A trivial PIN question
Discussion
I got a new credit card recently and it came with a default PIN I wanted to change.
I fired up online banking on my desktop PC but there was no option to do it. You can only change the PIN on a mobile phone with the relevant app, or, amazingly, at a cashpoint.
Why can you change the PIN on a 10 year-old piece of street hardware that's been kicked about by thousands of random punters, but not at home properly logged in to full fat online banking? (And why does an app have more functionality than the bank's own proper website?)
I fired up online banking on my desktop PC but there was no option to do it. You can only change the PIN on a mobile phone with the relevant app, or, amazingly, at a cashpoint.
Why can you change the PIN on a 10 year-old piece of street hardware that's been kicked about by thousands of random punters, but not at home properly logged in to full fat online banking? (And why does an app have more functionality than the bank's own proper website?)
Apps get more development than their website's version. My bank, for instance, updated the front end of the website account (some time ago now), but as soon as you access anything, it was back at the old looking s
te. So they just updated the front page and left the rest alone.
Plus now, if you want to log on to the web version, you more that likely have to use your phone to verify it's you. So you might as well just use the phone's app in the first place.
te. So they just updated the front page and left the rest alone.Plus now, if you want to log on to the web version, you more that likely have to use your phone to verify it's you. So you might as well just use the phone's app in the first place.
Phone apps can control access much better than web browser. For example most banking apps won't let you take a screenshot, which is trivial to do on a PC, because they're limiting what other functions on your phone can access the app, reducing the risk of a trojan on your device being able to access your login information.
It's also a lot easier for a scammer to create something that looks like the correct banking web page than something that looks like your banks phone app. For example a "man in the middle" attack on an unsecured wifi network (eg logging in from a cafe's wifi rather than at home) could hijack requests to access your bank's website and instead returns thier website. This should be impossible with a banking app because the app is running on your phone and sending encrypted data to the bank.
It's also a lot easier for a scammer to create something that looks like the correct banking web page than something that looks like your banks phone app. For example a "man in the middle" attack on an unsecured wifi network (eg logging in from a cafe's wifi rather than at home) could hijack requests to access your bank's website and instead returns thier website. This should be impossible with a banking app because the app is running on your phone and sending encrypted data to the bank.
Plus the hole in the wall machine has built in CCTV so they can all have a laugh back at HQ when you login.
'Jeeeze Simpo has let himself go since his last login, Dave.'
'Yeah. Seen how much he spends on pies at Lidl these days?'
'Ooooh no, I'll just have a look at his account 'for security checking purposes'.'
Lol.
'Jeeeze Simpo has let himself go since his last login, Dave.'
'Yeah. Seen how much he spends on pies at Lidl these days?'
'Ooooh no, I'll just have a look at his account 'for security checking purposes'.'
Lol.
Well, it makes sense if you look at it like that. Bizarre that a tiny thing you can lose on a bus or drop in a river is somehow more secure than a big box in my house.
Anyway, the good news is that the cashpoint did the job. Hurrah for old tech!
RizzoTheRat said:
This should be impossible with a banking app because the app is running on your phone and sending encrypted data to the bank.
But isn't the website running on my PC and sending encrypted data to the bank?Anyway, the good news is that the cashpoint did the job. Hurrah for old tech!
Simpo Two said:
But isn't the website running on my PC and sending encrypted data to the bank?
No: you’re dependent on accessing the correct website and then, once you’ve done that, sending data to the bank. If someone was to get in the middle you’d be looking at their clone of your bank’s website and sending your encrypted login details to them, not your bank.This is why a lot of people say you shouldn't do anything vaguely sensitive on a public wifi. Not that most of us listen to things like that. Apparently quite a lot of information can be harvested just from you connecting to a wifi network, and a captive portal (where you have to sign in to use the wifi) can capture even more stuff.
I went to a open day at the cyber security centre in Bristol some years ago. It was a bit of an eye opener what they could do then, 8-10 years on it's probably even scarier. I'm away in a hotel for a few weeks and bought myself a little travel router that lets me VPN back to my router at home, so I'm not putting any unencrypted traffic on the hotel wifi. Probably over paranoid but it's nice to get my geek on occasionally.
I went to a open day at the cyber security centre in Bristol some years ago. It was a bit of an eye opener what they could do then, 8-10 years on it's probably even scarier. I'm away in a hotel for a few weeks and bought myself a little travel router that lets me VPN back to my router at home, so I'm not putting any unencrypted traffic on the hotel wifi. Probably over paranoid but it's nice to get my geek on occasionally.
Nicetobenice said:
The app has more functionality than Web banking as that's what an increasing amount of people want - it's happening in many sectors.
Depends on the bank - there's a mix of features across app(s) and Web and quite often the Web one has features that the app can't easily handle or that they otherwise don't trust it with.Depends on their platform really.
Phone isn't better, just different in what it can support especially for device features and some of the security environment.
In the last job I had, we were creating training material for new starters to a civil service department.
It was trivially easy (for the programmers at least) to do a screen grab & the float a transparent screen over the top of it. Then on the transparent screen, they inserted boxes which did something when the user clicked on them. That way, we could direct the leaner to do the necessary. Often with complaints that the other boxes (on the screen grab) "didn't do anything".
So it must be really easy for crooks to clone / copy a bank, etc screen & stick nefarious stuff on top of it.
Which leads me to conclude that, as said above, mobiles are probably more secure (not that that feels right!!).
It was trivially easy (for the programmers at least) to do a screen grab & the float a transparent screen over the top of it. Then on the transparent screen, they inserted boxes which did something when the user clicked on them. That way, we could direct the leaner to do the necessary. Often with complaints that the other boxes (on the screen grab) "didn't do anything".
So it must be really easy for crooks to clone / copy a bank, etc screen & stick nefarious stuff on top of it.
Which leads me to conclude that, as said above, mobiles are probably more secure (not that that feels right!!).
Callerton said:
In the last job I had, we were creating training material for new starters to a civil service department.
It was trivially easy (for the programmers at least) to do a screen grab & the float a transparent screen over the top of it. Then on the transparent screen, they inserted boxes which did something when the user clicked on them. That way, we could direct the leaner to do the necessary. Often with complaints that the other boxes (on the screen grab) "didn't do anything".
So it must be really easy for crooks to clone / copy a bank, etc screen & stick nefarious stuff on top of it.
Which leads me to conclude that, as said above, mobiles are probably more secure (not that that feels right!!).
I believe apps come from Google Playstore (assuming Android). What's to stop bandits uploading fake apps in the hope you download the wrong one and send all your money to an attic in Albania?It was trivially easy (for the programmers at least) to do a screen grab & the float a transparent screen over the top of it. Then on the transparent screen, they inserted boxes which did something when the user clicked on them. That way, we could direct the leaner to do the necessary. Often with complaints that the other boxes (on the screen grab) "didn't do anything".
So it must be really easy for crooks to clone / copy a bank, etc screen & stick nefarious stuff on top of it.
Which leads me to conclude that, as said above, mobiles are probably more secure (not that that feels right!!).
In fact I think we might have the makings of a board game here. 'You have accidentally sent all your money to an attic in Albania. Miss two days while you phone your bank to sort it out'
Simpo Two said:
I believe apps come from Google Playstore (assuming Android). What's to stop bandits uploading fake apps in the hope you download the wrong one and send all your money to an attic in Albania?
In fact I think we might have the makings of a board game here. 'You have accidentally sent all your money to an attic in Albania. Miss two days while you phone your bank to sort it out'
Broadly speaking there is governance around the apps you can download from app stores.In fact I think we might have the makings of a board game here. 'You have accidentally sent all your money to an attic in Albania. Miss two days while you phone your bank to sort it out'
You'll still get people do stupid s
t but it's much less likely than someone either getting their PC infected or clicking some phishing link to a site that looks like a bank etc.mikeiow said:
butchstewie said:
They trust their hardware and mobile phone hardware more than they do some random PC that they know absolutely nothing about.
Yup.I don t get why so many older folk rail against mobile phones. Usually more secure than the computers you re using: embrace the future
I've found the best answer for the elders that I keep an eye on is a tablet/iPad with a stylus to help hit the right button - the learning curve isn't too hard and a tablet is much easier to see than a phone.
Gassing Station | Finance | Top of Page | What's New | My Stuff