Stories
Slash Boxes
Comments

SoylentNews is people

Scotiabank Internet Whizzkids Screw Up Their HTTPS Security Certs

posted by mrpg on Sunday September 10 2017, @07:56AM   Printer-friendly
from the world-class-digital-solutions dept.

MrPlow writes:

Submitted via IRC for Bytram

The team behind Scotiabank's Digital Banking Unit isn't impressing some customers, after forgetting to renew the security certificates for their own website.

The DBU was set up last year to sell "world class digital solutions" to electronic banking customers around the world. But Jason Coulls, CTO of food safety testing company Tellspec and a former banking software developer, tipped off The Register that the bank's hipster factory certificates had expired nearly five months ago.

"Tuesday next week is the five month anniversary of the certificate expiring and no one has noticed," he said. "This from a group supposed to showcase how smart the bank's IT people are. The irony is strong in this one."

[...] In 2016 he spotted that the bank's mobile app had some rather unusual features – notably that the programmers had laden the code with f‑bombs. He informed the bank in April and got no response, so let the regulators know. Scotiabank fixed the code within 24 hours.

Source: Scotiabank internet whizzkids screw up their HTTPS security certs

Original Submission

 
This discussion has been archived. No new comments can be posted.
Scotiabank Internet Whizzkids Screw Up Their HTTPS Security Certs | Log In/Create an Account | Top | 10 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 5, Informative) by Appalbarry on Sunday September 10 2017, @04:28PM (2 children)

    by Appalbarry (66) on Sunday September 10 2017, @04:28PM (#565976) Journal

    Scotiabank still does not allow customers to use upper case or special characters in passwords, arguing that it would confuse some customers.

    Rather than putting resources into security, Scotiabank has been prioritising the disposal of long time employees and the centralisation of all decisions at head office in Toronto.

    The days when you knew your branch manager, and they would bend the rules in an emergency, are long, long gone.

    But hey! Scotiabank is still the industry leader in exorbitant service charges!

    Starting Score:    1  point
    Moderation   +3  
       Informative=3, Total=3
    Extra 'Informative' Modifier   0  
    Karma-Bonus Modifier   +1  
    Total Score:   5  

  • (Score: 0) by Anonymous Coward on Sunday September 10 2017, @09:29PM (1 child)

    by Anonymous Coward on Sunday September 10 2017, @09:29PM (#566036)

    IT's good policy. By limiting the number of characters to only a..z and 0..9 you can enforce real security by having the customer use LONGER passwords. The Tr0ub4d0r style passwords are known to be weak anyways.
    Good policy should include a biometric identifier and a 6 to 9 digit PIN