Re:Is it OK to hold credit card numbers in cookies, Santander?
by marshray on Monday October 15, 2012 @11:56AM
(#4655614)
Would you consider doing everyone a favor and link the results of the https://www.ssllabs.com/ssltest/ Qualys SSL labs test for that site?
Re:Is it OK to hold credit card numbers in cookies, Santander?
by epo on Wednesday October 17, 2012 @03:55AM
(#4663534)
Do you have any grounds for this disbelief or do you just a go around changing the subject to make unsubstantiated assertions? FD's customer service (the subject of the parent comment) is beyond excellent, they set the standard to which all others should aspire. The comment about hiding the addressbar is simply tinfoil hat-ism.
You are the first and only person to mention the SSL issue so far as I can see, given the quality of your other comments I am inclined to disregard this as you not understanding what you were being told or because you are using a defective browser.
EDIT: I've just logged in, my popup window (Firefox, OS X) does have an address bar. My instinct was correct, you have no clue.
Re:Is it OK to hold credit card numbers in cookies, Santander?
by pornel on Friday October 19, 2012 @12:46PM
(#4674292)
Firefox simply does not respect firstdirect's wish to hide the addressbar, which doesn't mean they're not trying.
Safari obeys their wishes fully.
Run this in JS console before clicking "Internet Banking"
window.open = function(){console.log(arguments)}
and you'll see: ["/1/2/pib-service", "pib", "toolbar=0,location=0,directories=0,status=1,menubar=0,scrollbars=1,resizable=1,width=780,height=510,top=0,left=0"]
Note "toolbar=0,location=0,menubar=0" which is a quite strong attempt to hide all window chrome.
They force a 640px popup window that deliberately hides addressbar, so you can't easily check if it's HTTPS.
My browser warns me that their site still has SSL renegotiation vulnerability unpatched.