The point is that phones are just a bad way to do this. There’s no convenient way to do security checks over the phone, so why do banks insist on using them for people like us, for whom plenty of secure channels already exist?

A great example is Egg – I’ve never received a call from them, because all comms go through their website’s secure messaging system. I get email, but all it says is “go log in”. Yes, that’s open to phishing, but it’s better than some random scammer phoning me up and asking me straight out for my details.

On another call I asked them again if _they_ could identify and the girl asked me: “What you want to know from you? I’ve your date of birth, date when you opened your account, visa number or I can give you any piece of your data so you can verify this is an honest call”.

The banks website would require all 8 digits to log in. That’s a secure connection, which you can check by the https protocol and the genuine url of the bank. On the phone, you don’t have those checks, so you don’t give out your full PIN code. Or put it like this: if my colleague at work would overhear me saying those 8 digits on the phone, then he could fish up my account number via my last invoice, and log into my bank account online. So basically: online you always need the full 8 digits, on the phone you can never give out the full PIN. Still seems solid to me.

If my bank wants to communicate with me, well, I’ve got an e-mail address and a GPG public key. That they can’t use that is their problem, not mine.

The security thing that irritates me is that phones are inherently insecure because they require you to be in a secure area. Most people aren’t when they use their phones – they are in public areas. I’ve had to explain to people over the phone that there’s no way I’m giving them my details over the phone because I’m on a bus or standing on a railway platform. I was on the train yesterday and a man across the aisle from me gave his full address, postcode and phone number over the phone. I’m betting people would absent mindedly do the same thing with credit card numbers.

To paraphrase Linus Torvalds: if your security doesn’t include a web of trust, it’s not security, it’s masturbation. This applies very much to pre-shared keys – if you give someone access to something that you can’t revoke without changing the key for everybody, I would consider that a failed security model.

(Also, what’s with all the damn at signs in comments? This is not Twitter.)