How would you react to a headline in a national newspaper that said: ‘Millions of homes at risk from double glazing security flaw’?

You would probably be very concerned, and curious to read more. But if the story revealed that the windows to your home are vulnerable to burglars wielding baseball bats, you would probably feel pretty cheated.

As a customer of HSBC, I couldn’t fail to notice a recent Guardian front page that screamed: ‘Security flaw leaves three million HSBC online accounts open to fraud.’ The story was subsequently reported widely.

Academics ‘discovered’ a ‘glaring security loophole’ in HSBC’s internet banking system. Sounds serious, doesn’t it?

If you were a typical home PC user, with little technical knowledge, such a story would reinforce your fears about web security – that the internet is a dangerous place, teeming with thieves, paedophiles, terrorists and evil-doers.

But to Computing readers, and to anyone with an understanding of IT security, the story was the online equivalent of those window-smashing burglars with baseball bats.

HSBC’s web banking works like this: to authenticate users with a valid login identity, visitors must enter three selected digits from a personal security number, chosen by the customer when the account is set up; for example: ‘enter the second, fourth and seventh digit of your security number’.

Those clever researchers discovered that, given enough time, key-logging software dropped on the PC by a virus could record enough logins to be able to work out the complete security number and access that customer’s account.

Hardly Sherlock Holmes, is it?

No mention was made of anti-virus or spyware protection that most ISPs and many banks provide. HSBC says it has no evidence that this method has ever been used to access a customer account illegally. Even security expert Bruce Schneier told the Guardian that this was just a minor vulnerability out of hundreds affecting every bank.

We all have to be aware of the risks of using the internet, just as we are of walking down dark alley-ways in dodgy areas on our own at night. But banks are investing heavily in protecting their online customers, with two-factor authentication devices set to become a standard offering.

The criminals will, of course, find ways around any new offering, but their task is becoming harder. Would it not be better to focus on educating users about the simple ways to minimise the risks, instead of scaring them away? Or maybe we should all install bullet-proof windows.

What do you think? Email us at feedback@computing.co.uk