> SSL Strip still works and banks don't care about anything other than providing the illusion of security and standard SSL. Speaking as a security officer for

> SSL Strip still works and banks don't care about anything other than providing the illusion of security and standard SSL. Speaking as a security officer for a (non-US) bank, this is not true. We use EV certificates (to increase visibility vs. standard certs), deployed HSTS over a year ago on most of our propierties, force HTTPS and pin keys wherever we can (i.e. mobile apps). And even if a session is compromised: transactions are screened and verified before execution. Yes, our chief concern remains the bottom line. Pushing for more trust increases our user base. Fighting fraud avoids compensation payments. Building awareness and implementing technical measures aids both of these goals, so we get to spend a reasonable amount on both.