Hsbc new secure key - i hate it !!!

Thrugelmir

allan673 wrote: »

my mortgage is with first direct. i may transfer my banking to them? i am looking this weekend at alternatives to hsbc. are lloyds any good for internet banking??

Used online banking for many years never had major issues. Recently the software had a facelift. Overall I would say made application less user friendly. Still adequate for day to matters though.

Sharon87

*Ro* wrote: »

Ironically just got mine in the post this morning :eek:
err will see how it goes, probably will end up not using the account and getting blocked.... !!!!!!

Online banking told me when I had to update by, I did it at the last minute.

I find the Secure Key encourages me to use my internet banking less, so if there's unusual activity on my account I might not spot it! I lost the secure key for about a week and didn't check my account for that whole week, I use to log on once or twice a day.

DCFC79

I can see it being annoying but its for security reasons, luckily my rbs and natwest accounts dont use this feature although i do have the card reader device but only in use when setting up stadning orders.

Sharon87

Yeah I find the secure key best when it's only to make transfers, not for logging in all the time

aardvark65

Sharon87 wrote: »

Online banking told me when I had to update by, I did it at the last minute.

I find the Secure Key encourages me to use my internet banking less, so if there's unusual activity on my account I might not spot it! I lost the secure key for about a week and didn't check my account for that whole week, I use to log on once or twice a day.

I completely agree. It is not user friendly, makes me not want to bother and I used to keep a close eye on my account. It also looks like it will break fairly easily or if you do carry around will get lost - thereby stopping you accessing your account at all. There must be an easier way of providing security!:mad:

hermante

Grimbal wrote: »

anyone know how it works out of interest? Is it a random number generator - and if so, how is this transmitted? Or is it loaded up in advance with a series of numbers? Been driving me mad thinking about it since I first received it

Each device contains a clock and a unique code. When you press go, it calculates a hash based on the date/time and your code. HSBC does the same calculation. (The time is only accurate to a few seconds so that you don't time out.)

Lokolo wrote: »

With the number of smart phones now available I don't know why you can't have an app on your phone which replicates the secure code device. Would be a lot easier. Blizzard use it for their games such as WoW and Starcraft2.

1. Not everyone has a phone, and there are different models which update their software every so often. Exploits are discovered daily. New phones come out all the time. It is easier to have every customer use the same device (WORLDWIDE - there used to be different devices in different countries but they are now standardising it), and one that they are at least nominally in control of.

2. The unique code for every customer's login has to be programmed into a phone app. If you know the code, you can duplicate the app (or the securekey itself) which will allow you to log in without the genuine customer knowing. Also, the device is meant to be tamper-proof, while anyone with access to the app can work out what formulas they use. It's probably possible for a determined attacker to gleam a customer's code from their phone by walking behind them for a few minutes.

For Blizzard it's no different to logging in with one username and password, which you can do on the bank's site itself. I hope it's clear that the banks want to take an extra form of security, requiring something that only you know as well as something that only you have.


The disadvantage is that there is a single point of failure. If HSBC or RSA are compromised (RSA was compromised recently) then everyone's data is at risk, but at least it is absolutely their fault and they probably have contracts and insurance for those situations.


Personally, I find it a minor nuisance, especially just for logging in, but you just have to get used to it. I am probably in breach of their T&Cs as I occasionally need family members to log in to my account or vice versa, however now the person logging in needs to be awake at the same time as the person with the device, and they both need to be in an area with phone reception!

Sagar_Fuzz

I have to say, I really hate it. If I am being really cynical, I suspect it is just a way of banks pushing the risk onto you, the customer. This is classic corporation technique - always try to make the other party take on the risk if there is any risk to be had.

No-one could steal my passwords before, but anyone could steal this device. Sure, they'd have to have my passcode to log on, but if passwords / codes are so insecure, doesn't this just add an annoying extra step for the thief, rather than stop them?

Internet banking is supposed to be instant access, anywhere. Now I can hardly log on as I don't want to carry this hee-haw around with me. Hence, I check my account far less, hence a greater chance of missing any errors/fraud appearing in my account.

A classic case of missing the element of human nature and thinking technology would solve everything? Of being able to point the finger of blame at the customer instead of at the bank? You decide!

System

This sort of thing was one of the reasons I changed banks. I went with Metro Bank - they have no such security device, and don't even operate the secure Mastercard scheme for when you buy something with your debit card online. Worth a day out in London to open the account - you walk out of the branch with your cheque book, debit card and online banking all set up. No fees on overseas transactions either, and their online banking service is excellent.

Bloomberg

Grimbal wrote: »

Have to admit I'm not a fan either. I've put it on my car key - my thinking is that I'm such a lazy b*gger that as I never go anywhere without the car, I won't be without the little gadget either

anyone know how it works out of interest? Is it a random number generator - and if so, how is this transmitted? Or is it loaded up in advance with a series of numbers? Been driving me mad thinking about it since I first received it

I did read somewhere that the secure key has a clock inside it, every minute or so your access code changes. I generated a code and did not actually logged on. When I actually generated a code to log on a couple of hours later it worked.

This suggests that it is not loaded up with a series of numbers. I can only guess that the clock in the secure is somehow in sync with the HSBC database. This system seems so secure that I can only assume other banks will soon follow suit. Sorry I cannot answer your question about how this system works.

Sharon87

Even though it's annoying, it's better than a card reader for logging in. Because then you would need 2 things, your card reader and your bank card. And at least you don't need it again for making bank transfers.

I've decided to use my HSBC bank as an inbetween bank (until overdraft is gone) get paid into there, transfer money to other accounts/debts. Easier than using Natwest for it where you need to generate a new code for each transfer.

It's not as bad as I first thought it would be. I just need to make sure I keep it in a safe place. I did lose it for a few weeks at one point! Now it's nearly always in a specific drawer.