Stories
Slash Boxes
Comments

SoylentNews is people

Scotiabank Internet Whizzkids Screw Up Their HTTPS Security Certs

posted by mrpg on Sunday September 10 2017, @07:56AM   Printer-friendly
from the world-class-digital-solutions dept.

MrPlow writes:

Submitted via IRC for Bytram

The team behind Scotiabank's Digital Banking Unit isn't impressing some customers, after forgetting to renew the security certificates for their own website.

The DBU was set up last year to sell "world class digital solutions" to electronic banking customers around the world. But Jason Coulls, CTO of food safety testing company Tellspec and a former banking software developer, tipped off The Register that the bank's hipster factory certificates had expired nearly five months ago.

"Tuesday next week is the five month anniversary of the certificate expiring and no one has noticed," he said. "This from a group supposed to showcase how smart the bank's IT people are. The irony is strong in this one."

[...] In 2016 he spotted that the bank's mobile app had some rather unusual features – notably that the programmers had laden the code with f‑bombs. He informed the bank in April and got no response, so let the regulators know. Scotiabank fixed the code within 24 hours.

Source: Scotiabank internet whizzkids screw up their HTTPS security certs

Original Submission

 
This discussion has been archived. No new comments can be posted.
Scotiabank Internet Whizzkids Screw Up Their HTTPS Security Certs | Log In/Create an Account | Top | 10 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 4, Interesting) by krishnoid on Sunday September 10 2017, @10:47PM

    by krishnoid (1156) on Sunday September 10 2017, @10:47PM (#566054)

    In 2016 he spotted that the bank's mobile app had some rather unusual features – notably that the programmers had laden the code with f‑bombs. He informed the bank in April and got no response, so let the regulators know. Scotiabank fixed the code within 24 hours.

    Could this be a safer avenue of responsible disclosure?

    1. Identify security problem with financial institution's website/app
    2. Notify financial institution and get no response
    3. Notify appropriate financial regulatory body
    4. Lower likelihood of getting sued (?)
    5. ...
    6. Security!
    Starting Score:    1  point
    Moderation   +2  
       Interesting=2, Total=2
    Extra 'Interesting' Modifier   0  
    Karma-Bonus Modifier   +1  
    Total Score:   4