IE Devs Criticize Bank Security Vulnerabilities

mrcaseyj writes "A post on the IE blog criticizes some banks for no longer using secure connections for entire login pages and only encrypting the password as it goes back to the bank. This prevents simple password sniffing but doesn't prevent a man in the middle attack from replacing the unsecured login page with one that has disabled encryption. This is especially a problem if you are using an unencrypted wireless connection such as at a coffee shop, because hackers can easily use the airpwn package to intercept the login page and steal your password. An easy remedy for when a secure page isn't available is to enter a bad username and password which usually brings up a secure page telling you to try again. But can you really trust your money to a bank that doesn't even offer the option of a secure login page?"

Comments

Re:Fixed it for ya!

[jZnat]

Find me a bank that uses IIS and I'll make sure not to use them. IIS is an insecure piece of shit that has only recently upgraded its security in version 6.0, and many IIS administrators don't know how to secure it properly anyhow.