HSBC security key

alanq

Discussed today on BBC Radio 4's MoneyBox programme. (Around 11 mins in)
http://www.bbc.co.uk/iplayer/episode/b0171x1r/Money_Box_12_11_2011/

Have your say
http://news.bbc.co.uk/1/hi/programmes/moneybox/9637740.stm

I_luv_cats

alanq wrote: »

Discussed today on BBC Radio 4's MoneyBox programme. (Around 11 mins in)
http://www.bbc.co.uk/iplayer/episode/b0171x1r/Money_Box_12_11_2011/

Have your say
http://news.bbc.co.uk/1/hi/programmes/moneybox/9637740.stm

You beat me to it... I luv my weekly dose of Money Box.

huw01

It said that all HSBC customers had been issued with the key.

Oh no they haven't. I had the letter in may or June but I still haven't had the key and I'm still logging in using my IB no, date of birth and passcode.

Have they stopped rolling them out ??

spenderdave

The money box programme seemed to put forth the view, as expressed in these forums, that the majority of people hate the new keys. But we just hear from the more vocal members of our community. I have no problems with it myself, and it is actually much quicker to log in than with the old method.

MonkeySaving?

chanmus wrote: »

The security key is a complete waste of time and money. How much has it cost the bank to roll out this garbage? I dread to think.

The device is an electronic device containing a peice of software which generates a key. Therefore it is insecure. Period. It does not matter how secure people 'think' their software is - if someone wants to gain access badly enough - then they will. This has been proven time and time again in the media, and those reports are the ones we hear about.

The only device which is so far is unbreakable is the human brain. Why is it suddenly not acceptable to have to enter a phrase which is in your head, which is the most secure place known to man?

I personally do not bank with HSBC (my wife does) - but, I DO bank with First Direct, which is part of the HSBC group. First Direct do not require the use of such a security device, and require instead on the good old challenge response passphrase. If they do roll-out these devices, I shall leave imediately as I shall not be carrying a rediculous peice of tat everywhere I go - this is the 21st century!

Rich
Software Engineer

LOL :rotfl:, It's not "insecure" at all, the key needs to be combined with 2 other sets of information, firstly your IB number and then a security question. As a "software engineer" I'm surprised you've never come across 2FA before?
It's a bloody annoying device though, slow to turn on and too large, 2FA devices 10 years ago were smaller than this. What HSBC should have done is gone down the securenvoy route....but it looks like they chose the wrong consultants to advise them

Gromitt

The problem is that the Secure key doesn't require anything else. Losing it could/may give away a lot of information.

The 'PIN Sentry' device used by Barclays has already been reverse engineered and you can download PC Software that does the exact same thing. However, its still useless without the card and appropriate PIN, so still secure.

Once the HSBC 'Secure Key' has been reverse engineered, what happens? All a thief needs is your IB number perhaps, or worse, maybe even just your account number! Considering you can change the PIN easily without informing the bank makes it clear that the PIN isn't used as part of the challenge, its just to stop people using your secure key.

We have an electron microscope at work, I'd love to disassemble such a key to see what I can find.

Infidel

Hi. I'm just wondering if this has been enforced for all customers as of the last few days or so. As I haven't been able to log-on to internet banking for the last few days - it's not recognising my user id. Up till now it's been functioning perfectly - so this is the only thing I can think of.

Lokolo

Infidel wrote: »

Hi. I'm just wondering if this has been enforced for all customers as of the last few days or so. As I haven't been able to log-on to internet banking for the last few days - it's not recognising my user id. Up till now it's been functioning perfectly - so this is the only thing I can think of.

You mean enforcing to use the secureID key?

I thought it was compulsory months ago!

huw01

Nah , I had a secure message off hsbc last year about it and another one about three months ago about the introduction of the secure key. Still nothing, I'm still logging in the old way

HKitten

The only thing that bothers me about the key is having to use it every single time I want to see my account. I can't even log in without it. It just seems like overkill. My boyfriend is with Natwest and has a pin reader thingy, and he only has to use that when he wants to create a new payment. That makes more sense to me!