activating (but not really being able to use) HSBC's online banking (private banking edition)

The online banking for HSBC's private banking is a read-only view -- fine.

It depends on one-time-codes over SMS, and there is no alternative mechanism for people who don't want everything to depend on their mobile phone -- bad.

The process so far was something like this:

 * get an html email with a link to HSBC's web-based messaging

 * follow link and try to log in to HSBC's web-based messaging

 * login button is replaced by swirly thing which swirls, but doesn't log me in

 * email point of contact at HSBC about swirly thing that never progresses

 * received reply from point of contact at HSBC about swirly thing

 * around 15 minutes later, notice that HSBC's messaging site has now deigned to log me in

 * follow link in message to online banking site ready to try and proceed with registration

 * enter one-time identifier supplied to me in message (fine), set usual "security question" type stuff, fight with a very badly-done and incorrect pasword-setting page.  This includes an error along the lines of "password must be at least 12 characters long, with at least one happy emoji, one sad emoji", etc, all of which requirements were met by my password.  I then had to guess what it was about my password (answer: a string of 4 identical characters in a row) that was upsetting it -- but this reason was not stated in their error message, nor even listed in the given list of possible reasons, though I had previously noted it in a different list elsewhere.

You could spend a whole lifetime just cataloging ways corporations fuck up simple password-setting web pages if you wanted, but of course, they should not be given the opportunity, were authentication in the world to be done properly.

 * transcribe an SMS code from my phone to the web page

Tada! At this point I was logged in for the first, and possibly last, time in my life, to the online banking facility of a private bank.  But there was something rather strange, related to authentication, popping out at the top:

That box saying "Sign in".  It's from the browser, not the page.  It's what the browser gives you when the web site, or some element thereof, wants HTTP Basic Authentication.  This is where a username and password is sent in a header called "Authorization" (oh dear), as opposed to the commonly-used approach where a form submission results in a cookie being set.

So seeing that box here presents the user with a conundrum.  It is certainly a basic mistake by  HSBC's online banking team, that it is there.  Is the best way to deal with it to re-enter the username and password (previously entered into a form and submitted, remember), to try and do HTTP Basic Authentication on some elements presumably being loaded by the main page, which appears to be authenticated and logged in, displaying my name and other details?  It does at least appear to be an okay domain to send it to.  Or should the user hit cancel, and risk mysterious breakage elsewhere?

I hit cancel.

I then proceeded to try and browse to find the most basic thing I wanted to be able to view.  There are 4 accounts here for which I have IBANs, in different currencies.  I have been given the account numbers, via a PDF in which the text was not selectable, but was done as pictures of text, so I had to transcribe all these IBANs and other identifiers by hand.  No, I am not shitting you.

How do I see the balances for the 4 accounts?  I thought I may as well explore the site, too.  Within two clicks, I think it was when I clicked on "Documents", I was logged out of the site again:

Why was I logged out?  "For security purposes", of course.

This is the world we live in.  You can spend months trying to log in to a web site, and the moment you are logged in, you can not find the one thing you wanted, and in any case you are immediately logged out again "for security purposes".