Using Website Lastpass to store bank log-in, will banks mind?

Christabel

My nephew, the computer security expert, has advised me to use Lastpass to store all my passwords etc so that I can't be hacked. That statement will probably cue other security experts to shout that statement down! But I have been reading that banks are putting clauses into their T&Cs saying you shouldn't let your computer save passwords or automatically use them for online forms. Is that the same thing do you think? Any advice would be appreciated please.

Racheya

It's a mixed bag imo. I'm a computer science graduate and I use a password manager for most things because you can generate good passwords that you'd never remember and as long as you have a strong password for your last pass, it issecure.

The only thing I don't use it for is for my bank, I'm just a little too wary I suppose. I think the advantage of having a bank-only password known only to yourself outweighs some of the advantages last pass and similar bring.

I wasn't aware of those T&C's but I think that they may cover this. They won't want to be liable if last pass gets hacked and your password is stolen - despite how unlikely that would be. The question is whether that risk is acceptable to you or not.

baggers02

I would imagine that if your bank became aware of how you were storing your passwords etc it would be sufficient for them to wangle out of any responsibility to reimburse you for any fraud at a later date.

innovate

I have never seen any T&Cs for bank accounts that prevent the use of password stores such as Lastpass. I also can't see how any bank would be able to determine that you are using Lastpass, unless you tell them you do.

Many bank T&Cs now include an express permission to use account aggregators, which store your passwords in an encrypted form on your computer - so do essentially the same with passwords as Lastpass does. An example is clause 4.8 in the Lloyds T&Cs.

Aquamania

LastPass Corporate HQ

8315 Lee Hwy Suite 501 Fairfax, VA 22031, USA

Doesn't sound like a PO Box at all does it?

Definitely the sort of place to happily send full details of your banking ID, logon, card numbers, security codes, PIN etc.

I know I would ... :cool:

pmduk

I'm with the earlier poster, I use it to store banking numbers & IDs; but not the actual passwords. Once you're using Lastpass, the only other passwords to remember are your banking ones so it does make life simple

innovate

pmduk wrote: »

I'm with the earlier poster, I use it to store banking numbers & IDs; but not the actual passwords. Once you're using Lastpass, the only other passwords to remember are your banking ones so it does make life simple

It's perhaps a good compromise that works for many people. Personally, if I couldn't trust the password store fully I wouldn't use it at all.

dunstonh

Lastpass and Roboform are two of the most popular password managers. They are both secure and well regarded but they are reliant upon you having a strong password for them and for you to be auto logged off.

If anyone can start your PC and log into windows and you have lastpass set to auto-login with details pre-filled then it is not secure.

SailorSam

I use Lastpass and store my bank details there, but i'm not sure you could log on automatically even if you wanted to. When logging on to one of my banks i have a 6 digit password and the bank asks for 3 of those numbers. For example it' will ask for the second; third; and sixth. I can't see how your computer could do that. My other bank has like a little credit card size thing that changes the numbers each time i use it. Again i can't see how Lastpass could do that.

pmduk

innovate wrote: »

Personally, if I couldn't trust the password store fully I wouldn't use it at all.

I do trust Lastpass, but by not storing banking passwords in it I can honestly answer the banks' questions on storing passwords should fraud ever occur on my account

masonic

Aquamania wrote: »

Definitely the sort of place to happily send full details of your banking ID, logon, card numbers, security codes, PIN etc.

I know I would ... :cool:

Fortunately, you don't have to share any of those details with Lastpass, since all they see is your encrypted store. While not open source, the protocol was released into the public domain and has been subject to review. The only risk is that they turn nefarious and distribute an update that compromises the existing security. This is of course true of any online tool or software that auto-updates itself, so you may prefer a good old pen and paper (though the banks seem to like that even less).