3 ms·

All of the above assumes that the broader population are well informed about the nuances of digital security. The reality is most people have better things to d

All of the above assumes that the broader population are well informed about the nuances of digital security. The reality is most people have better things to do. As for your third paragraph—I would agree that banks should act more like APIs and less like their own countries. But that is independent from the use of a protocol. Arguing between TLS (HTTPS) and SSH borders on bikeshedding. The reality is more than a billion people are successfully using HTTPS to safely and securely manage their money, and HSTS is improving the guarantees around that security. I'm sure you've solved every security and trust risk with this hypothetical bank-over-IRC-over-SSH protocol with non-mandatory security... but I'm not yet convinced.

zzo38computer 8y ago
You are correct about that; you could do HTTPS (or otherwise TLS) too would also work, to define such API; it does not have to be SSH. (Actually, now that I consider, HTTP requests (with HTTPS) might be better than SSH anyways for many of the things being done, such as downloading a bank statement. So, it may likely do better. However, the common authentication protocols are better in SSH, but similar kind of authentication protocols is probably still possible with HTTPS too, just it does not seem to be as commonly used, but perhaps it should be.)