Re:Microsoft bakes a VPN into Edge and turns it on
by LtWorf on Saturday October 01, 2022 @03:15AM
(#33044677)
So this shows that your statement about the security of hsts headers was overblown?
Re:Microsoft bakes a VPN into Edge and turns it on
by sbierwagen on Sunday October 02, 2022 @07:10PM
(#33061339)
You got me. I wildly overestimated the competence of Eurobanks. I'll never make the mistake of assuming an institution knows what it's doing again.
Re:Microsoft bakes a VPN into Edge and turns it on
by LtWorf on Monday October 03, 2022 @05:15PM
(#33073809)
fideuram removed the phisical tokens for 2fa and moved to SMS, saying that it was because of some european directive… I went to read the directive. It basically said to not use sms and avoid apps in favour of dedicated 2fa devices for banking.
unicredit.it is not on the list, but unicredit.ba and unicredit.ro are. (Lines 7331 and 7332) It does send HSTS headers.
danskebank.se and sella.it are not in the file, nor are the base strings, but both sites do send HSTS headers.
fideuram.it is not on the list, and does not send HSTS headers, so they don't seem particularly interested in security. They also haven't set an A record for the root domain, so visiting `fideuram.it` returns NXDOMAIN. Only `www.fideuram.it` exists.