Superfish was never on Thinkpads, only Lenovo's consumer laptops. The Thinkpad division and the consumer laptop division seem to operate somewhat separately.

Not to excuse Lenovo - they fucked up big.

Superfish was never found, but there has definitely been malware installed on the ThinkPad line:

https://thehackernews.com/2015/09/lenovo-laptop-virus.html?m...

The firmware rootkit, to my knowledge, has never been found on ThinkPads.

please folks, dont do your banking on open coffee shop wifi

I do this all the time. My machine has a modern browser, up to date OCSP, HSTS already cached, all that. Could you please explain to me the danger or threats you are warning against?

What does "up to date OCSP" even mean?

Have you configured your browser(s) to "fail closed" when it comes to OCSP queries? CRL and OCSP behavior has been, well, "not ideal" since basically forever.

Honest question - why not? My bank uses this cool thing called TLS. What’s the threat model here?

yes legitimate traffic is going to be fully encrypted thanks to TLS, the risk comes from attacks where you believe you're logging into your banking site securely when you're actually not. for example dns cache poisoning, ssl downgrade attacks, etc.

in the case of a starbucks, the AP itself is not necessarily secure (under a counter somewhere?) so it's possible users are connecting to a malicious AP.

the threat model depends on the level of risk: the convenience may outweigh those risks, it may not. for myself it is one of a few tasks i wouldn't engage in on a network i don't have more trust in, but in retrospect this advice was indeed probably too strong for most.

Again - who cares about dns cache poisoning when your cert chain is sound and your browser is sensible about cert downgrades (which all of them are now)? Who cares about how secure the AP is? It’s an encrypted, securely authenticated connection. That’s the whole point of the cert chain. The AP can be as malicious and evil as it wants - good luck usefully tampering with or impersonating my bank’s public key.

Again, what’s the threat model here? Exploiting a browser vulnerability? Maybe?