Posts by Gerry 3

SMS is U/S for 2FA

GCHQ told the banks not to use SMS verification: it's insecure because MNOs aren't very good at preventing fraudsters gaining control of your mobile number.

Predictably, people still lose £thousands.

So why are banks such as Santander still refusing to issue card readers for 2FA, which seem to be pretty secure because (1) you need to have your card and (2) to know its PIN?

Style over substance?

Does it have an FM radio, preferably DAB/DAB+ as well? Does it have a user replaceable battery? Will it have updates for at least a decade? These are all basics I'd expect but I doubt it'll have any of them, let alone all.

Not quite as bad as Santander et al

Surprisingly, NatWest is actually one of the (slightly) better banks when it comes to online banking. Unlike Santander and many others, they offer a free card reader. As it requires you to have your card and to know your PIN it's a lot more secure than the predictable telephone questions where the answers are often widely known and/or shared, e.g. postcode, email address, DoB, mother's maiden name etc.

GCHQ have warned the banks that SMS verification is insecure, but most have ignored their advice. This guy found out the hard way.

El Reg using dial up to catch up?

I spotted this way back in July ! Here's the original in all its glory.

Meanwhile, I'm still wondering who makes a DAB radio without 'set channels that are a bit like the channels on your TV'.

My whinge about CAPTCHA is that the relevant objects are often not neatly contained within the boxes.

If it's traffic signs do you just click the main two boxes, or do you include the pole and the 'spillover' boxes ?

But at least it doesn't ask you to click on the pavement, a stroller or a solicitor...

Good only for White Goods

I find the Which? reviews useful for seeing what's on the market and what all the bells and whistles do. They seem OK on relatively straightforward things (e.g. the toaster will burn the toast if you use it again immediately) but they are often well out of their depth even on slightly technical thingies.

Not so long ago I was amazed at their review of DAB radios which completely failed to mention the need to check for the Digital Tick. Many well known retailers such as Tesco and John Lewis are still ripping off their customers by selling digital radios that can't receive the ever-increasing number of DAB+ transmissions in the UK, but Which? readers would be none the wiser.

If it has Alexa inside, I won't have it in my house.

Even if they give it away free of charge.

D'oh !

The Halifax website has a very obvious weakness: the password characters entered via the drop down menu are displayed permanently rather than momentarily.

Their 2FA is also poor because it relies on an SMS. They've never considered that mobile numbers can easily be hijacked.

ALL the regulators are useless...

The ICO's website outage means that it's not possible to report yet another scam or nuisance phone cal, even if you think that reporting a spoofed or withheld number will achieve anything and you can be bothered to spend a fair bit of time so doing.

If the ICO, DCMS, Ofcom etc were any good they'd have mandated long ago that all telcos provide 1477 free of charge by default: Automatic Call Trace stores the REAL number at your local exchange for subsequent investigation and prosecution. But that would be too easy, wouldn't it?

You can have Amazon OR Privacy...

Amazon and privacy don't seem to go together.

I rapidly lost interest in buying a PC from them when I noticed that they register all of them on a police database, for my protection of course.

Shades of North Korea... I'd rather take my chances, thank you very much.

You can easily STOP the nastygrams !

@ Will Godfrey

I didn't have a TV and just ignored the fortnightly nastygrams, letting them build up into a pile about two feet high. They became ever nastier, with pictures of courtrooms etc, and were sometimes disguised to look like bank PIN notifications or payslips.

On principle, I still kept ignoring them.

It might have been different if they had politely asked me to confirm that I didn't need a licence, explaining that there was no obligation whatsoever to respond, but they'd be eternally grateful if I would just return the enclosed post-paid declaration form: I might well have done so.

Eventually the goons started to send their nastygrams by Registered mail. As I was always at work when the postman called, that necessitated an unnecessary trip to the Head Post Office the following Saturday. It would have been tempting to keep ignoring them, but there was always the risk that one of them might be something I wanted (e.g. a bank card) or something I didn't want but needed to know about (e.g. a speed camera ticket).

Enough was enough, so many years ago I sent a letter withdrawing their Implied Right of Access (signed as The Occupier). For good measure I also stated that I was fully aware of the penalties for watching live TV without a licence so there was no justification for reminding me every fortnight and, as they could no longer send the boys round, continuing to send scary letters threatening to do so would be an offence under the Malicious Communications Act 1988.

Result: they confirmed they would never bother me again - and they haven't !