Alliance & Leicester online banking
Follow-up to Is one password enough with Single Sign On? from Kieran's blog
Interestingly, just after writing about different levels of security, my bank has gone and changed their online banking system.
Alliance & Leicester online banking demos
They have put in two new measures.
1) The first measure is to be a bit more sure that you are who you say you are when logging in. The first time you register, the take a look at what they call "Your computer characteristics" (basically probably your IP address and browser agent). They then use this to let you in with just a customer number and PIN from known computers, but ask you something else like your mother maiden name or place of birth as another security question before letting you in.
2) The second measure is to let the customer know for sure what site they are logging into. This is for people who fall for the fake bank emails they get. Basically, the first time you register you are shown a random, but distinctive image and are asked to enter a phrase as well. These are then show to you after you enter your customer id but before you enter your PIN. The idea being that if you login and don't recognise your own image and passphrase, then don't enter your final PIN as you might be on a fake site. To be honest I'm not sure how much this is going to help as the kind of people who fall for these fake emails and sites are probably also fooled by something like just saying. "Your previous image has no expired, please pick a new image and pass phrase." Oh well.
16 Mar 2006 20:39
| 
Tags: ITS Single Sign On
| 
Comments (2)
| 
Report a problem
whilst they seem to be doing something positive about security I worry most about key loggers. regardless of what they try and do on their side, if you have one then someone's going to be getting all your cash. An easy way to stop that is the system Nationwide use, which is to say you have to pick numbers from your pass code from drop down boxes, this will stop the effects of key loggers and make the site more secure… unfortunately this idea doesn't seem to have become the norm…
24 Mar 2006, 16:34
I hadn't actually thought about key loggers to be honest. I wonder how common they are. As you say, the majority of websites would be caught out by this. Cahoot is another one that requires you to pick your password with drop down lists…damn annoying though.
27 Mar 2006, 09:08
Add a comment
You are not allowed to comment on this entry as it has restricted commenting permissions.