Bank harrasses user because he tweeted screenshot of their SSL certificate

Post by yuhong » Fri, Mar 13, 2015, 5:43 PM UTC

some_furry wrote: post #9

> Firefox suggests some security concerns in the firefox console on both sites. Especially about how weak is sha1 algorithm. Both sites have a 2048 public cert, the one use TLS1.2 but the other TLS1.0 and one of them have a 128bit private key size. You all understand that from a security point of view, these things arent best practices. Especially if you are a bank ! 128 bits for symmetric key ciphers is actually fin…

Post by spectre256 » Fri, Mar 13, 2015, 5:56 PM UTC

AlyssaRowan wrote: post #31

spectre256 wrote: post #8

It's dangerously close to a passive-agressive pitchfork mob, but I propose that many people start tweeting to greek banks regarding their SSL configurations. The National Greek Bank, for example, scores an F on the SSL Labs Test because they are using TLS 1.0 and are vulnerable to POODLE: https://www.ssllabs.com/ssltest/analyze.html?d=nbg.gr their twitter account is: https://twitter.com/ibanknbg EDIT: The most effect…

Let's be crystal-clear: All of these fail PCI compliance, because they have RC4 enabled. These sites have no business processing anything, let alone personal or financial info. Yes, having RC4 enabled is now an instant PCI compliance fail as it has a die-die-die RFC and as a result NIST changed it, on request, to a CVE grade above a 4.0 - https://tools.ietf.org/html/rfc7465 - https://web.nvd.nist.gov/view/vuln/detail…

Post by MichaelGG » Fri, Mar 13, 2015, 5:59 PM UTC

exelius wrote: post #30

fragmede wrote: post #27

Earlier quoted context omitted.

> you wouldn't fuck with casinos, or the mob. Why wouldn't I, from the other side of the world, from the wifi connection of a coffee shop on the other side of town, bounced through a couple VPNs? It's one thing if I have to walk inside the casino, but the internet isn't like that.

No, that that bank on the other side of the world is likely insured by a company in the US. The global financial system is intricately linked, and the bankers and insurance companies effectively run the global economy. Given that, do you think it's really a huge stretch to think that three letter agencies from the US - the ones with documented capabilities to de-anonymize your VPNs if your OpSec is even a little slop…

Post by cgtyoder » Fri, Mar 13, 2015, 6:06 PM UTC

lepht wrote: post #35

cgtyoder wrote: post #22

Earlier quoted context omitted.

National Bank of Greece ( https://www.nbg.gr/en , @ibanknbg)

That's incorrect: > The first bank contacted almost immediately with me and I respect National Bank of Greece for that.

Post by lepht » Fri, Mar 13, 2015, 6:12 PM UTC

cgtyoder wrote: post #38

lepht wrote: post #35

Earlier quoted context omitted.

That's incorrect: > The first bank contacted almost immediately with me and I respect National Bank of Greece for that.

What's incorrect?