Security

dosh37

Maybe it's just me becoming more like Victor Meldrew as I get older but I'm getting just a bit frustrated with the hassle of online banking, registration, sign-on and money transfer.

Now we have...

Customer id / Unique id.
Security number.
Registration Code.
Online PIN.
Password.
Telephone Banking PIN.
Card Number.
Login Security Icon.
Memorable Security questions and answers.
Electronic Security keypad/card reader (never there when you need it).
Security number grid card.
Mobile phone security code confirmation.
etc etc.

If you have to phone customer services you are bombarded with security questions we can't remember the answers to.

Banks and Building Societies don't seem to believe in customer loyalty. Their policy of reducing interest rates on existing accounts and introducing new bonused based accounts means we have to keep opening new accounts and moving our money around.

It's made worse because now we are encouraged to spread our savings around in case one organisation goes bust.

So now we have to operate and manage several savings accounts, each with their own set of security details to remember.

Since no one can remember all the details, in practice everyone has them either written down or stored somewhere which kind of defeats the whole idea.

Ok, I realise that security is necessary, but as time goes on, instead of technology making our lives easier, it's becoming more and more involved and tedious.

There has to be a better way.

exel1966

Yes, if you don't like it Victor, don't use it !

The security is there for your benefit. There are numerous encrypted programs available to store password details. I'm sure someone will come along shortly with a few examples.

MoneySaverLog

Stick it all in a excel spreadsheet and password protect it. Just don't forget that password.

masonic

I agree the banks could streamline some of these things a bit better (eg. all offer mobile phone verification as a second factor instead of each making you use a different 'dongle'). However, there is a huge advantage of having different login information for each site - if one site is compromised, the potential damage is limited to that one site.

Examples of good secure password management tools include Lastpass and Keepass. An encrypted spreadsheet will work, but only if the encryption is secure (the old .xls format does not offer adequate encryption itself). Truecrypt is a very good option for keeping an encrypted store of documents containing your credentials.

dosh37

That's what most of us do.

It may make things easy for the banks but it's not exactly human friendly.
I'm suggesting that what is needed is some kind of authentication technology (e.g retinal scanner) that allows us to access all security protected services in a common way.

I work with networked computers all day. If I had a pound every time I typed in username/password, I would be a rich man.

masonic

dosh37 wrote: »

That's what most of us do.

It may make things easy for the banks but it's not exactly human friendly.
I'm suggesting that what is needed is some kind of authentication technology (e.g retinal scanner) that allows us to access all security protected services in a common way.

I work with networked computers all day. If I had a pound every time I typed in username/password, I would be a rich man.

And if your retinal fingerprint data gets compromised?

dosh37

Poke your eyes out - simples.

xrjtg

MoneySaverLog wrote: »

Stick it all in a excel spreadsheet and password protect it. Just don't forget that password.

Unless things have changed recently, MS Office password protection is not secure; it does little more than add a flag to the file saying "don't display this if the user hasn't typed in the following password". Other programs are free to ignore this instruction.

If you want to store important password electronically they need to be encrypted, so that the information in the file is unreadable without the password.

Edit: masonic has already covered this.

Edit2: And again below. Apparently "recently" is post-dark ages.

masonic

xrjtg wrote: »

Unless things have changed recently, MS Office password protection is not secure

From Office 2007, the password protection uses AES-128 encryption (using AES-256 is also possible), so is perfectly adequate providing you save in the new file format.

MoneySaverLog

I think given that a) you would need physical access to the computer b) know the login password and c) know the excel 2010 document password I think it is quite secure. The only concern I'd have is if it were stolen, but even then they'd have to have the passwords.

masonic

MoneySaverLog wrote: »

I think given that a) you would need physical access to the computer b) know the login password and c) know the excel 2010 document password I think it is quite secure. The only concern I'd have is if it were stolen, but even then they'd have to have the passwords.

There is no need for physical access if your computer is connected to the internet. However (b) and (c) make this approach reasonably secure providing you are able to keep your computer free of malware and viruses.

Edited to add: This isn't something you'd want to admit to your bank, though, because they could use this against you in the event of a security breach.