounded as though they didn't.

Just for sake of clarity here, do you mean the bank sounded as though they didn't know what keepass is?

ta

masonic

Undisputedtruth wrote: »

It seems I potentially could be penalised for other people's failure to add layers of security to their password manager. This is unfair.

It is unfair, but it perhaps isn't entirely unexpected that a bank would not want to over-complicate their policies for their non-techno savvy call centre staff.

I don't even think the added layers of security are necessary. It's picking the wrong tool for the job that is the problem, which is why banks need to examine this area and decide which tools they are willing to accept, if any. At the moment, there is no clear position on this from the banks, which means your behaviour may not be differentiated from somebody who uses a password manager with remote data storage.

The figures you've provided on inherent risks with password managers are they based on factual data by the banking industry/computer security experts or is it an arbitary figure you had plucked from the sky to convey your message?

Completely arbitrary. I was trying to illustrate that an added layer of protection would have a negligible effect on the risk providing the product stored infomation securely in the first place. Added layers of security can't protect the data when you unencrypt it to use it and that's when the data is at risk. I certainly didn't intend for those figures to be interpreted in any absolute sense.

Yes, but Stompa said earlier in the thread that this bank doesn't even know what is keepass. Currently, I suspect there isn't a policy on password managers as the vast majority of banking staff are pretty clueless about them and their benefits. My T&Cs have all stated that I should take precautions to secure my information so I feel using a password manager is justified in this instance. I wouldn't clarify with bank staff whether I'm allowed to use a password manager because I can't rely on their advice on normal financial products at the best of times much less on password managers!

I think I understand what Stompa was trying to say, which is pretty much what you have said above. These products are not well understood by the front line staff at banks, and some of the things they say suggest as much. I'll leave it for Stompa to further clarify, though.

I understand the point you are making - that if you remain honest about your use of Keepass, then you believe in the end justice will prevail and any problems from the bank would be overturned by the Ombudsman, or failing that, the courts. I hope you are right.

However, you need to understand that if for some reason you become the victim of fraud you could be in for a long and painful battle to get your money refunded, the ramifications of which could be very severe depending on your circumstances. I would seriously advise anyone against openly using a password manager without clarification of their banks policy for that reason. The advice may be poor and uninformed, but you'll probably be faced with the same if you have to talk to them about fraud on your account, when you'll be at their mercy for a refund (at least for the first 8 weeks). The alternative option is to keep quiet about it, since it only becomes an issue if the bank finds out.

Stompa

masonic wrote: »

I think I understand what Stompa was trying to say, which is pretty much what you have said above. These products are not well understood by the front line staff at banks, and some of the things they say suggest as much. I'll leave it for Stompa to further clarify, though.

I was merely suggesting that since CBS stated that by using Keepass you were passing your security details on to a third party, then they didn't understand how the product worked. Would they think the same if you stored your details in a text file created with Notepad?

masonic

Stompa wrote: »

I was merely suggesting that since CBS stated that by using Keepass you were passing your security details on to a third party, then they didn't understand how the product worked. Would they think the same if you stored your details in a text file created with Notepad?

Perversely, you might have more luck getting a refund for fraud from CBS if you used Notepad instead of Keepass... Although they do also state "Never write all your Security Details in a letter, email, secure message or any other correspondence, and never store your Security Details on a computer."

Stompa

masonic wrote: »

Although they do also state "Never write all your Security Details in a letter, email, secure message or any other correspondence, and never store your Security Details on a computer."

Since they also say: "Try to avoid using the same password over and over again, so try to use different passwords for each website you login to" - I wonder how they expect us to remember them all?

masonic

Stompa wrote: »

Since they also say: "Try to avoid using the same password over and over again, so try to use different passwords for each website you login to" - I wonder how they expect us to remember them all?

Funnily enough, with the exception of putting the details in a letter or similar, a pen and paper record of the details doesn't seem to be prohibited, though even that isn't explicitly permitted. Of course, in some situations that would be less safe than using a password manager.

StevieJ

masonic wrote: »

Funnily enough, with the exception of putting the details in a letter or similar, a pen and paper record of the details doesn't seem to be prohibited, though even that isn't explicitly permitted. Of course, in some situations that would be less safe than using a password manager.

That is where all mine are but I don't write down what they relate to.

Stompa

StevieJ wrote: »

That is where all mine are but I don't write down what they relate to.

But how do you know which relates to what? Or perhaps you don't have many entries?

Undisputedtruth

Stompa wrote: »

Since they also say: "Try to avoid using the same password over and over again, so try to use different passwords for each website you login to" - I wonder how they expect us to remember them all?

Apparently if you can remember your password then it's no longer secure!

See here.

They even suggested the use of password managers..:rotfl:

Stompa

Undisputedtruth wrote: »

Apparently if you can remember your password then it's no longer secure!

See here.

They even suggested the use of password managers..:rotfl:

I rather hope that any banks I use won't permit an unimpeded repetitive "guessing" attack though!