Feeds

Lloyds TSB certificate glitch sparks concerns

Trust no one

Internet Security Threat Report 2014

Online banking customers logging onto the Lloyds TSB website on Friday morning were confronted by potentially confusing warnings about a security certificate.

Consumers were greeted with a "website certified by an unknown authority" pop-up message for *.clickshift.com after accessing online.lloydstsb.co.uk.

certificate error

The domain involved is not an essential part of the Lloyds site, so refusing the certificate doesn't cause a problem. The certificate involved is attached to a webtrends stats gathering engine.

Instead of advising customers to refuse the certificate, Lloyds TSB online banking staff told Reg readers to click OK when the SSL security error popped up. So users are being asked to ignore a warning about the possibility that confidential information might be stolen by someone pretending to be clickshift.com, an entity few are likely to recognise in the first place.

"Given all the scams that you are advised to look out for, you would have thought the bank would have been quicker to advise people to not accept it and deal with the pop ups rather than train customers to just say yes blindly," said Reg reader Zoe, summarising the concerns about the site several of you have written to us about this morning. "It's worrying in its own right that a UK bank is using a hosted web stats gathering engine, thus transferring all page visit information to another set of servers not under their control," she added.

Lloyds TSB responded promptly to our requests for comment on the matter, confirming that punters phoning up with concerns are been advised to accept the certificate. A spokeswoman for the site acknowledged the situation was far from ideal and could give rise to security concerns among its online banking customers.

She said the certificate glitch was nothing to worry about, adding that customers should be assured that Lloyds TSB would take its site offline in the event of a serious security concern.

The cause of the certificate glitch is not immediately clear. Lloyds TSB is working on the problem, which it hopes to resolve sometime later this afternoon. ®

Intelligent flash storage arrays

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Shellshock over SMTP attacks mean you can now ignore your email
'But boss, the Internet Storm Centre says it's dangerous for me to reply to you'
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.