I've been checking out various TLS certificates lately and noticed that most of the banks seem to have the following two issues:

1) They do not offer perfect forward secrecy

2) They are still using RC4

So far, all the ones I've checked (TD, JPMorgan, CIBC, Wells Fargo, Bank of America, ING/Tangerine, RBC) use 

TLS_RSA_WITH_RC4_128_SHA

Though actually CitiGroup and Goldman Sachs are using AES in CBC mode with 256 bit keys, instead of RC4, but still, no forward secrecy, and I would think GCM+SHA256 is better than CBC+SHA, even with 128 bit keys vs 256.

On the other hand, google, facebook, linkedin, and bitcoin exchanges/sites do offer perfect forward secrecy (typically with ECDHE), and unanimously use AES in GCM mode with SHA256 and 128 bit keys.

So my question: why have our banks not upgraded their security, especially given recent attacks on RC4 (though they are mostly theoretical, they do point to possible issues, and RC4 is generally considered less secure than AES)? Also, why would they not offer perfect forward secrecy? Is that an oversight on their part, or possibly for regulatory reasons?

I nearly emailed my bank about this today, but figured I'd throw the question up here first. Of course, cyber attacks on banks are all the rage these days - they ought to use the best encryption they can.

No, HTTPS does not necessarily mean that a site is not malicious.  HTTPS means very little as to the security of a site.  It's specifically geared to keep your communication with the site secure from eavesdroppers and tampering, but offers nothing as to the security of the site itself.  

Yes, a site serving content over HTTPS has a certificate.  That means that the individual who requested the certificate from the CA has an email address that is associated with the domain. Except in the case of Extended Validation certificates (the ones that offer a green address bar) this is literally all it means.  Nobody from the CA is validating that the site is safe, secure, and not serving malware.   Any site, with an SSL cert or without, can have bugs and vulnerabilities that allow an attacker to leverage them to serve an exploit.  Or a admin or user who has the ability to either maliciously or unknowingly cause the site to serve malware. Even if the site itself does not, if it serves advertisements (or any other content, for that matter) from an ad network or another site, that could be vulnerable.

So, HTTPS means that nobody should be able to view or tamper with your traffic.  That is all that it means.  
