Tesco Online Banking Inaccessible

hasdogs

reboot4loot wrote: »

Good points! If it’s a browser fingerprinting technology requirement that certain files remain in the cache etc

I don't think it is. I changed IP address, deleted cookies, flash cookies, cleared the browser cache and still logged on without needing an SMS.

http://samy.pl/evercookie/ gives information about possible locations and methods by which websites can store and retrieve data from your computer and can show you which work on yours.

http://panopticlick.eff.org will show you what 'fingerprint' information a web site can obtain from your computer and how unique it is. My computer was unique among the 1.6 million they have examined so far.

Tesco are using fingerprinting technology from arcot, it will be using some of the information http://panopticlick.eff.org shows you and some undisclosed computer performance metrics.

The Tesco online service takes a fingerprint from your computer without asking, without telling you and without telling you what they will do with it or who else they will give it to.

EU legislation just came into force requiring websites to obtain permission before placing permanent cookies on your computer (duff legislation with very little compliance, but, that's another story). Browser fingerprints are a much bigger threat to privacy because they can be 'read' by any website, cookies can only be read by the website which deposited them.

There are ways mask your finger print (like putting on gloves) but Tesco online won't work if you use them.

I suspect many people would be unhappy about this if they were aware it was happening and not completely ignorant of the details and implications - ignorance which Tesco (perhaps tellingly) make no effort to correct.

SnowMan

hasdogs wrote: »

I
The Tesco online service takes a fingerprint from your computer without asking, without telling you and without telling you what they will do with it or who else they will give it to.

I suspect many people would be unhappy about this if they were aware it was happening and not completely ignorant of the details and implications - ignorance which Tesco (perhaps tellingly) make no effort to correct.

Thanks, said I wasn't a techie :rotfl:

They are definitely saying that they are just using flash cookies. Clearly your experience is different. Have just tested it and deleting flash cookies does make my computer unrecognised so different result to you.

Their privacy page is not good and just talks about cookies. They should say there IF they are using fingerprinting and if a third party has access to that info also, or that they are using flash cookies

I agree it is too easy to be complacent and think it doesn't matter.

Would contacting the Information Commissioners Office to express concerns be worth it? I'm not saying Tesco shouldn't be using these methods if on balance the legitimate aim of security justifies it but they should be open about what they are doing so people can make an informed choice on whether to use Tesco.

td_007

Success!! Managed to get through to someone to close the Internet saver account:j

After being unable to log in following the changeover to the new system - blank login page after inputting unique user id/computer not being recognised/receiving a "special bonus for you" letter where the interest rate is lower than the one available for a new account...I am happy to give Tesco some rest.

I am hoping that following this fiasco they will come out with some attractive offer of bonus clubcard points or higher interest rates which I will be glad to take advantage of. Till then adieu Tesco:beer:

hasdogs

SnowMan wrote: »

I'm not saying Tesco shouldn't be using these methods if on balance the legitimate aim of security justifies it but they should be open about what they are doing so people can make an informed choice on whether to use Tesco.

Would you be happy with ATMs which have fingerprint readers built into the keypad keys? Can't use it without giving it fingerprints and won't work if you wear gloves?

I remember a lot of stink about schools using fingerprint readers to identify kids for library access and class registers.

As for security it may makes things more difficult but not secure. I am sure it it possible for a computer to provide a website with a spoofed fingerprint and any website you visit can take your fingerprint (unless you wear those computer 'gloves'). The fingerprint is mostly taken with a flash application which is probably still sitting in your browser cache, everyone has access to it and it can be reverse engineered.

SnowMan

They are now suggesting here that people who can't get through on the phone. email them to arrange a callback, probably worth trying

Question:

I can’t get through to you on the telephone to discuss my issue, is there a way that I can contact you by email?

Answer:

You can arrange for a call back by sending an email to [EMAIL="callmeback@tescobank.com"]callmeback@tescobank.com[/EMAIL]. We will try our best to call you back as quickly as possible, although please be aware that we are currently experiencing a high volume of demand. In order to help us to solve your issue please provide:
· Your name
· Your postcode
· Your account number
· Up to two telephone numbers that we can reach you on
· A brief description of the issues that you would like us to assist you with
· A recognisable word that you can use to identify us when we call you back
Unfortunately it will not be possible for us to enter into any dialogue via email or commit to calling you back at a specific time.

GeorgeHowell

Thanks for the people who have drawn attention to this fingerprinting nonsense. It looks like the customer's security is compromised so that Tesco's risk can be minimised. It's yet another reason to reinforce my decision to have withdrawn the money and close the account. Maybe there isn't anyone else out there offering relatively high rates with instant access and faster payments. But given that the rates are not that fantastic, the instant access is now a joke, and the faster payments are erratic, to put it mildly, then for my part getting out of this basket case is a no-brainer.

rtoobtoo

hasdogs wrote: »

Would you be happy with ATMs which have fingerprint readers built into the keypad keys? Can't use it without giving it fingerprints and won't work if you wear gloves?

I remember a lot of stink about schools using fingerprint readers to identify kids for library access and class registers.

As for security it may makes things more difficult but not secure. I am sure it it possible for a computer to provide a website with a spoofed fingerprint and any website you visit can take your fingerprint (unless you wear those computer 'gloves'). The fingerprint is mostly taken with a flash application which is probably still sitting in your browser cache, everyone has access to it and it can be reverse engineered.

The good thing about fingerprints ON fingers is that they stay there and can be recognised. The fingerprint on my PC may not now be there or is not now recognised by Tesco.:(

pqrdef

Renamed my flash cookie and tried to log in, got "You aren't on your regular computer". Requested a magic number on my mobile, but nothing received. After about 3 minutes, clicked on Send again and got two messages together.

Typed in the magic number, gave password, got 502 Proxy server error. Back to square one

Fair bit of work to do before this isn't the worst bank website.

It made me a new flash cookie, but I deleted that, renamed the old one back, and everything back to normal.

SnowMan

Just realised in firefox 5 and if you are using the latest version of flash you can now delete flash cookies through the TOOLS, CLEAR RECENT HISTORY options and then choosing cookies to delete and timescale everything. This didn't used to be the case only normal cookies were deleted.

Note if your settings are to delete cookies when you exit Firefox that seems to delete only normal cookies not flash cookies on exiting firefox. It is the tools, clear history route that deletes the flash cookies as well.

By doing this and nothing else I have switched from my computer being recognised by Tesco to being not recognised by Tesco. So ties in with what pqrdef has found.

So be careful if using firefox and without a mobile phone back up before inadvertently deleting flash cookies this way.

More problems for Tesco methinks.

So I have no PERSONAL evidence to suggest Tesco are using fingerprinting through a flash application as opposed to just a flash cookie.

hasdogs

pqrdef wrote: »

Renamed my flash cookie and tried to log in, got "You aren't on your regular computer"

Strange. I didn't need a flash cookie. It created one on the initial registration which I deleted I don't think it created any replacement.

Perhaps my fingerprint is more unique than others, it seems only about 1 in 400 people have 2560x1600 resolution monitors for example.