Lloyds TSB plugs security gap at last

A security hole in Lloyds TSB's internet banking service is finally to be fixed, nearly two months after a customer alerted the bank to the problem.

The hole was discovered in August by prominent IT services analyst Richard Holway, whose company is a Lloyds customer.

"The first thing I did was to telephone the customer care people, all the way up through these stupid lackeys giving me this party line that I could turn it off if I wished and that was up to me," he said.

"They only responded differently when I identified myself as an industry analyst."

Holway finally received a letter from Lloyds TSB dated 13 October saying that after an investigation, the 'AutoSave Password' feature is to be disabled from its service.

The flaw occurs if the AutoSave Password feature on a customer's desktop is enabled. A cookie that stores the Lloyds TSB account username and password allows anyone with access to the PC to enter the account.

"After logging in once, the username and password were automatically remembered. In other words, anyone using my PC had unrestricted access to my account," said Holway.

The flaw is similar to one discovered by Barclays' online customers in August, whereby using a browser's back button after logging out still took customers back into the account, without the need for logging in again.

Barclays said at the time it was working on a process to automatically delete the cache after logging out, but a spokeswoman this week said this would not be done until the next website update, sometime before the end of the year.

"It is something we are developing, and it will go live with our next release of software," she said.

First published in Computing

See also:

Lloyds TSB scraps e-bank plans

Lloyds TSB has scrapped the launch of its UK internet bank, Evolvebank, and will instead concentrate on an online venture with Centrica.  14 Dec 2000

Online banking hangs in the balance

The UK's online banking pioneers have run into some problems. We look at what they are doing to turn around their fortunes.  08 Dec 2000

Lloyds TSB denies web bank delay

UK bank Lloyds TSB has denied that it will put back the UK launch of its internet bank following recent security concerns at other online banks.  29 Nov 2000

James Bond exposed in Swiss bank blunder

Roger Moore, who played British secret agent James Bond in the 1970s and 1980s, has had his Swiss bank account details published on the web following an error by bankers Credit Suisse.  09 Nov 2000

Internet banks need a high street presence

Online-only banks will have to consider establishing bricks-and-mortar branches if they want to survive as long as their high street competitors, says the ebusiness man at the Chartered Institute of Bankers.  02 Nov 2000

Bank seeks to address security fears

The Royal Bank of Scotland (RBS) is hoping to benefit from users' distrust of spending online by routing ecommerce payment requests directly through its own network.  02 Nov 2000

Cashing in on the digital wallet

Forget the European currency debate, electronic money is set to radically change the way we buy goods and services.  20 Oct 2000

Interpol faces up to cybercrime

Interpol wants to extend its reach and become a global cybercrime police force.  19 Oct 2000

UK web banks rapped over security

Think-tank the Foundation for Information Policy Research today launched a scathing attack on the UK's internet banks.  11 Oct 2000

Lloyds TSB online banking hit by glitch

Back-office staff at Lloyds TSB had to work frantically this afternoon to smooth out glitches with its internet banking service after a connectivity problem left customers unable to access their accounts.  09 Oct 2000

Can you count on your online bank?

While the threat caused by recent security beaches at a raft of online banks may have been exaggerated, such organisations need to take the initiative in educating users about security procedures if they are to boost consumer confidence.  03 Oct 2000

LloydsTSB acts to improve online service

Amid much criticism of high street banks' treatment of online bankers, LloydsTSB today announced measures to ensure that its internet customers get the same level of service as its telephone customers.  15 Aug 2000

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!