NSANDI support?

Malthusian

ColdIron wrote: »

Make a secure note of your security questions?

Terrible advice. This is the kind of thing that can make you personally liable if someone does hack into your account and steal your money. Normally the provider is liable unless you are grossly negligent. Writing down your password is always example no. 1 of gross negligence.

Making a note of your "security info" is not as bad as writing down your password (since your mother's maiden name etc could be discovered by anyone from public records) but I still wouldn't want to argue that point in court if the bank refused to reimburse.

I don't know exactly what you meant by "a secure note" but putting them in a password-protected file would be pointless as if the OP could remember passwords he wouldn't be facing a minor delay in getting his money out. And not many people would go to the lengths of writing them down and putting them in a physical safe.

If you can't remember passwords then either don't use online services or allow extra time to go through the password retrieval system.

Eco_Miser

Malthusian wrote: »

I don't know exactly what you meant by "a secure note" but putting them in a password-protected file would be pointless as if the OP could remember passwords he wouldn't be facing a minor delay in getting his money out.

I use a piece of software called Password Safe to store logon details. Instead of having to remember about twenty passwords, some rarely used, I only have to remember one , which is used frequently, and so is easily remembered.

6022tivo

This has happened to me twice now, the phone verification is a pain as if you hang up or get it wrong once, the account is locked and takes physical mail to sort it.
Personally, although a pain, I like it as it keeps my money safe.

bravotango

I know a friend of mine who had to get their password completely reset though the post recently, as NS&I did an upgrade of their systems, and the password my friend used wasn't completely compliant with the new requirements.

It is a bit backward having to get the password sent in through the post, rather than letting you reset it there and then online.

I think they got the new password in the post within 4-5 days from memory.

Pincher

The really irritating thing is, the new Log-in screen wants you to type your complete password. Before, it was the nth character.
Imagine if the browser remembered your password. :eek:

stringer_bell

the complaints team rang me today, they apologised and said that on the second security question round, I actually got it right and it was successful, so for some reason it locked me out

they gave me £25 compensation, or as a gesture of goodwill, probably more than I win from premium bonds

Malthusian

Eco_Miser wrote: »

I use a piece of software called Password Safe to store logon details. Instead of having to remember about twenty passwords, some rarely used, I only have to remember one , which is used frequently, and so is easily remembered.

I use one password across everything where it really doesn't matter if it gets hacked into (like MSE). Only financial stuff gets unique passwords. I don't really see the point of "password lockers" as it just means that instead of having to guess your password (or hack in via an easier way), the thief has to guess the password to your password locker. Or know where the password locker's developer put the backdoor.

There is no need to overthink password security. The important thing is not to do anything that would make you liable for your losses from fraud instead of your bank.

Eco_Miser

Malthusian wrote: »

I don't really see the point of "password lockers" as it just means that instead of having to guess your password (or hack in via an easier way), the thief has to guess the password to your password locker. Or know where the password locker's developer put the backdoor.

They also have to gain physical access to the device it is stored on, unless they can bypass the firewall and other security to read the file while it's plugged into the computer (only while I'm banking).

Malthusian wrote: »

Only financial stuff gets unique passwords.

I have enough bank and investment accounts, and a poor enough memory to require a back-up.
I also consider email accounts and my personal (and formerly my employer's) websites to be worthy of unique passwords.