I was interested to read the
BBC article
highlighting the concerns of Professor Antonia Jones and her team at Cardiff University
regarding the security of the HSBC Online Banking Web Site, particularly in light
of my
earlier blog entry.
It seems that Professor Jones believes that there are serious flaws in the way
that HSBC's online customers access the bank's web facilities. These seem to centre
around key logging (the recording of key strokes by either hardware or software
tools). The problem with key logging is that the keystrokes are captured before
they are encrypted as part of the secure connection between the user's web browser
and the bank's web site. This means that user names and passwords are easily captured
and can be relayed to the perpetrator.
Personally, I no longer use third party computers (except those where we are
responsible for their security) to conduct any confidential transactions. The risks
are simply too great and I would certainly not recommend anyone else doing so either.
According to the BBC, the bank says that the "problem does not pose a serious
threat to its customers", although the Cardiff researchers suggest that anyone exploiting
the flaw would gain access to an account within nine attempts.