3 ms·

Of course it's not real. Its a subdomain of chase.com. Parent should've said something like chase.evil.com.

• tomsmeding 8y ago
  If the user hasn't visited the subdomain evil.chase.com yet, a http downgrade attack (https://news.ycombinator.com/item?id=18090419 https://news.ycombinator.com/item?id=18090419) would maybe work.
  • hunter2_ 8y ago
    That's not a downgrade, but a lack of upgrade. A few comments back said https://evil https://evil but it would have to instead be http://evil http://evil assuming no rogue root cert is installed. And requires that if the user had visited chase.com, that chase.com not have includeSubdomains in their HSTS header.
    • deaps 8y ago
      So to prevent a downgrade attack before a first connection is made, not only does the domain need to "includeSubdomains" - and have a valid lifetime (maybe of at least 31536000 seconds, or 1 year [this may just be a government standard]), but they'd also have to send the preload directive in their HSTS header and have been preloaded by that browser platform. If the domain is not preloaded, that first connection is required to get the HSTS information to the client in the Strict-Transport-Security header.