4 ms·

> like man in the middle attacks stealing everything from all your user/passwords to credit/bank/personal info. If you're logging in or sending financial data

> like man in the middle attacks stealing everything from all your user/passwords to credit/bank/personal info. If you're logging in or sending financial data over unsecure (non-SSL) connections, you already have a problem.

MertsA 12y ago
SSL Strip still works and banks don't care about anything other than providing the illusion of security and standard SSL. Take for example an old lady down the road who somehow got some futuristic malware on her router. She goes to Bing to search for Wells Fargo to do some online banking (and you know that there is a huge portion of users who only browse the web this way). Hypothetical malware then just runs SSLStrip over the page from bing.com which isn't served over ssl because Microsoft values their bottom line over your privacy and security, which then replaces the link to the https site with http, the router acts as a proxy between http and https so wellsfargo.com is none the wiser. Evil hacker now has poor old lady's password and transfers the money in her account to his own foreign bank account. This hypothetical scenario is doable even running off of a slow router while not using many more resources than the parental keyword filtering uses. At no point does SSL ever come into play and the top 4 Banks in America (Chase, Citibank, Bank of America, Wells Fargo) don't use HSTS so there's no real way to protect their users from SSLStrip unless a browser includes them in some force SSL list.
- phlo 12y ago
  > SSL Strip still works and banks don't care about anything other than providing the illusion of security and standard SSL. Speaking as a security officer for a (non-US) bank, this is not true. We use EV certificates (to increase visibility vs. standard certs), deployed HSTS over a year ago on most of our propierties, force HTTPS and pin keys wherever we can (i.e. mobile apps). And even if a session is compromised: transactions are screened and verified before execution. Yes, our chief concern remains the bottom line. Pushing for more trust increases our user base. Fighting fraud avoids compensation payments. Building awareness and implementing technical measures aids both of these goals, so we get to spend a reasonable amount on both.
  - makomk 12y ago
    The UK bank I use doesn't even bother to force HTTPS on most of their site, let alone use stuff like HSTS. They helpfully make use of EV certificates for the bits of the site that are secure though (except those still don't show up differently on many devices).

MertsA 12y ago

SSL Strip still works and banks don't care about anything other than providing the illusion of security and standard SSL. Take for example an old lady down the road who somehow got some futuristic malware on her router. She goes to Bing to search for Wells Fargo to do some online banking (and you know that there is a huge portion of users who only browse the web this way). Hypothetical malware then just runs SSLStrip over the page from bing.com which isn't served over ssl because Microsoft values their bottom line over your privacy and security, which then replaces the link to the https site with http, the router acts as a proxy between http and https so wellsfargo.com is none the wiser. Evil hacker now has poor old lady's password and transfers the money in her account to his own foreign bank account. This hypothetical scenario is doable even running off of a slow router while not using many more resources than the parental keyword filtering uses. At no point does SSL ever come into play and the top 4 Banks in America (Chase, Citibank, Bank of America, Wells Fargo) don't use HSTS so there's no real way to protect their users from SSLStrip unless a browser includes them in some force SSL list.

phlo 12y ago
> SSL Strip still works and banks don't care about anything other than providing the illusion of security and standard SSL. Speaking as a security officer for a (non-US) bank, this is not true. We use EV certificates (to increase visibility vs. standard certs), deployed HSTS over a year ago on most of our propierties, force HTTPS and pin keys wherever we can (i.e. mobile apps). And even if a session is compromised: transactions are screened and verified before execution. Yes, our chief concern remains the bottom line. Pushing for more trust increases our user base. Fighting fraud avoids compensation payments. Building awareness and implementing technical measures aids both of these goals, so we get to spend a reasonable amount on both.
- makomk 12y ago
  The UK bank I use doesn't even bother to force HTTPS on most of their site, let alone use stuff like HSTS. They helpfully make use of EV certificates for the bits of the site that are secure though (except those still don't show up differently on many devices).