4

The HSBC UK online banking website has a strangely convoluted login system that I haven't seen anywhere else before, and which I'm concerned is ineffectual and compromises security. It works like this:

  1. I enter my username, then forwarded to a new page for the next steps.
  2. I am asked a "memorable question", and enter my "memorable answer" in full.
  3. I am asked for three characters from specific positions in my password. As far as I can tell, they are always the same three positions.

I am used to Australian banks just asking me for my username and password, potentially with an SMS authentication step.

Here's a screenshot of the page in which steps 2 and 3 are carried out:

"answer your memorable question; enter the 1st, 2nd and 5th characters of your password."

Is there any advantage at all to doing this, or is this poor security compared to just asking for my password in full? I am concerned that not only is this needlessly complex, it is actually worse security than just asking for my password outright, because a potentially quite long and complex password is effectively reduced to a 3-character password.

As far as I'm concerned right now, my "memorable answer" has taken on the traditional password role, and my "password" is just an extra three characters I have for some reason.

marked as duplicate by Mike Ounsworth, paj28, André Borie, user15392, Community Oct 12 '16 at 15:33

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Yeah, it's dumb. Super dumb. I think banks only hire web devs who fail security exams. – Mike Ounsworth Oct 12 '16 at 15:29
  • 2
    Oh too bad. I was going to switch to HSBC but now I'm reconsidering my choice.. – André Borie Oct 12 '16 at 15:30
  • Thanks for the dupe suggestion, @Mike. Glad it's not just me thinking badly of it. – doppelgreener Oct 12 '16 at 15:34
  • @Andre I'm reconsidering my choice of HSBC too. ( ͡° ͜ʖ ͡° ) – doppelgreener Oct 12 '16 at 15:35