Skip to main content


I am slowly going mad

I am trying to report to Simplii Financial that they don't have SSL on simplii.com and they just keep telling me that they have SSL on www.simplii.com

This is one of those "type it into SSL labs and see what pops out situations", incredibly boring, and it just breaks my HSTS and it's annoying and bad.

Their support team needs a screenshot of my browser not connecting , and a version number of a browser and the model number of my computer, and it needs to be running Windows or Mac in order to report this. But they did finally send me to BugCrowd.

BugCrowd tells me that it's a false positive, and that this means SSL is working fine https://www.ssllabs.com/ssltest/analyze.html?d=simplii.com

I am definitely moving my money, but also - is BugCrowd usually this dumb?! Is there anywhere where you can report a (admittedly incredibly minor) security issue to a Canadian bank where someone who knows what SSL is will read it?

An image of the www.simplii.com login page with an arrow pointing to https://www.simplii.com and nothing about https://simplii.com

This is their proof that the bareword domain has SSL on it. Whicjh uh, I am glad BugCrowd hires the best.

Day 5 of trying to report a vulnerability to a bank >.<

Quincy reshared this.