HSBC forgets to renew its digital certificate
Can I forget about my overdraft then?
Agentless Backup is Not a Myth
Online banking customers logging onto the HSBC website last week were confronted by potentially confusing warnings about a security certificate.
Business banking customers logging onto ukbusiness.hsbc.com were greeted with a notice that the site couldn't be verified because its certificate had expired. HSBC said the problem persisted for about a day before it was resolved. It apologised for the glitch, which it said had no effect on either the integrity or operation of its website.
"The problem related to a US SSL certificate that expired on 4 March. The certificate enables us to place security messages on our Business Internet Banking welcome page (for example, warnings of phishing attacks). The issue was identified on the morning of Wednesday, 5 March, and the new certificate was installed at 5pm," an HSBC spokesman explained.
"Customers who have their browsers configured in a certain way would have seen the message regarding the certificate expiring, but despite the message that they could be logging into a website pretending to be something it was not, this was obviously not the case. Customers were able to click through and log into their online banking service. No functionality was affected and there were no security risks associated with the certificate expiring."
Forgetting to renew a digital certificate can happen to any organisation, as Microsoft and Symantec can verify. In such cases a secure connection can still be established with a site. Such slip-ups are generally best considered as minor foibles.
However, since banks are always warning customers about the risk of identity theft, it's only fair to expect them to provide positive confirmation of their identity online, something HSBC briefly failed to do. Four Reg readers emailed us about the HSBC digital certificate slip-up.
The bank apologised for any inconvenience. "Obviously we would apologise to any customers who were concerned about the message they saw or inconvenienced in any way," an HSBC spokesman said. ®
COMMENTS
Why can't they...
use a keycode calculator where the bank issues a challenge based on the transaction(s) you have just done and want to authorize?
Then you type in that challenge into the calculator, get the response code which you punch into the browser window...
If the 'man in the middle' tries to change the transactions, the codes won't fit any more.
They don't even need a 'full' 0 - 9 keypad, just a few keys so that people doesn't mistype the code all the time...
@Al Jones
"Both browsers make it fairly clear to anyone who bothers reading the error message that the site is "obviously not a fake".
A fair point, if you are prepared to equate reading with understanding. There are just three problems.
Firstly, "security certificate", "trusted certifying authority" and "name" are jargon terms. Replace them with pitchfork, gardener and carrot. Now re-read the error messages and I think you'll find that it is no longer obvious that the expiry failure is less serious than the other two.
Secondly, whilst I have accepted certificates under these circumstances, my "advice to grandma" would always be "If there's a problem, don't accept it.". I *hope* that the vast majority of web users default to mis-trusting institutions who can't keep their paperwork in order. (I doubt it, but it is something to wish for.)
Thirdly, *I* wouldn't accept this certificate for online banking. If they can't even get this right, what else is wrong? This is my money we're talking about. I'll wait a couple of days. If they fix it, that's fine. If it is still broken several days later, I'm going to start looking for a new bank.
you'd be surprised...
This is a lot more common than people think...
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Enabling efficient data center monitoring
