9 ms·
What sort of clowns stored the credit card number in a cookie? Seriously? What a breathtakingly stupid show of total incompetence. Was considering switching
by TomGullen 14y ago
What sort of clowns stored the credit card number in a cookie? Seriously? What a breathtakingly stupid show of total incompetence.
Was considering switching my personal account to Santander, have been looking to move away from Natwest for a while now. Natwest are a dismal failure of a bank to the extent I'm always happy to go out my way and dissuade people from associating with them in any way. I'll be writing Santander off my list for sure now. How on earth can you trust them after seeing this?
For a business who HAS to take security seriously, for a business with a LOT of resources, for a business who hold YOUR cash this is utterly pathetic and inexcusable on their part.
Leaving them might be a good idea for your personal security, unfortunately the UK is a little short of good banks. Would love to see someone shake up banking like Stripe has shaken up online payments.
- lmm 14y agoFirst Direct consistently scores highly on customer service, you might want to try them.
- pornel 14y agoTheir online banking interface is a bit old and crummy. I don't believe they take security seriously either. They force a 640px popup window that deliberately hides addressbar, so you can't easily check if it's HTTPS. My browser warns me that their site still has SSL renegotiation vulnerability unpatched.
- mietek 14y agoFYI: It's possible to open that popup in a new tab.
- marshray 14y agoWould you consider doing everyone a favor and link the results of the https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/ Qualys SSL labs test for that site?
- mietek 14y agoLooks OK: https://www.ssllabs.com/ssltest/analyze.html?d=https%3A%2F%2Fwww1.firstdirect.com https://www.ssllabs.com/ssltest/analyze.html?d=https%3A%2F%2...
- epo 14y agoDo you have any grounds for this disbelief or do you just a go around changing the subject to make unsubstantiated assertions? FD's customer service (the subject of the parent comment) is beyond excellent, they set the standard to which all others should aspire. The comment about hiding the addressbar is simply tinfoil hat-ism. You are the first and only person to mention the SSL issue so far as I can see, given the quality of your other comments I am inclined to disregard this as you not understanding what you were being told or because you are using a defective browser. EDIT: I've just logged in, my popup window (Firefox, OS X) does have an address bar. My instinct was correct, you have no clue.
- pornel 14y agoFirefox simply does not respect firstdirect's wish to hide the addressbar, which doesn't mean they're not trying. Safari obeys their wishes fully. Run this in JS console before clicking "Internet Banking" window.open = function(){console.log(arguments)} and you'll see: ["/1/2/pib-service", "pib", "toolbar=0,location=0,directories=0,status=1,menubar=0,scrollbars=1,resizable=1,width=780,height=510,top=0,left=0"] Note "toolbar=0,location=0,menubar=0" which is a quite strong attempt to hide all window chrome.
- dspillett 14y agoI switched to FD over a decade ago after many cock-ups by NatWest (my previous bank for ~6 years), been happy since. A few minor problems, but they have always been fixed quickly to my satisfaction.
- nicholassmith 14y agoBarclays online offerings are pretty good as well, depends on how much you can ignore their slightly shady ethics when it comes to investment banking. They also weathered the last financial meltdown a bit better than the rest, so there's that. UK is definitely missing a trustworthy, ethically sound bank though.
- lucian1900 14y agoDoes any country have one of those?
- ookware 14y agoWhat about The Co-Operative Bank? http://www.co-operativebank.co.uk/servlet/Satellite/1193206375355,CFSweb/Page/Bank http://www.co-operativebank.co.uk/servlet/Satellite/11932063...
- quarterto 14y agoGot there seconds ahead of me. Co-op (and Smile, their internet alter-ego) seem to be the ethically best choice. And their customer service is the best of anyone, ever.
- MattJ100 14y agoDitto. I have had an account with them for some years, and have always been incredibly pleased with their customer service. As another commenter wrote, their online banking is "primitive", but it's usable.
- desas 14y agoI'm assuming it'll get upgraded when they move over to the lloyds tsb infrastructure. I have no idea how good that is.
- nicholassmith 14y agoI've heard negative things about their online banking and customer service, but those were a while ago so I'm not sure what the state of play is now. Could be worth a try, I do like their ethics.
- belorn 14y agoIf they bank does not have a two token security system, its is not secure. A single password should never, ever, anywhere, be enough to legally prove identity or validate a bank transfer.
- joevandyk 14y agoDoesn't seem too awful to store obfuscated credit card details in a short-lived cookie with httponly and secure set. (Say, in a checkout flow where you have to hold the credit card details somewhere for a couple minutes).
- krapp 14y agoMaybe a naive question/response on my part but why not rather encrypt it and hold it in a session? Or if you have to put something in a cookie, just a reference that points to some data on the server like an id, which has no real meaning to the end user?
- joevandyk 14y agoThat means holding the credit card information on the server. Seems safer to hold it temporarily on the client.
- sopooneo 14y agoI may be missing something, but what does it mean to "hold something in a session" if not to either (1) store it in a cookie (encrypted or not) or (2) store it server-side with a token stored in a cookie pointing to it?
- krapp 14y agoI meant storing it on the server - just preferring not to have any actual cc data on the cookie, even obfuscated or encrypted. It may be a distinction without a difference, though, I honestly have never dealt with anything more complex than your basic 'hash username and password and check the hash when they login' scheme.
- TomGullen 14y agoIt's terrible - I have no idea if it's PCI compliant (I would hazzard a no here) - Obfuscation is such weak security it should be considered as pretty much worthless - It's vulnerable to cookie jacking over non HTTPS - It's vulnerable to theft if you have access to a computer where someone has logged on There are other ways of doing it, putting it in a short live cookie is one of the worst ways
- dcminter 14y agoI've found Santander to be absolutely ghastly as soon as any exceptions to their core process occur. Anecdotal, but in my opinion you're probably better off avoiding them anyway.
- nessus42 14y agoMaybe I'm an ignoramus, but what's wrong with storing your credit card number in a cookie, as long as it's encrypted? This is how session management is typically done, right? Your session information is stored encrypted in a cookie so that on subsequent page requests, the server still knows who you are, but the session information is encrypted and decrypted on the server, so that the client can't forge the session information. If this technique is good enough to make sure that you still are who you said you were when you logged in, why is this not good enough for storing other sensitive information? And if it's not good enough for session management, then you're in deep trouble anyway, since someone else can now log in as you and funnel all your money into their Swiss bank account. Edit: As it turns out, it seems that most cookie-based session data is only stored cryptographically signed, rather than encrypted. The reason for this seems to be that HMAC signing is up to 4X faster than encrypting with Blowfish.
- aaronbasssett 14y agoBut it is not even encrypted. And AFAIK most (sane) sites do not store you account information encrypted in the cookie, they store a session id. This session id is then used to find the relevant session information which is stored on the server.
- pfraze 14y agoIANA security expert but I think session info is somewhat protected by the short TTL. The amount of time required to get at the session data should (hopefully) exceed its window of validity.
- phil 14y agoWell for starters, it's common practice (e.g. in Rails' cookie store, but many others too) to leave the cookie contents as plaintext and just append a HMAC so that you know they haven't been tampered with.
- nessus42 14y ago> it's common practice (e.g. in Rails' cookie store, but many others too) to leave the cookie contents as plaintext and just append a HMAC so that you know they haven't been tampered with. This approach seems strange to me. Why is this approach taken? Why not encrypt everything? I only really know anything about writing server-side web code from using Play Framework, which provides a "session" object for storing information in the browser using the cookies mechanism. Everything in the session object is kept encrypted on the client in a cookie. The most common use for the session information is to store a user ID and/or a session ID, but I believe it not uncommon to use this to store additional small bits of information if this will take some load off of your database and/or cache, and to help the server be more RESTful/stateless. Edit: It turns out that I was not quite correct about Play. Like Rails, it seems to only sign the session cookie, rather than encrypting it. From looking at some benchmarks for the performance of HMAC vs Blowfish, it seems that signing with HMAC can be up to 4X faster than encrypting with Blowfish.
- ookware 14y agoI don't know if you saw Bank of Dave [1] but it showed how difficult it is to start a new bank in the UK, even if you are going to be run responsibly and in a small way. I find it difficult to imagine someone new entering this market place, other than "people" like Virgin and Tesco with deep pockets to back them. [1a] http://www.guardian.co.uk/tv-and-radio/tvandradioblog/2012/jul/12/why-i-opened-bank-of-dave http://www.guardian.co.uk/tv-and-radio/tvandradioblog/2012/j... [1b] http://www.ft.com/cms/s/0/2ba372d4-d80b-11e1-80a8-00144feabdc0.html#axzz29OE3d71x http://www.ft.com/cms/s/0/2ba372d4-d80b-11e1-80a8-00144feabd... [1c] http://www.burnleysavingsandloans.co.uk/about-us/ http://www.burnleysavingsandloans.co.uk/about-us/
- justincormack 14y agoMetro Bank managed to open recently, apparently it took some time but was entirely feasible
- EwanToo 14y agoIt also cost around £15 million to do, before the first branch opened!
- justincormack 14y agoApparently it is the best capitalised bank in the world... its expensive to open a bank now.
- Firehed 14y agoIn theory, I'd rather have it in a cookie than unprotected in a database. In practice, anyone doing something that stupid will have XSS exploits rendering that information available to anyone running an exploit. While security and encryption are definitely not easy (and far less so when you're talking about adhering to PCI-DSS Level 1, which somehow actual banks never seem to do), there are plenty of well-tested libraries that make it significantly easier. Having said that, I'd prefer to see the data stored in plaintext - obviously bad - rather than using easily-broken encryption (short keys, re-used keys, bad key storage, poor algorithm, etc) which looks OK at the surface but provides a serious false sense of security. What really blows my mind is that Visa and Mastercard never seem to require PCI certification for their issuing banks. Being deep in the industry I realize how many middlemen and layers of misdirection there are with this kind of thing (usually to get around these security requirements), but Visa's diligence process is actually quite thorough - at least in the US. I've been interviewed by PCI auditors, and my experience was that they were actually asking the right questions, and required demonstrations to prove your claims. But for all I know, that varies widely from auditor to auditor.
- petercooper 14y agoNatwest are a dismal failure of a bank to the extent I'm always happy to go out my way and dissuade people from associating with them in any way. Just as a countering data point, I've been with NatWest for 14 years both for personal and business banking (plus a business credit card) and have had nothing but an excellent experience with them (the only negative I can think of is their online banking goes down for maintenance at 2-3am sometimes for an hour or two).
- chunkyslink 14y agoI would agree with you. I have been with them for 20 years and I have never had one problem with them. They even let me off with some overdue charges (which were my fault) when I asked them nicely.
- monsterix 14y agohttps://www.simple.com/ https://www.simple.com/ your wish has just been granted. Or close, perhaps. :)
- michael_miller 14y agoI think part of the incompetence has to do with what talented engineers want to work on. Most of us here on HN would never dream of writing mundane business logic software for a bank. Why would we, when we could be working on much more interesting problems, while earning a lot more money, working in a much more stimulating environment? This leaves mediocre programmers who can't get jobs at {Google, Facebook, Microsoft, Amazon, Startup X}. Talent goes where the money is, and the money is not in writing a bank web service.
- reissbaker 14y agothe money is not in writing a bank web service This is the real issue. Banks can certainly afford to hire qualified engineers; Santander apparently chooses not to.
- chii 14y ago> Santander apparently chooses not to. because their customers chose not to care (at least, until shit hits the fan). A bank (or any conservative organization) will only really react, as it is too slow to become proactive (otherwise, it'd be by definition, no longer conservative! ala, google, facebook etc).
- PeterisP 14y agoBecause regulators don't do their job. Private customers shouldn't be responsible for auditing their bank - instead, regulators should enforce fines for banking privacy and security breaches that are an order of magnitude greater than the cost of implementing the systems securely. The banking rules should be so that even an immoral Scrooge would see proper security as the cheaper, cost-efficient way compared to screwing their customers with shoddy systems. If a bank teller violates financial privacy by leaking his customer's transaction lists, it carries criminal penalties in many countries. Why should a manager who intentionally violates banking privacy of thousands of customers face less prosecution?
- atas 14y agoA little bit off-topic, but in what way(s) is Natwest a "dismal failure of a bank"? I had a Natwest account a few years ago when I was in the UK, and I was happy with it at least in relation to the other bank I had an account with.
- regomodo 14y agoI graduated 5 years ago with a maxed 2K overdraft. Last year I went to the bank to reduce the limit and the nice lady informed me I hadn't been paying interest the whole time on it, she promised to not to tell.