4 ms·

Honest question... why not? Modern banks use HTTPS throughout. The banks I use all have HSTS and use preloading so no hijacking to a non-HTTPS site. I use a pa

Honest question... why not? Modern banks use HTTPS throughout. The banks I use all have HSTS and use preloading so no hijacking to a non-HTTPS site. I use a password manager so if somehow I do get hijacked and get sent to a phishing site, and even if that phishing site is using a Lets Encrypt cert to prevent the “Not Secure” banner in a modern browser, my password manager isn’t going to recognize the domain so it would not let me attempt to log in even if I wanted to.

ceejayoz 7y ago
This comments thread literally starts with someone who discovered their bank's app wasn't validating the certificate, though.
- lukewink 7y ago
  In that case it wouldn't be safe to use the app on a private network either.
  - JohnFen 7y ago
    True, but doing so on a private network would still be a whole lot safer than on an open AP.