as internal banks are usualy much worse..
http://www.bbc.com/news/technology-36110421
I could be ironic and comment it a Indian bank who they going to outsource to?
but the reality is all bank outsouce this work as it much faster cheaper.
what was done here was just way too cheap however, SSL v3 is bad, V2 is broken as such.
no SSL pinning.. well I've had that prob twice in past couple months, 1 where the company did SSL packet inspection so tried to decrypt our traffic. However as for this service we use client Client authentication the proxy did not have access to the private key so no traffic was accessed, PKI wins.
same today the Proxy was doing deep packet inspection, the product in question uses it's own Crypt not just https to avoid this. Proxy could not work out what happening and dropped packets.
pass though for our site and sorted.
in both cases the proxy is trying to complete a Man in the middle attack and was denied.
so just think, if you accessed banks at the office or similar the admins could take your details as they installed their own CA in the browser.
anyhow correct use of PKI and/or for that matter 2 factor authentication could fix all this.
Welcome to what I do for a living.
making the interweb secure.