Don't know how many of you have seen this little gem:
https://www.cbc.ca/news/canada/nova-scotia/national-bank-canada-customer-banking-privacy-1.5334059For those of you afraid of following a link, A bank in Canada is requiring users accounts and passwords from OTHER banks to register for their online services.
Lemme say that again, they're asking for the login credentials of their clients AT OTHER BANKS!
I deal with banks a lot, and when it comes to common sense, security, accessibility, usability, or even good practices there are few more incompetent fools "faking it until they make it" than in the upper echelon of bank development. Most of them barely know the most basic of security practices, much less give a flying purple fish if their train wrecks of how NOT to use HTML, CSS, or JavaScript are actually useful to end users.
That's why I get hired to clean up their messes as an accessibility consultant.
But this? This goes above and beyond... To the people in charge at "National Bank of Canada" all I can say is...

But do they solve the problem by admitting fault? Hell no, they're doubling down on the stupid trying to defend it. SAD part is I've dealt with these types of two faced social generals enough times to know they'll just by their way out of the problem without changing a thing.
Hence why I have an idea. I've already done it, I'm promoting this idea around the web, and I'd ask anyone effected by this, or even just understands what's wrong with it to do the same. It's an obvious solution.
Report their site to Google Safe Browsing for being a phishing scam.
https://safebrowsing.google.com/safebrowsing/report_badware/?hl=enProblem? Solution. If enough of us report, it will get attention to get them investigated. Since the claim that they are asking for other account credentials -- phishing -- is entirely true, it will get them that nice full screen "we're blocking access" page.
So please, do like I did. Go to the above link, type in:
https://www.nbc.ca/
as the offending site, type in "they are phishing for other banks login credentials, as reported in the news".
Because if this doesn't qualify as reason enough to treat them as unsafe for general users, nothing does.