I'd be surprised / disappointed if banks weren't subject to PCI DSS audits and I know from my own personal experience with PCI compliance that the SSL 3 and TLS 1.0 would fail many 3rd party vulnerability scans.
So I was very surprised to read your post and after checking the URL (www.halifax-online.co.uk) myself, sadly it seems you're right.
Sadly this isn't the first time I've questioned Halifax over their security policy for online banking. When I first signed up with them approximately 5 years ago, their login process consisted predominantly of researchable questions (eg "what was your pet's name", "what primary school did you attend", etc). Thankfully now they have a standard 2 password process now with 2FA used for any additional payment processing.
Banks aren't subject to company wide PCI DSS audits. Which makes sense as you don't usually input your credit card number anywhere...
I'm not going to disagree with your generalisation there. However with Halifax, specifically, you input your debit card details as authentication when resetting your password / sending user name reminders. And since user names are non-memorable (the one assigned to me was a 9 digit integer!), you can find yourself using the user name reminder feature on Halifax more regularly than you'd normally expect.
Re:Disabling SSLv3 and RC4
by PuffinBlue on Friday September 18, 2015 @05:13AM
(#10238183)
Lloyds appears to have an identical config:
https://www.ssllabs.com/ssltest/analyze.html?d=https%3A%2F%2...
I would have expected banks to have audits for things like these fairly regularly. Does anyone know why they are running such a broken configuration when a lot of these vulnerabilities have been around for months/years? Not to mention that even ignoring any vulnerabilities, their ciphersuite is dire.