No HSTS

[Sentience]

Hi team, technical one but important considering you’re in the finance space.

Spotted on a hotspot today that https://theverge.com blocked me accessing the site due to HSTS but https://monzo.com allowed me still to connect and it probably​ shouldn’t.

Hope this feedback helps

[_Colin_W]

Thank you for raising this again.

@_Colin_W

Yes, but I agree with @OBR, why shouldn’t it be done on the rest of the Monzo estate? An attack against Monzo.me could simply be started via a different Monzo site/domain the user trusts.

@_Colin_W

Similar to this helpful topic about HSTS…

CSP/HSTS/HPKP (security headers) on Monzo.me

… should the Content Security Policy HTTP response header also not be defined on all TLS websites in Monzo’s portfolio? It can help reduce cross-site scripting risk, and missing security controls like this would be reported as a vulnerability in application security testing.

There seems to be a reluctance to implement HSTS (and CSP) across all of Monzo’s web hostnames. Maybe something has been built that will break if HSTS is added. neither is a silver bullet, but they are baseline application security configuration matters.