Showing posts with label online banking. Show all posts
Showing posts with label online banking. Show all posts

Thursday, January 29, 2009

Do you know about Wesebe?

Wesabe is a social-networking site that also lets users track their finances and helps you with safe investing. Users and financial experts share tips on saving, investing and spending. Traffic on Wesabbe has more than doubled in the last four months. [A social network site focuses on building online communities of people who share interests, or who are interested in exploring the interests and activities of others – in this case finances, ie a financial social networking site]

In November, Wesabe and the UK newspaper giant The Telegraph entered a partnership to offer co-branded tools on the Telegraph website.

Wesabe anonymously aggregates data from it's customers to provide tips and recommendations for it's members. Importantly, they've got data that spans the market, something that banks themselves have tried (with account aggregation) and largely not been able to make work very well. Wesabe applies wisdom of the crowd thinking to personal finance and debt.

Wesabe Mobile is available which also provides members with an easy way to record and track where they are spending cash. Wesabe holds out the promise to help consumers validate their financial decisions based on what other people like them are doing. Wesabe is both versatile and powerful. You can set spending targets, monitor your account on a mobile and download a Vista gadget for instant account access. Wesabe is rolling out new graphs to more easily allow users to track spending and monitor their income.

Wesabe cleverly uses two levels of tags: one for “just this entry” and another for “each time this transaction occurs”. This is powerful, but can be confusing, too. Wesabe is different, in that it is re-defining financial advice, and references in a banking context. Wesabe allows you to tag all your line items (expenses, deposits, etc) with arbitrary tags, so you can easily view groups of transactions. Within any tag you can set up spending targets and it will show you how close or far to that goal you are for the month at any given point.

A new feature of Wesabe, the Cutback Tool, focuses on a specific part of the problem, probably the one most easily controlled; namely, recurring fees and expenses. The Cutback Tool flags all your recurring expenses, then shows you how much money you’d save annually if you reduced or eliminated the spending. The tips provided are not perfect, but they are already useful in the many markets where the company has a concentration of users and it will get better and better as more users contribute more data.

Wesabe a very innovative solution for getting your financial data into a nice clean format that is ripe for analysis. On a higher level, they are using the wisdom of crowds to try teach us personal finance best practices. They interact amazingly closely with customers. For example, Wesabe usues collective wisdom to tell you how much you are spending on your services – say, car insurance – relative to its other users, and showing tips that are relevant to the tags you choose. Wesabe has nothing like the rich functionality of Quicken. It is basically a community site where you can upload your financials to manage your budget.

Wesabe uses a downloadable application to keep you safer – no credentials are stored on their website. The service utilizes SSL connections and authentication – keeping member data safe and private yet readily available. Wesabe spends a lot of time and energy trying to build up trust. That's a good move.

Wesabe has three advantages over Quicken:


  • It’s only online.
  • It has added tagging to transactions that are shared among users - when enough users tag a specific merchant, that tag is automatically added as a suggestion to your transaction.
  • It is security-focused. Your third-party bank and credit card account credentials are not stored on Wesabe’s servers – instead they are downloaded to your personal computer. Hackers can’t access your account credentials by breaking into Wesabe’s servers.

Thursday, January 15, 2009

How can you trust a website?


Authentication + Encryption + Certification Authority = Trust

Conducting financial transactions over the Internet requires a safe investing environment. One of the biggest problems facing Internet business today is the issue of trust and security. Most consumers are concerned about the safety of their credit card and personal details. Many people simply don't trust the Web, fearing that their transactions might not be safe.

A critical issue for suppliers is how to win a your trust and convince you that it is perfectly safe to make online purchases or conduct safe investing on the suppliers website. The easiest and most secure way to achieve this is through authentication and encryption.

Why is authentication important?
In the age of faceless Internet commerce, authentication provides crucial online identity. People and companies need to get to know one another before conducting business. In traditional commerce, people rely on physical credentials – such as a business licence or lD document – to prove their identities and assure the other party of their ability to transact safely.

A business partner's identity must be established before it can be trusted in conducting safe investing or other trade. At the most basic level, there must be a process which verifies that an organisation or individual exists, has a name, and is entitled to use that name. This process may also establish other identification attributes. Trusted third parties or delegated authorities often play a key role in confirming the identity attributes of participants at the time identification takes place.

Once the participant's basic identity and identification attributes are established and verified in "real" world, it must be issued with a credential such as an ID document or a business licence that can be used to prove identity. In the digital world, the most robust form of credential is the digital or Server Certificate signed by a trusted Certification Authority. [note #1]

How authentication works
Authentication allows the receiver of a digital message to be confident of both the identity of the sender and the integrity of the message. When Web visitors connect to websites, they reach one of two kinds of servers. If the servers are secure, visitors will get messages indicating that fact; similarly, if they are not secure, there may be warnings to that effect. A secure website is one that has been authenticated and has a certificate. The certificate tells users that an independent third party has agreed that the website belongs to the company it claims to belong to. A valid certificate means that users can be confident that they are sending confidential information to the place they think they are sending it.

The basic premise is that the Certification Authority, CA, is vouching for the link between an individual's identity and his or her public encryption key. The CA provides a level of assurance that the public key key contained in the certificate does indeed belong to the entity named in the certificate. For an Web user to determine whether a legitimate CA issued the certificate, he must verify the issuing CA's signature on the certificate.

CA's must be absolutely certain that they are issuing certificates to the "correct" company. They must be sure that the company they are certifying owns the Internet Domain Name they have certified, that it is registered as a business, and that its registered name is the same as that on the certificate the CA is signing. Once the CA has done what is, essentially, a background check on all these elements, the CA signs off on the public key. Then the Secure Sockets Layer (SSL) will start functioning. SSL, another critical element of a secure website, ensures that the information sent by a server is identical to that received by a Web visitor - that no change has taken place.

How can you tell if a website/company is authentic?
Before submitting information or purchasing goods, you need to know that the company you are doing business with is who it claims to be. Web shops can buy Server Certificates from many different companies (CAs). But Internet applications are configured to trust only those Server Certificates that come from a few highly reputable companies. So, if someone sends you his or her Server Certificates (either via e-mail or from a website you visit) and it is from a CA that the application does not trust, you will get an alert message asking if you want to trust the new CA.
When you visit a website you can be sure that transactions with the site are secured by looking for the following easy cues:
  • The URL in the browser window displays "https:" at the beginning, instead of “http:”
  • In Internet Explorer, a padlock icon appears in the bar at the bottom of the IE window. IE users can find out a website’s encryption level by following these steps:
    - Go to the website you want to check.
    - Right-click on the website's page and select Properties.
    - Click the Certificates button.
    - In the Fields box, select "Encryption type". The Details box shows you the level of encryption (40-bit or 128-bit).

[1] Internet applications are configured to trust only those Server Certificates that come from a few highly reputable companies, e.g. thawte, VeriSign, Entrust

[based on the thawte document The Value of Authentication]

Thursday, January 1, 2009

Be aware of two aspects of your browser when conducting financial transactions

A further important aspect of safe investing may be the vulnerability of your Internet browser to interception The following two precautions should be implemented.

1. Web browsers

A website should be accessible via all main web browsers and browsing devices. Most Windows based PCs are preinstalled with Microsoft Internet Explorer (IE). Because of this, IE is the browser most attacked by viruses and spyware and is a threat to safe investing and doing your banking and other financial transactions via the Internet. .

We recommend that you use the most up-to-date version of your preferred browser, because they are more secure than older versions. If you use IE it is particularly important for safe investing to run a virus scanner regularly and keep it updated with the latest security patches from Microsoft.

2. Caching

Internet browsers have the ability to remember a page from a website - this is called caching. This makes Internet surfing quicker, but vulnerable to interception. Thus, for security, online banking pages are usually delivered with instructions to the browser not to cache (remember) the information. While most browsers obey these instructions IE ignores them and under certain circumstances a cached page of information may be viewed.

To prevent this make sure that IE has the following settings:
>Tools > Internet Options > Advanced > Do not save encrypted pages
>Tools > Internet Options > General > [Browsing history] Settings > Automatically
>Tools > Internet Options > Advanced > Empty Temporary Internet Files folder when browser is closed

How to keep your Internet banking session secure

We repeat that an important aspect of safe investing is fraud avoidance. My bank provided me with the following information for safe online banking. [1]:

Check the site is secure
When you visit a website (especially a transaction website) you should look for a padlock in the browser window. The padlock indicates that you are in SSL (secure socket layer) mode, which means that every request or information that you send from the browser to our secure site is encrypted (scrambled and encoded).



Secure sites use digital security, a Trusted Site Seal is a dynamic image appearing on a secure website that allows online banking customers to tell at a glance that they can trust the website, that the online site is validated and that they can transact safely and securely and share information free of worry.

Leading providers of digital security are thawte, VeriSign, Entrust

1. First National Bank (South Africa)

Saturday, December 27, 2008

Tips for safe online banking

An important aspect of safe investing is fraud avoidance. My bank provided me with the following 10 tips for safe online banking [1]

  1. Avoid using public terminals (such as Internet cafes) for Internet banking.
  2. Be aware of the higher risk of interception during a wireless connection. Only do your banking via a wireless hotspot if you are certain of the integrity of the connection.
  3. Ensure that you have an updated anti-virus and spyware programme and perform regular system scans. (See note 2).
  4. Never access the site via a link. Rather type the address (URL) of your bank into the browser address bar or save the address as a "Favourite".
  5. Do not open other websites while logged into Internet Banking; only have a single browser window open.
  6. Choose a User ID and password that cannot be easily guessed and change these regularly.
  7. Ensure your computer software is up-to-date.
  8. Check for the padlock in the lower right of your browser window (it indicates a secure site for safe investing). You can click on this padlock to verify the site "owners".
    When you complete your online banking tasks, log off and close the browser window.
  9. Never provide your password over the Internet (by email) or over the telephone to anyone (including persons identifying themselves as bank officials). (See my Blog on Phishing)
  10. Don't trust a PDF payment proof unless verified by the bank - these documents can be manipulated by fraudsters.

1. First National Bank (South Africa)

2. Symantec Norton 360, MacAfee and Kaspersky are leading anti-virus prorammes. Try MacroVirus On-Call, especially if you have a less powerful PC and/or an old version of Windows.
Kaspersky Lab North America E-Store