News for hackers. Stuff that matters.

A comment on Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse. Parent comment

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by technion on Monday October 16, 2017 @07:28AM (#15482440)
I'm seeing HSTS on 0/3 of Australian banks (I'm even seeing RC4 on one of them).

https://www.ssllabs.com/ssltest/analyze.html?d=commbank.com.... https://www.ssllabs.com/ssltest/analyze.html?d=nab.com.au&s=... https://www.ssllabs.com/ssltest/analyze.html?d=westpac.com.a...

[ Parent | on HN ]
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by stephen_g on Monday October 16, 2017 @11:51AM (#15484080)
Commonwealth's online banking is actually at my.commbank.com.au and does have HSTS - https://www.ssllabs.com/ssltest/analyze.html?d=www.my.commba...

CUA does have it - https://www.ssllabs.com/ssltest/analyze.html?d=ob.cua.com.au

Bankwest does but has some awful problems elsewhere - https://www.ssllabs.com/ssltest/analyze.html?d=ibs.bankwest....

But yeah, Westpac and NAB don't, and in addition to the ones you tested, ANZ and St. George don't have it either. That's pretty unacceptable really.

[ Parent | on HN ]
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by baby on Tuesday October 17, 2017 @10:08AM (#15490986)
These are real issues that you can report to them.
[ Parent | on HN ]