This is one of several posts of the topic of security of websites. Inspired by my initial post on the security of UK banks.
The reason for splitting this data into multiple posts is to make it more manageable. So that data on one institution is not mixed with data on another type of institution.
I thought it would be interesting to look at each bank in the UK to see if when you visit their company homepage, is that secure by default? That is, is the page loaded by HTTPS? There are more tests than this that you could do, but that’s the baseline. If they can’t meet that then the other tests are meaningless.
Some banks provide the website in both http and https versions. This is bad practice. If someone visits the website as http then the customer should be served the https version of the page.
Also please note, these test results are for a desktop computer visiting the website. A mobile phone may well get a different experience. In other words desktop visitors may get a secure site, but mobile visitors might not. Or vice versa.
The following key is used for the secure status:
| Yes | The site is secure, loaded via https |
| Dual | The site can be loaded via http, or via https. |
| Invalid | The site loads via https, but the security certificate is invalid and thus the site is insecure. |
| Partial | The site loads via https, but loads some parts of the page without https. The site is insecure. |
| No | The site is loaded via http, not via https. |
| Fixed | The site is loaded via https, but at the time of first writing it was loaded via http. |
| ?? | We could not find a website to evaluate. |
We tested 66 stock trading websites, most of them based in the UK. We found 20 stock trading websites that did not have a secure home page (not https or did have https with an invalid security certificate). That is 30% of stock trading websites have security vulnerabilities.
Some of the websites shown below no longer have active links. For those websites we have listed the URL but removed the non-working link.
Charles Schwab & First Direct
First Direct were the first bank without a bank branch in the UK. That is they’ve always been online only. But their website is not secure by default. It is vulnerable to a man in the middle attack.
Charles Schwab was one of the very first share trading sites aimed at making share trading easy, even for non-experts. As such they’ve been around for a long time. But their website is not secure by default. It is vulnerable to a man in the middle attack.
Just because a business is established, that doesn’t mean you can trust their security.
Fantasy Stock Exchange
Fantasy Stock Exchange is website where children can go to trade pretend stocks and shares. To understand what is happening without any financial risks. It’s an interesting idea. But it’s not secure by default. Anything where children are involved I’d like to think that is secure, we read enough unpleasant stuff about grooming in other environments without their accounts being at risk as well.
Insecure Login
Most of these insecure websites are secure when you try to login, but not secure on the homepage. That makes them vulnerable to a man in the middle attack. However, one stock trading site, Digital Look, is completely insecure, even the login page is not secure, and has a remember me option!
Insecure Browser Extension
Another website was so problematic that we could not visit the website without being forced to install a chrome extension, that was allegedly to improve our security while using their site. The problems with this is are numerous:
- The extension is downloaded from a non-disclosed location (you can’t see where it’s downloaded from, a website name briefly flashes past that is not the destination website).
- The extension is download from a non-secure location. Thus it could be anything.
- You can’t verify anything about the extension before installing it in Chrome.
- Whether you choose to install an extension in order to view a website should be a choice, not mandatory.
We were going to name this company, but when we later tried to reproduce this to get some screenshots of this dangerous chrome extension behaviour could not be repeated. If you see behaviour like this with a website please let us know.
Guest posts
No, we’re not interested in having a guest post about finance related topics. These articles are about security, not finance.
Original post
This post was originally published 15 Dec 2017 on the softwareverify.com blog. We moved these posts to this dedicated domain 27 March 2025.