4 ms·
> It’s clear that had I gone through with this payment it would have come out of WATSON’s account and not mine. No it's not clear. You're just looking at some
by dmethvin 14y ago
> It’s clear that had I gone through with this payment it would have come out of WATSON’s account and not mine.
No it's not clear. You're just looking at some HTML on the screen, it may have come out of some stale cache and have nothing to do with the session's current permissions. You might try to do the transfer and find that the internal state of your session is so hosed that you can't do anything.
- pav3l 14y agoExactly, most likely Watson's stuff came from his ISP's cache.
- espes 14y agoHow? SSL...
- pav3l 14y agoRight, nevermind...
- maratd 14y agoNot so fast. You don't know if everything is coming down the pipe using SSL. They might be trying something fancy with AJAX, performing a remote call, the server spits back JSON on a regular connection, screws up the headers, and it gets cached. You really can't tell. It is a possibility.
- espes 14y agoA bank pulling down user information unencrypted is only slightly better than showing it to strangers. Though you're right, it's a possibility :(
- gst 14y agoI take it for granted that banks to stupid things. Just look at their password policies, for example. Many US banks basically prevent you from setting a strong password. Or my Austrian bank (http://www.easybank.at/ http://www.easybank.at/) which includes Javascript code from typekit.com to use some Adobe fonts. Makes me feel much safer knowing that the security of my online banking interface does not only depend on my bank's site, but also on the security of Adobe's site.
- pacomerh 14y agoYeah, actually I do online BoA also, and that interface doesn't look exactly the same as the one I see. Shouldn't it be the same?.