Santander Security is OTT

GeoffTF

grumpy_codger said:

And if even an amateur like me can easily disable this 'security', isn't it worthless?

Most people do not go out of their way to disable security measures. Most people probably do not even want to disable them, but some do. There is not much Santander can do about that.

BooJewels

They seem to have stepped something up very recently - I've never had any difficulty with either Web page or app.  But I posted this in a thread a couple of days ago, about Cahoot log in not working in the Santander app:

I've been having issues with Santander this afternoon after getting a new phone and got stuck in a loop where the app wouldn't allow me to log in without clicking a link in an email to verify my ID - but the email had to be on the same device as the app - which it wasn't.  But I couldn't change my account email address without verifying it was me trying to do so - in the app.  I just assumed it was a preposterous arrangement I was falling foul of - but maybe there are issues today.

I need a lie down, that's 2 hours of my life I won't get back!

After a few attempts to change my email address, it eventually offered me alternative methods to verify, including an OTP.  So I was able to sort it, but it took a while.

GeoffTF

GeoffTF said:

grumpy_codger said:

And if even an amateur like me can easily disable this 'security', isn't it worthless?

Most people do not go out of their way to disable security measures. Most people probably do not even want to disable them, but some do. There is not much Santander can do about that.

The point here is that Santander’s security measure aims to stop malware from pasting an OTP into the field. Overriding that security measure increases the risk that malware will enable hackers to get into the account. 

grumpy_codger

GeoffTF said:

GeoffTF said:

grumpy_codger said:

And if even an amateur like me can easily disable this 'security', isn't it worthless?

Most people do not go out of their way to disable security measures. Most people probably do not even want to disable them, but some do. There is not much Santander can do about that.

The point here is that Santander’s security measure aims to stop malware from pasting an OTP into the field. Overriding that security measure increases the risk that malware will enable hackers to get into the account. ...

• Why is 'paste' disabled only on the second page (OTP) then, and not on the first (ID and security number)?
• Can't malware easily imitate typing instead of pasting? I checked with my KeyPass and it doesn't have any problems with filling this field.

I stick to my guns - this OTT security only makes life of the customers harder. Any professional (or even amateur) hacker will easily overcome it.

ranciduk

I'm getting my money out of TSB 

Once they get gobbled up by Santander,  I don't want to be subjected to all this palaver! 

GeoffTF

grumpy_codger said:

GeoffTF said:

GeoffTF said:

grumpy_codger said:

And if even an amateur like me can easily disable this 'security', isn't it worthless?

Most people do not go out of their way to disable security measures. Most people probably do not even want to disable them, but some do. There is not much Santander can do about that.

The point here is that Santander’s security measure aims to stop malware from pasting an OTP into the field. Overriding that security measure increases the risk that malware will enable hackers to get into the account. ...

• Why is 'paste' disabled only on the second page (OTP) then, and not on the first (ID and security number)?
• Can't malware easily imitate typing instead of pasting? I checked with my KeyPass and it doesn't have any problems with filling this field.

Santander seems to be less worried about the first OTP. As I have said, I do not get that one at all. In principle, malware can imitate typing, but the malware out in the wild may not do that. Santander's security experts will know more about this than anyone here. I do not believe that they are putting in obstacles just to annoy their customers.

grumpy_codger

GeoffTF said:

grumpy_codger said:

GeoffTF said:

GeoffTF said:

grumpy_codger said:

And if even an amateur like me can easily disable this 'security', isn't it worthless?

Most people do not go out of their way to disable security measures. Most people probably do not even want to disable them, but some do. There is not much Santander can do about that.

The point here is that Santander’s security measure aims to stop malware from pasting an OTP into the field. Overriding that security measure increases the risk that malware will enable hackers to get into the account. ...

• Why is 'paste' disabled only on the second page (OTP) then, and not on the first (ID and security number)?
• Can't malware easily imitate typing instead of pasting? I checked with my KeyPass and it doesn't have any problems with filling this field.

...I do not believe that they are putting in obstacles just to annoy their customers.

Neither do I. There is a much simpler explanation - (overzealous) idiots can be found everywhere, even among 'security experts'. And their unique 8-character alphanumerical OTP (when online access gets blocked after few unseccessfull attempts) is a good proof of this. 
Give someone enough rope, ....

GeoffTF

ranciduk said:

I'm getting my money out of TSB 

Once they get gobbled up by Santander,  I don't want to be subjected to all this palaver! 

Why do you think you will? I am not. Santander's security is less intrusive than other banks in my experience. I can login without 2FA, which is not usual. I can make £100K Faster Payments over the telephone, which is also not usual. I can make £50K debit card payments with no more than an OTP. Show me a bank that promises more. I do not know why some customers get security heavy and others get security light, and I am not going to speculate.

Apart from less intrusive security (which is not always an advantage), Santander does not offer a particularly good deal nowadays. It is average in the official service quality survey for just about everything. The 123 Lite has gone. It does not have the perks that other banks offer. Nonetheless, I am not complaining. It is working for me. As far as security is concerned, it looks a bit thin, but I expect that they know what they are doing.

grumpy_codger

GeoffTF said:

ranciduk said:

I'm getting my money out of TSB 

Once they get gobbled up by Santander,  I don't want to be subjected to all this palaver! 

...

Apart from less intrusive security (which is not always an advantage), Santander does not offer a particularly good deal nowadays. ...

It offers 6% on easy-access £4K for a single person, or up to 3x£4K 4x£4K for a family. Plus 5% regular saver that is easy-access too.

IMO this is good.

where_are_we

A family can get 4 Santander Edge savers. 123 lite has gone but we still make almost £2 on cashback each month with Edge Current account once fees have been taken and as bills inevitably increase that cashback can only get better (small consolation). Yes -  security measures are slightly annoying but you can increase your daily payout limit on the app for a large payment and then immediately reduce it again afterwards.