Ann Arbor (MI) – A soon to be released University of Michigan study will show that more than 75% of banking websites have serious security flaws.  According to Atul Prakash, professor of electrical engineering and computer science, these flaws are design issues that cannot be quickly solved with a simple patch or upgrade.

Prakash, along with doctoral students Laura Falk and Kevin Borders, studied 214 financial institutions and found that the most serious issue was the placement of contact or security information on insecure pages.  Prakash argues that this can easily lead to phishing attacks by the placement of bogus numbers that lead to scam artists.

Approximately 55% of the sites had this problem, while 47% placed login boxes on insecure pages.  Prakash is recommending that banks use SSL protocol to secure their login pages.  Why any bank still has a non-SSL login page is beyond me.

Rounding out the top five security problems are poor email security, broken chain of trust where banks redirect users to insecure outside sites and inadequate user id and passwords.  31, 30 and 28 percent of websites had these problems, respectively.

Of course security problems can erode public trust in banking websites and Prakash says, "Our focus was on users who try to be careful, but unfortunately some bank sites make it hard for customers to make the right security decisions when doing online banking."

Prakash’s study titled “Analyzing Web Sites for User-Visible Security Design Flaws” will be released later this month on his website here.

HSBC secure

Jul 24, 2008 00:11     

My understanding is that HSBC and Citi are among the most secure online banking web sites. HSBC, for example, issues security code key generators that are registered to your account. It's a small, keychain-sized device. They also use an onscreen keyboard for some portions of the login process. I'm curious as to whether or not this report will rank the bank sites in terms of security.
Robert Saunders (skylarking) report abuse vote down vote up Votes: +0

banks in general

Jul 25, 2008 12:55     

The fact that a ton of banks are providing unsecure websites is just one example of a bigger problem. Banks are living in the past. Every time I use a banks website, or walk into a bank, or even just see a billboard or commercial for a bank...I get that uneasy feeling that they'd cheat, lie, and steal to keep the world from passing them by. Kinda like the RIAA or MPAA has been prone to do in recent years. It's scary and sad.

Thunderdome report abuse vote down vote up Votes: +0