3 ms·

HSTS cannot be overridden. Which bank domain names are you thinking of that are not one of the twelve thousand names on the HSTS preload list? https://source.ch

HSTS cannot be overridden. Which bank domain names are you thinking of that are not one of the twelve thousand names on the HSTS preload list? https://source.chromium.org/chromium/chromium/src/+/main:net/http/transport_security_state_static.json https://source.chromium.org/chromium/chromium/src/+/main:net...

LtWorf 4y ago
I tried 5 banks (swedish and italian). None of them are in the list. I feel safer now :D :D :D handelsbanken.se danskebank.se unicredit.it fideuram.it sella.it
- sbierwagen 4y ago
  handelsbanken.se is on line 163144. (I was a little bit off on the length of the list before) unicredit.it is not on the list, but unicredit.ba and unicredit.ro are. (Lines 7331 and 7332) It does send HSTS headers. danskebank.se and sella.it are not in the file, nor are the base strings, but both sites do send HSTS headers. fideuram.it is not on the list, and does not send HSTS headers, so they don't seem particularly interested in security. They also haven't set an A record for the root domain, so visiting `fideuram.it` returns NXDOMAIN. Only `www.fideuram.it` exists.
  - LtWorf 4y ago
    So this shows that your statement about the security of hsts headers was overblown?
    - sbierwagen 4y ago
      You got me. I wildly overestimated the competence of Eurobanks. I'll never make the mistake of assuming an institution knows what it's doing again.
      - LtWorf 4y ago
        fideuram removed the phisical tokens for 2fa and moved to SMS, saying that it was because of some european directive… I went to read the directive. It basically said to not use sms and avoid apps in favour of dedicated 2fa devices for banking.
- ripdog 4y ago
  Banks often have awful security systems. Kiwibank in NZ has a "two-factor security" system. All it is is a security questions thing where you click on screen to fill in 3 letters of the hidden answer. The on-screen keyboard makes it secure, you see? Against keyloggers. I once wrote them a long email about what two-factor is actually supposed to be and why it exists, and got a reply basically saying "lol ok, our security is great ok?" I've since switched away from them for a bank which does 'two-factor' by sending codes via SMS, but only when its algorithm decides that it needs to. That's not very often.

LtWorf 4y ago

I tried 5 banks (swedish and italian). None of them are in the list. I feel safer now :D :D :D handelsbanken.se danskebank.se unicredit.it fideuram.it sella.it

sbierwagen 4y ago
handelsbanken.se is on line 163144. (I was a little bit off on the length of the list before) unicredit.it is not on the list, but unicredit.ba and unicredit.ro are. (Lines 7331 and 7332) It does send HSTS headers. danskebank.se and sella.it are not in the file, nor are the base strings, but both sites do send HSTS headers. fideuram.it is not on the list, and does not send HSTS headers, so they don't seem particularly interested in security. They also haven't set an A record for the root domain, so visiting `fideuram.it` returns NXDOMAIN. Only `www.fideuram.it` exists.
- LtWorf 4y ago
  So this shows that your statement about the security of hsts headers was overblown?
  - sbierwagen 4y ago
    You got me. I wildly overestimated the competence of Eurobanks. I'll never make the mistake of assuming an institution knows what it's doing again.
    - LtWorf 4y ago
      fideuram removed the phisical tokens for 2fa and moved to SMS, saying that it was because of some european directive… I went to read the directive. It basically said to not use sms and avoid apps in favour of dedicated 2fa devices for banking.
ripdog 4y ago
Banks often have awful security systems. Kiwibank in NZ has a "two-factor security" system. All it is is a security questions thing where you click on screen to fill in 3 letters of the hidden answer. The on-screen keyboard makes it secure, you see? Against keyloggers. I once wrote them a long email about what two-factor is actually supposed to be and why it exists, and got a reply basically saying "lol ok, our security is great ok?" I've since switched away from them for a bank which does 'two-factor' by sending codes via SMS, but only when its algorithm decides that it needs to. That's not very often.