MSE News: Customers can't keep track of passwords

Ectophile

I detest Verified by Visa, and avoided it as long as I could. It's bad enough trying to remember a long password, but then being asked for the 2nd, 5th and 9th letters leaves you counting off the letters on your fingers trying to pick the correct ones. I usually make a mistake and end up having to try again.

The stupid thing is that if you get it wrong too many times and have to reset your password, then the information you have to supply is probably no more than what someone who has stolen your credit card would already have anyway.:mad:

bubieyehyeh

Password manager software are a great idea, however a growing number of banks are outlawing their use in their terms and conditions.

One bank which has this effectively outlaw anything other than remembering passwords in your head. They also limit the number of character you password can be from a set of only 36 characters, since they only allow letters and numbers, but don't tell you they ignore the case of the letters.

dalesrider

If only I had so few......
20+ at work most of which change at various intervals. None of which match. Various lengths, some have to have caps or numbers some dont.

And they expect you to remember them.....

Well they are in for a shock as the vast majority have them recorded somewhere

innovate

Crikey, I feel like in a time warp. People not remembering their passwords was commonplace in the late 90's. What's new? More people can't remember more of their passwords now?

callum9999

redbiro wrote: »

Ryanair additionaly want you to fille in there scribbly letter capthca & dont forget to click the T&C box are you'll get sternly warned ;Michael mcintyre did a sktecht about it

Ryanair don't use passwords at all?

And I'm sure I read on a previous story on MSE (if not here, it was definitely widely reported in the media anyway) about a report saying it's perfectly fine to write down your passwords. Most burglars aren't interested in that kind of thing, and as it's on paper and not stored on the computer, it's out of the reach of hackers.

thepearce

http://xkcd.com/936/

Fella

Ectophile wrote: »

I detest Verified by Visa, and avoided it as long as I could. It's bad enough trying to remember a long password, but then being asked for the 2nd, 5th and 9th letters leaves you counting off the letters on your fingers trying to pick the correct ones. I usually make a mistake and end up having to try again.

The stupid thing is that if you get it wrong too many times and have to reset your password, then the information you have to supply is probably no more than what someone who has stolen your credit card would already have anyway.:mad:

And the most ridiculous thing of all is that only some sites insist on it.

Hence its' like having a huge annoying difficult lock on one door of your house and another door next to it that doesnt have that lock. It adds literally nothing in the way of security, just plenty in terms of hassle.

The most annoying thing of all is those sites that don't even give you the option to "activate later" if you haven't signed up. I refuse to buy from those sites & just cancel the transaction & shop elsewhere.

tyllwyd

The other aspect that isn't mentioned in the original article is that for banks you often have to remember three different pieces of information - customer number, passcode, password. Even if someone got hold of your password, they would struggle to get into more than one account.

I think the much bigger danger is places like itunes and xbox live where they store your bank details often without you realising, and then a family member (usually a child) is using your account, and ends up ordering stuff without you noticing until it is too late. How many threads like that get started on this website?

roddydogs

& in further news, the Pope is catholic.

Hominu

Fella wrote: »

And the most ridiculous thing of all is that only some sites insist on it.

Hence its' like having a huge annoying difficult lock on one door of your house and another door next to it that doesnt have that lock. It adds literally nothing in the way of security, just plenty in terms of hassle.

Your forgetting something.

VBV is nothing to do with protecting you as a customer, and everything to do with yet another get-out clause by the bank. "That transaction was VBV, it can't have been fraudulent". Just like when they refuse to refund because a transaction was "Verified by PIN".

If a fraudster doesn't know your VBV password, they can probably find the information required to reset it.

IMO, transactions should be tied to your OLB much more closely. VBV should only ever be able to be changed from your OLB, and any suspicious transactions should show up on your OLB for you to approve or decline. If someone doesn't have OLB, then they must ring the bank. A customer should also be able to say "All CNP transactions must be approved by me via OLB" if they don't use the card much online, have been hit with fraud before, or just want the extra security.