Nationwide BS security

fenlander_uk

Paul_Varjak wrote: »

Here is the evidence you require...

http://www.nationwide.co.uk/internetbanking/helpandsupport/browserhelp.htm

Just click on the SUPPORT tab.

My browser (Chrome 13) is shown as unsupported because it's not Chrome 11. The panel immediately above states that only Chrome 12 is supported. I'm supposed to take this seriously?

Has someone mentioned to the banks involved that browsers tend to update themselves pretty regularly - usually in the interest of improving security - and if they (the banks) want us to take them seriously, they need to keep up with developments.

ChiefGrasscutter

Yes, but it's not a simple as you think.
You seem to imagine that just as you update your browser without a moment's thought and it takes 10 seconds then companies at the other end are going to do the same.
Actually they ain't - and anyway they can't.

To comply with various regulatory and audit requirements they have to evaluate the browser modifications in great depth. All the various tests, error checking etc they do on the browsers interations with their systems will have to be certified by some outside body. .....and everytime someone brings out a new browser version/update it has to be done all over again.

You 'll discover this is business one day. Once your product has been designed with various sub-suppliers all integrated in, wait for the cries of rage when one sub-supplier wants to change something meaning all the customer approvals have to be re-done. Which is why you hear tales of UK Gov departments still using IE6.

Of course this problem reaches its logical end point in the aviation industry where the regulatory regime is so tight and safety so important that trying to change anything and get it "approved" is horrendously expensive - so in many cases people/companies just give up bringing things to market - and use existing old stuff "because it has approval"

Paul_Varjak

fenlander_uk wrote: »

My browser (Chrome 13) is shown as unsupported because it's not Chrome 11. The panel immediately above states that only Chrome 12 is supported. I'm supposed to take this seriously?

Has someone mentioned to the banks involved that browsers tend to update themselves pretty regularly - usually in the interest of improving security - and if they (the banks) want us to take them seriously, they need to keep up with developments.

Yes, I noticed that too because I always use Chrome to log into internet banking; I believe it is the safest browser to use to log into internet banking. In fact, I have set up a short-cut to execute Chrome in private browsing mode with all plug-ins disabled as Nationwide does not support browsers with certain plug-ins (it does not list them of course); if the browser is not supported, the Internet Banking Promise does NOT apply.

When I used Chrome 12, it passed the Nationwide test on that browser but when I updated to Chrome 13 it says I am not supported because I am not using Chrome 11.

When I challenged Nationwide on the fact they do not support IE9 or Chrome 13, their response was that browser makers do not make them aware that new browsers are being launched!

tweeter

Just for a laugh I've used a Tor enabled Linux distro with an Iceweasel browser and I came up with these weird results below with XP among other things. So depending on there being an acceptable browser, maybe one could be able to log on to the Nationwide website using Linux/Tor.

Results

JavaScript enabled? Yes
Can access secure sites?Yes
Images enabledYes


This is the browser and operating system we believe you’re using to access this page:
If the information above is not correct, you can find more detailed information about your browser.
Check
Result
Supported
Operating System Windows XP Browser Firefox (not version 3.6) Javascript Version 1.5 Javascript not Enabled

Server side detection
JavaScript detection
Screen size
Browser Type: Firefox (not version 3.6)
Platform: PC navigator.appCodeName = Mozilla
navigator.appName = Netscape
navigator.appVersion = 5.0 (Windows; LANG)
navigator.userAgent = Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16 Width: 1600
Height: 971

Paul_Varjak

And will Nationwide actually allow you to login via a proxy server, such as TOR?

tweeter

I don't know. I just tried it out for a bit of a laugh just to see the results as I don't bank with them - a bit weird that they refer to XP though.

Paul_Varjak

tweeter wrote: »

I don't know. I just tried it out for a bit of a laugh just to see the results as I don't bank with them - a bit weird that they refer to XP though.

I think XP must be used on the exit node on the Tor network. Next time you use TOR, the user agent string will, almost certainly, differ because you will be assigned a different exit node.

tweeter

I was thinking something like that - maybe its possible it would fool the bank into accepting it if it was compatible with their requirements.

Raine_E_Day

Paul_Varjak wrote: »

When I found out that Nationwide did not support IE9 I sent them a message too. They did, in fact, insist I would still be covered by the Internet Banking Promise despite IE9 not being a supported browser. That is in complete contradiction to what Nationwide state on their website.

Bit of a further contradiction here then, as this is further response from Nationwide:

"I confirm until our Technology Department are satisfied that IE9 is secure and we can support it, then as per the information below from our Internet Banking promise you are not covered if a browser is not supported."

In view of fact that many people will not be covered and probably do not know, I shall be writing back to suggest they make this more prominent on their website.

Paul_Varjak

So, three difference answers to the same question then!

I think they should check your PC and browser details on the log-in page and inform you if you are covered by the banking promise BEFORE entering your log-in information.