Wonga are now asking for online banking login details "to verify" applications

Thrugelmir

gazman100 wrote: »

The decision logic is definitely genuine, but given that most banks don't ask for full information, or use a special keypad thing, I doubt they'll "have" your information.

No passwords are provided. So there's no access to the account itself. Given the issues surrounding PD loans seems perfectly sensible approach.

worried48

I meant the Wonga PIN

matttye

Thrugelmir wrote: »

No passwords are provided. So there's no access to the account itself. Given the issues surrounding PD loans seems perfectly sensible approach.

Did you see the picture that was posted? It asks for user ID, password and memorable information.

rizla_king

matttye wrote: »

Did you see the picture that was posted? It asks for user ID, password and memorable information.

Thrugelmir

matttye wrote: »

Did you see the picture that was posted? It asks for user ID, password and memorable information.

Data entered will be encrypted.

rizla_king

There is no indication that it will be encrypted.

Even if it is, encryption only works between you and an endpoint, at which the data is available unencrypted at the other end.

With your bank's verified website you can be confident that the endpoint is your bank's own systems. With this the system could be making your unencrypted login details available to Wonga staff/systems or those of the 3rd party they seem to be using. You just don't know, and have no way telling.

It is also obviously going initiate a live login to internet banking piggybacking through the Wonga and 3rd party systems, which would be vulnerable to man in the middle high-jacking.

The whole think stinks and is completely unacceptable.

The ONLY place you should EVER be entering your internet banking login details is on the actual bank's website via a direct connection, and even then you would NEVER enter the all the security info in one go.

matttye

Thrugelmir wrote: »

Data entered will be encrypted.

So? Data is encrypted for transmission to the server and is decrypted when received by the server, but it is the server itself that we are concerned with having this data. We don't want Wonga or that other company to have our bank details!

HTTPS is for sending data securely to the server, so that third parties who manage to catch the data in transit can't do anything with it, because it's encrypted, but the server has the private key with which the data is encrypted and can therefore decrypt it.

Thrugelmir

matttye wrote: »

So? Data is encrypted for transmission to the server and is decrypted when received by the server, but it is the server itself that we are concerned with having this data. We don't want Wonga or that other company to have our bank details!

If you require an instant Pay Day loan. Then subjecting yourself to such a procedure seems a reasonable procedure.

Reducing bad debts has to be a good thing. Along with stopping people with debt problems already to spiral totally out of control.
Given credit is the cause of many of the issues faced in the UK today. Then anything that improves this should be welcomed.

I'm no fan of Wonga by the way.

Sparhawke

This is a satire/joke site and should not be taken seriously, why don't you get your facts or research from the BBC or other reputable sources instead?

DevCoder

Even https to your bank might not be secure as the protocol has been compromised in the last month in certain configurations.