ns&i security problems

tom188

I suggest you read some of fellow forum member James's posts. His particular bugbear is Chip and Pin but you are both obviously on the same sensationalist fraud bandwagon. He also likes to post in relevent news articles of interest.

Personally I am much more concerned about my wallet or phone being stolen. If my account gets hacked, the bank has to refund me, if my phone gets stolen, I have to buy another one.

gpu

There's nothing "sensationalist" about it. Just like wallet theft, online fraud happens all the time. You sound like the sort of person who puts their wallet in your back pocket and your online passwords in your wallet! Burying your head in the sand doesn't help. And if you are careless with security the bank wont refund you.

DocProc

gpu

I for one, can see where you are coming from. What you are describing does sound a bit farcical, really.

It's "costing you" because, with this, you are involved in "I lose/they lose" situations all the time.

I think your enquiring mind is thoroughly deservant of a more 'supervisory' standard of explanation than that you are receiving from mere CS staff. If a senior manager can settle your mind down a bit and give you some reassurances and explanations, I think it would be a great help. For you and for them.

Actually, 98% of people are honest, you know. It is not the other way round.

Nevertheless, for an Internet savings account, there really should be online facilities to change a password. There are other issues, which then come into play, and the best safeguard here, is that withdrawals can only go out if they go back into the linked account from which they first came.

Judwin

I agree - you shouldn't have to EVER give your full password verbally over the phone - I wouldn't. But.

gpu wrote:

There are many key logger programs out their that could easily grab your password.

If you're worried about keyloggers, then it's the security of your machine that needs to be looked at - not the banks password system.

gpu wrote:

That's why the more secure sites will ask you for two or three letters only. It's also why others will ask you to select the letters/numbers via a drop down list (Nationwide for example)

I find these a royal PITA and they actually cause me to compromise my own security. One of my accounts has a 16 digit 'memorable phrase', and they then ask for the (for example) 2nd, 9th and 13th digit to be entered in the drop down boxes. As often as not I have to write down the 'memorable phrase' to count along to get to the 13th digit. I know i shouldn't - but I bet I'm not the only one.

For me - there is more danger of someone discovering my 'memorable phrase' by seeing it written down on a discarded scrap of paper than there is from a key logger discovering the whole password.

gpu wrote:

read this http://news.bbc.co.uk/1/hi/business/6279561.stm

Some people are just too stupid/reckless to own computers.:eek:

[Flame suit on]
:beer:
Judwin

masonic

Judwin wrote:

For me - there is more danger of someone discovering my 'memorable phrase' by seeing it written down on a discarded scrap of paper than there is from a key logger discovering the whole password.

So why not install truecrypt and store your memorable phrase within an encrypted file on your computer?

Mikeyorks

gpu wrote:

No secure banking system will ever ask you for your full password.

NS&I do .. but only when you ring up to change it!;)

They must find changing a password rather difficult - when the client won't tell them what the new one is? You now having read their T&Cs, and apparently having understood they can only change the password over the 'phone (post #8) .... you still seem to be none the wiser how OTT your original is.

nrsql

Not really surprised that people here seem so relaxed about password and system security. The biggest problem is usually not the systems themselves but the users attitude.
Saying that it doesn't help when companies put together systems that instill bad practices.

The OP's reaction may appear over the top but it's right that the company should have it's defficiencies pointed out. It's unlikely that this would cause a breach but that's probably small comfort to the people who do have problems and are then stuck trying to prove that the system is flawed (which the company will probably deny even if they know it to be so).

gpu

Mikeyorks wrote:

They must find changing a password rather difficult - when the client won't tell them what the new one is?

You still don't get it! If it was a good system you should never have to give your full password over the phone. ns&i even tell you not to do it.

Kilty_2

I didn't recieve a temporary password for my NS&I account when opening a Direct ISA, I chose the password that I wanted when applying....

Kilty_2

tom188 wrote:

The websites of


Lloyds TSB

all request your password in full.

Lloyds request characters from memorable data though, not the full phrase.