Online banking payment system aims to reduce fraud Online shoppers in the UK will be able to pay direct from their online bank account rather than via a credit or debit card, thanks to a new service. The POLi online bank payment platform aims to increase payment choice while reducing card-not-present fraud, a category of fraud covering ecommerce transactions which is on the …
Well, their FAQ seems to completely ignore the fact that there are people out there who choose not to have a Windows PC, but as they rely on ActiveX, that locks out Macs, Linux and any Internet Exploder refuseniks.
So their soopa-secure service relies on a technology that lots of people really don't trust.
Looking at the demo on their website, it appears to use an activex control - I thought they went out of fashion long ago ? It begs the question, why should I trust a ropey, non-standards browser on an even more ropey, non-standards operating system to transfer money from my account to the one it fills in for you ?
This will teach non-net-savvy users that it is OK to open activex controls that fill in arbitary details into your bank website. How long before a phishing scam does /exactly/ the same thing, but redirects you to a copy of your bank's website?
Sorry, no. Try again.
Surely encouraging people to log in to their online banking following a link from a website is just going to encourage phishing. You could just set up a link that says "Pay by POLi", get the user to choose their bank account, and take them to a fake page to grab their details. You could even get an SSL certificate that has POLi somewhere in the name which would convince a lot of people etc...
I've just had a look at the demo at http://www.centricom.com/flash%20demo/POLi_demo.html . You visit the merchant site, click on the Poli logo and if it's your first visit from that PC it installs an ActiveX control, that opens your bank website in a new window, you log into the bank, Poli takes you to the payment page and fills in some details and you do the rest and then finally Poli closes the bank website and returns you to the merchant site.
How much scope is there here for a dodgy website to add a fake Poli logo? User's will be used to installing an ActiveX control which, from a dodgy website, could be anything and then a window opens with a potentially bogus ebanking website to capture your ebanking details......
I'll give it a miss thanks.....
The benelux region have had something like this for sometime. iDeal is brilliantly effective and, I believe, trumps credit card transactions for volume of online purchases.
Not to mention the other continental European banking perks like instantaneous (bill) payments, money transfers, personal service, local call centres....
Most online banking setups are susceptible to Man-in-the-middle attacks, which 2 factor authentication does not address at all (start with the assumption that the client PC is compromised). Let's hope these guys are also working on new solutions.
I know we do, about to roll out phase 1..
This has been done before, UsemyBank.com does much the same. These services are fairly pointless in the UK, as, unlike AU and NZ, we already can shop online and pay from our bank account using Maestro/Switch. Over here, they tend to be used by online betting services, who get hammered with credit and debit card fraud.
I can see few benefits for the consumer here, they are installing an ActiveX control (shudder) whose only purpose is to make payments to arbitrary bank accounts when the user logs into their online banking. There is another name for software that does that. Internet Banking Trojan.
The merchant is no longer at risk of fraud as the payment is guaranteed.
The bank is no longer at risk because the bank directly pays the merchant with money it knows the consumer has.
Doesn't this just turn it into a hi-tech Western Union transfer when the goods fail to be delivered?
I can see how it's more secure, granted; but the price seems to be the loss of any consumer protection.
"Here's how you shop with POLi:
1) Select the POLi logo.
2) POLi will present you with a list of banks- select your bank.
3) Login as you normally would to begin an internet banking session.
4) POLi calls up your "pay anyone" screen and automatically fills in the merchant's details and the amount of the purchase.
5) Simply click "Pay" to purchase with money that's in your bank account. "
So I have to trust the merchant's website enough to allow a script to remain active while I log into my bank account, answer all the usual security questions and then have it fill in the payments form for me?
Not meaning to be paranoid, but how can I be sure that the merchant's website is anymore genuine, and the POLi script anymore trustworthy than the average phishing email? Using an ActiveX control, as it does, I'm also forced to use MSIE, which I don't like...
Also, of course, when I pay with Visa or Mastercard, I have some insurance against fraud. When I bay by BACS, I have none.
It's a lovely idea, but flawed, no?
Wouldnt it be easier and more secure to adopt more virtual single use cards for online transactions?
I have a webcard with my bank account and it allows me to set a limit on a virtual card, once its hit the limit it cant be used again. This means if somebody steals the info or tries to run up multiple times it wont work.
Seems a simple and affective solution, shame that some payment merchants wont allow them as payment.
Doesnt protect against key loggers, but a step in the right direction.
Sounds to me like people will just end up losing their online banking details to fraudsters instead of their credit card details.
There's no way I'd feel comfortable letting even a legitimate 3rd party log me into my bank account (even if they do say: "POLi does not access or store any of your Internet banking account details."
I'll pass.
Strike 1: Windows only.
Strike 2: IE only.
Strike 3: ActiveX
Evidently news of persistent insecurities in all 3 of these facilities has failed to reach Down Under. Someone, somewhere, who doesn't know their technical/security ass from a hole in the ground, said yes to a technical proposal that on the surface looks very dangerous.
Oh, dear, time to repeat one of the important mantras: "Windows is a consumer grade operating system and as such inherently unsuitable for mission-critical applications."
I can remember years ago when I worked for one of the Seven Dwarf computer companies and trying to make headway against IBM's superlative sales people was an endless uphill battle. They seemed to have mesmerized decision makers with prospects of cradle-to-grave system support. Just what lure Microsoft uses to achieve a similar monopoly is interesting to speculate, given that MS's products are well-known to be difficult to use without risk. Sex? Drugs? Rock'n'roll?
PS: Wasn't it an Australian navy ship run by Windows that got a BSOD and floated around rudderless until damaged by grounding? Don't the decision makers of Australia even read their own newspapers?
"Go" because that's what this Poli will do once the phishers have taken it to town.
Wouldn't a better idea be for banks to set up a system with merchants, to send a transaction request into your account. You then independantly log onto you online bank and see a list of pending transactions and authorise/decline them.
its the same principle but, the bank has validated the retailer to authorise them to send requests, no dodgy activex involved, no phishing as you independantly log in to your own bank. Depending how much detail is in the request, you could see, for example "pay amazon £10 for a copy of flyfishing by J R Hartley" on your online banking site.
This could even be used with current card not present transactions. your credit/debit card request goes through as today, but you then, independantly, log into your online banking site, see a list of pending transactions, and authorise/decline them straight away.
Much more secure than the current authorised by visa system that automatically pops up a window asking for a password, any dodgy site could spoof that and capture it.
It took customers threatening to leave banks before they took notice that many of their clients preferred not to use IE for security reasons.
No doubt the trial comes out of the pockets of the customers.
Did no one think to ask the IT department first?
Seems like the world and its wife beat me too it. I will not trust anyone to redirect me to my bank website (i barely trust myself having to double check I spelt it correctly before hitting enter). And now on comments it has script running while I log into my bank. erm No Thankyou. When I start internet banking it advises me to close any other browser windows and start a new session.
I think paying by instant transfer could be an option but i'd rather be given say two Id numbers that would checksum each other to enter into my own bank session I started.
I thought many banks were going to there own "secure" browser/software anyway
not quite as Paypal is the run by a bunch of halfwits and where security is a joke (that'll be the ebay influence then)
AND
Google Checkout is worse -
- 1st transaction went through fine & delivered (well known internet retailer)
- 2nd transaction (with the same retailer) "we were unable to verify your identity so have cancelled your order ref xxxxxxxxxxx with xxxxxxxxx.co.uk"
note, not delayed, not referred, CANCELLED you note
needless to say GC have not bothered with replying to my email
complete f***wits
stick to direct credit card payment, much safer & in the UK at least you are protected
However trivial it may seem, its the fact that consumers have some level of insurance should they use a credit card. What seems over a life time ago, Visa and Mastercard collaborated to create SET, a standard for Secure Electronic Transactions that used a PKI solution to validate both cardholder and merchant independantly. It bombed in the marketplace because it offered nothing to the consumer who was (and is) already covered against dodgy merchants
This happened to me (and a lot of other people) at University a few years ago... you'd be walking somewhere when a scruffyTransit would pull up and a guy would jump out trying to flog a pair of top quality speakers that were "worth 2k" (he'd even show you in a local newspaper) but because it was Friday and it was raining he couldn't restock them in his store or <...insert other random gibberish here...> so I could have them for a great price.
The killer line was "how much can you get out of the cashpoint right now?"
This POLi crap wreaks of the same thing. What frightens me most is that the message about being "safe online" is ever so slowly filtering out to the common masses (e.g., my Mum) but services like this are only going to bugger it all up.
This post has been deleted by its author
Well, it won't work on my PC - I have ActiveX explicitly disabled. Besides which, I use Firefox for all my browsing.
Restricting you to a dodgy browser on a flaky operating system like Windoze is a pretty good way of eliminating a big chunk of your potential user base straight off, and having an ActiveX control active while you enter all your online banking details frankly horrifies me.
I'll stick to using my debit card until they come up with something more secure that actually works.
Its already easy enough to purchase an online "you can trust me" certificate,
whats to stop phishing with POL-i simply mis-using the inputs to the control
and doing a real transfer session using corrupted inputs...
this doesn't change existing security, it only makes it harder for the user to
certify the transaction for themselves
I'll keep to doing transfers without such "feature-esque" want to be secure
wet tissue jobs...
POL-i *maybe* secure, but that is only 1 card in a house, lets see if it is still
standing AFTER it is deployed
"The ship" was the USS Yorktown, the prototype in the US navy's "Smart Ship" program which ended up dead in the water after a sailor typed "bad input" into a dialog box which caused the ship's propulsion system to fail. The ship may or may not have had to be towed back to Norfolk VA, depending on who you want to believe (and it may be that failures on several different occasions are being conflated together here).
http://www.gcn.com/print/17_17/33727-1.html
E.
(and no, haven't heard of POLi here in Melbourne either...)
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
