Ah, sorry, I misread your comment. Indeed, a browser that doesn't respect cross-domain restrictions is a poorly written browser.
My point still stands, though: the point of cookieless domains is not security, but bandwidth. And there are legitimate reasons to have top-level domain cookies - sharing authentication state between subdomains is a common example - which would prevent a subdomain from being used as a CDN, without receiving cookies.
There are many high profile websites that use the cookieless domain approach: Google, Facebook, and Reddit off the top of my head. I wouldn't say they are poorly written - it's more of a design decision to have cookies in the top-level domain.
It's not about the security of the cookies, it's about the bandwidth you save by having a separate domain for static content, because the client does not have to transmit the cookies for each request.
Because WhatsApp uses your phone book as the only way to interact with its contact list. You can't add someone to directly to your WhatsApp contact list.
It could probably access it less often by only sending deltas, but that would mean their servers would have to store your whole phone book. I don't think that's any better from a privacy perspective.
Of course Facebook Messenger doesn't do the same, it has its own contact list coming from Facebook.
Thank you for the feedback. That was my original intention, but seeing the constant location updates from Foursquare while writing the article surprised me (admittedly not too much).
I recognize this as a possibility and I would definitely take it down if the bank requested it.
On the other hand, if anything, I exposed that they did a good job. They could have rolled out their own crypto, or some flawed form of code generation, in which case I would have disclosed it to them through proper means. But they adhered to standards (TOTP, RFC6238) and protected their data as well as possible. This article should be seen as praise.
Then again, corporations aren't always that understanding, which is why I would be happy to comply.
Don't forget bandwidth costs. I could get about 100mbps to an external server. At $0.12/GB, 100mbps * 35 minutes = 25GB = $3. Most clicks won't cost you this much, but you should definitely keep an eye on this. Maybe set a bandwidth cap somehow.
Also, I noticed a public key in ~/.ssh/authorized_keys. Is that intentional or just part of how EC2 APIs work?
Other than that, great job. I would definitely use this service.