Santander online banking query

PeskyBlunder

Somehow I've managed to end up with a second Santander online account, despite having used my first one for several years - it was because of a mismatch of personal details when I recently opened an ISA with them.

I've managed to logon and set a new security number (though it never asked my for the temporary password they also sent me) and can see my new ISA. Once I had logged out I received and email reminding me how to logon in future. The confusing thing about this email are steps 4 and5:

4 check your image and word/phrase appear and
5 enter your Password and Security Number

I've never set an image or word/phrase, and neither does it ask for my password - is this anything to worry about or have they just sent me out of date information?

Nasqueron

Your point 4 - I would message them, if you have never set one though, are you able to do so?

Your point 5 - I find it weird online that it only asks for user ID and the 5 digit PIN. I much prefer sites that ask for certain characters of your password and I especially don't like ones that restrict you to letters and numbers. That way I can have a 20 character random string that could never be cracked or guessed based on computer tech really for the next 20-50 years, perhaps longer

PRAISETHESUN

Nasqueron said:

Your point 4 - I would message them, if you have never set one though, are you able to do so?

Your point 5 - I find it weird online that it only asks for user ID and the 5 digit PIN. I much prefer sites that ask for certain characters of your password and I especially don't like ones that restrict you to letters and numbers. That way I can have a 20 character random string that could never be cracked or guessed based on computer tech really for the next 20-50 years, perhaps longer

Santander also make you do a 2FA check the first time you log into a new device, so even though it's only a 5 digit password effectively, there is still at least some additional protection (even if it is SMS-based). If you have issues logging in with the details you have/don't have, then I'd just suggest getting in touch with customer service and ask them for whatever info is missing to let you manage your online banking.

And I fully agree about the password restriction stuff. I use a password manager and basically set all my passwords to the absolute longest each website allows. I found one recently that allows 256 character passwords! I immensely dislike websites that limit your length and complexity, especially when they advertise the requirements so I know how to tailor my brute force attempt...

GeoffTF

PeskyBlunder said:

I've never set an image or word/phrase, and neither does it ask for my password - is this anything to worry about or have they just sent me out of date information?

They have sent you outdated information.

PeskyBlunder

GeoffTF said:

PeskyBlunder said:

I've never set an image or word/phrase, and neither does it ask for my password - is this anything to worry about or have they just sent me out of date information?

They have sent you outdated information.

Thank you.  Totally reassuring, I must say...

35har1old

PeskyBlunder said:

Somehow I've managed to end up with a second Santander online account, despite having used my first one for several years - it was because of a mismatch of personal details when I recently opened an ISA with them.

I've managed to logon and set a new security number (though it never asked my for the temporary password they also sent me) and can see my new ISA. Once I had logged out I received and email reminding me how to logon in future. The confusing thing about this email are steps 4 and5:

4 check your image and word/phrase appear and
5 enter your Password and Security Number

I've never set an image or word/phrase, and neither does it ask for my password - is this anything to worry about or have they just sent me out of date information?

Step 4 was a security feature in the past it has been redundant for sometime now.i quite liked the feature as you selected the image and phrase so when you logged on it confirmed to you that you where on the legitimate site hopefully some agent has selected a old formatted email and sent in error.
Santander has gone for speed of login and scarfised some security 
All that is required is your user ID and you 5 digit security number plus sometimes OTP sent to phone (online banking)
Once app is setup only requires 5 digit security number

35har1old

PRAISETHESUN said:

Nasqueron said:

Your point 4 - I would message them, if you have never set one though, are you able to do so?

Your point 5 - I find it weird online that it only asks for user ID and the 5 digit PIN. I much prefer sites that ask for certain characters of your password and I especially don't like ones that restrict you to letters and numbers. That way I can have a 20 character random string that could never be cracked or guessed based on computer tech really for the next 20-50 years, perhaps longer

Santander also make you do a 2FA check the first time you log into a new device, so even though it's only a 5 digit password effectively, there is still at least some additional protection (even if it is SMS-based). If you have issues logging in with the details you have/don't have, then I'd just suggest getting in touch with customer service and ask them for whatever info is missing to let you manage your online banking.

And I fully agree about the password restriction stuff. I use a password manager and basically set all my passwords to the absolute longest each website allows. I found one recently that allows 256 character passwords! I immensely dislike websites that limit your length and complexity, especially when they advertise the requirements so I know how to tailor my brute force attempt...

Not all password managers are equal

PRAISETHESUN

35har1old said:

PRAISETHESUN said:

Nasqueron said:

Your point 4 - I would message them, if you have never set one though, are you able to do so?

Your point 5 - I find it weird online that it only asks for user ID and the 5 digit PIN. I much prefer sites that ask for certain characters of your password and I especially don't like ones that restrict you to letters and numbers. That way I can have a 20 character random string that could never be cracked or guessed based on computer tech really for the next 20-50 years, perhaps longer

Santander also make you do a 2FA check the first time you log into a new device, so even though it's only a 5 digit password effectively, there is still at least some additional protection (even if it is SMS-based). If you have issues logging in with the details you have/don't have, then I'd just suggest getting in touch with customer service and ask them for whatever info is missing to let you manage your online banking.

And I fully agree about the password restriction stuff. I use a password manager and basically set all my passwords to the absolute longest each website allows. I found one recently that allows 256 character passwords! I immensely dislike websites that limit your length and complexity, especially when they advertise the requirements so I know how to tailor my brute force attempt...

Not all password managers are equal

Not sure I understand the point you are making there? Features between PWMs of course vary, but the barebones feature of storing and remembering passwords for you is a constant. My point was more aimed at websites artificially limiting password complexity by restricting either the maximum password length (probably the most important factor affecting password strength) and/or the types of characters you can use (eg. alphanumeric only, or only a small subset of special characters).

flaneurs_lobster

PRAISETHESUN said:

35har1old said:

PRAISETHESUN said:

Nasqueron said:

Your point 4 - I would message them, if you have never set one though, are you able to do so?

Your point 5 - I find it weird online that it only asks for user ID and the 5 digit PIN. I much prefer sites that ask for certain characters of your password and I especially don't like ones that restrict you to letters and numbers. That way I can have a 20 character random string that could never be cracked or guessed based on computer tech really for the next 20-50 years, perhaps longer

Santander also make you do a 2FA check the first time you log into a new device, so even though it's only a 5 digit password effectively, there is still at least some additional protection (even if it is SMS-based). If you have issues logging in with the details you have/don't have, then I'd just suggest getting in touch with customer service and ask them for whatever info is missing to let you manage your online banking.

And I fully agree about the password restriction stuff. I use a password manager and basically set all my passwords to the absolute longest each website allows. I found one recently that allows 256 character passwords! I immensely dislike websites that limit your length and complexity, especially when they advertise the requirements so I know how to tailor my brute force attempt...

Not all password managers are equal

Not sure I understand the point you are making there? Features between PWMs of course vary, but the barebones feature of storing and remembering passwords for you is a constant. My point was more aimed at websites artificially limiting password complexity by restricting either the maximum password length (probably the most important factor affecting password strength) and/or the types of characters you can use (eg. alphanumeric only, or only a small subset of special characters).

There's one financial institution that I have an account with that has a password length max of 8 characters, numbers and uppercase letters only. 

SacredStephan

35har1old said:

Step 4 was a security feature in the past it has been redundant for sometime now.i quite liked the feature as you selected the image and phrase so when you logged on it confirmed to you that you where on the legitimate site

I think Tesco Bank used this feature as well, maybe five years ago?

flaneurs_lobster

SacredStephan said:

35har1old said:

Step 4 was a security feature in the past it has been redundant for sometime now.i quite liked the feature as you selected the image and phrase so when you logged on it confirmed to you that you where on the legitimate site

I think Tesco Bank used this feature as well, maybe five years ago?

Doesn't the Barclays app have a user-chosen phrase on it's home page?

Can't check, on different device.