Santander 123 making a hacker's life so much easier (Feb 2020)

masonic

Louiscar said:

born_again said:

Security in many ways is how hard you make it.

>>Image and passphrase - to ensure you didn't click a bogus link<<  If someone had access to your computer it would be a easy task to spoof the image.

This I think is more designed for those that may respond to emails that purport to be from Santander or whatever bank. If successful they will get your ID and pin. Even though the 2FA is in place it will still be a privacy issue.

I'm however less concerned about this personally as I never respond to such emails but given that this method is still highly active must mean that a lot of people still get caught out by it.

As mentioned in the previous thread, the image and phrase doesn't work even for phishing scams. The fake site can just collect the userid and then scrape the correct information from the real santander online banking during the login process. As you say, 2FA wouldn't defeat that either, because the customer is expecting to provide this and will do so on the fake site.

It does seem an odd decision to use the 5 digit PIN rather than the complex password though.

masonic

By way of update on my posts on the previous thread, my trick of using uBlock origin to avoid the new login page no longer works.

However, I'm now being asked for userid, 5 digit PIN, and SMS code in order to log in. So 2FA at login is now live (it wasn't when I last checked).

born_again

masonic said:

By way of update on my posts on the previous thread, my trick of using uBlock origin to avoid the new login page no longer works.

However, I'm now being asked for userid, 5 digit PIN, and SMS code in order to log in. So 2FA at login is now live (it wasn't when I last checked).

Wonder if they are trialling the 2FA login.
As I just tried on back of your post.
Went via google link to Santander site and was only asked for 5 digit PIN.

masonic

born_again said:

masonic said:

By way of update on my posts on the previous thread, my trick of using uBlock origin to avoid the new login page no longer works.

However, I'm now being asked for userid, 5 digit PIN, and SMS code in order to log in. So 2FA at login is now live (it wasn't when I last checked).

Wonder if they are trialling the 2FA login.
As I just tried on back of your post.
Went via google link to Santander site and was only asked for 5 digit PIN.

Quite possibly, as I now see this:

Edit: and working again now, still with 2FA for me.

molerat

Just logged in and still using the number / password / pin / picture & word.  MrsM still using the old original number / full pin and picture & word.

masonic

molerat said:

Just logged in and still using the number / password / pin / picture.  MrsM still using the old original number / full pin and picture.

Using a bookmarked link / history item in your browser, or by going to the main santander.co.uk website and clicking the Log On button on the top-right?

EssexExile

I've just logged in & had to use the OTP by SMS

Slappermum

Just logged in with username and 5 digit PIN, after which I needed to authorise the log-in through mobile app (fingerprint). 2FA. I don't see the problem. 

born_again

Nope still going straight in with just 5 digit code. No 2FA here. Still using a google search for santander & link of their site. So is not a bookmarked link..

Weird.

brewerdave

Still logging in the "old" way; ID no. ,piccie and phrase ,characters from password and from PIN