Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This link says it's from YouTube but it's not

youtube.com

Post reply on HN
Print view View original

51–60 of 60 posts

Re: This link says it's from YouTube but it's not

#51

Post by URSpider94 »

harshavr wrote: post #43
Phantom wrote: post #7

Earlier quoted context omitted.

Exactly! Imagine if your bank had such a redirect URL available, Phishing would be so simple.

Some banks display a customer preselected image after the user name & before entering a password. This seems to be a good solution to phishing if one keeps the username private. Otherwise a site could give you the option of using two part passwords.

... and a study a while back showed that, if you simply don't show that image, a large majority of users don't notice. For this reason, the whole "sitekey" phenomenon strikes me as a waste of time.

Re: This link says it's from YouTube but it's not

#52

Post by kwamenum86 »

This is a case where the web is only as secure as its most insecure link. Even if your site uses a hash to prevent abusing redirects people can still abuse them. They need only find a site that uses hashless redirects, generate some redirect link using that site, and then create a legit redirect link using your site. Blacklisting certain domain strings in the url would not solve this- new domains are too easy to obtain. Whitelisting would help but may be prohibitive depending on what you are building...

Re: This link says it's from YouTube but it's not

#53

Post by ced »

harshavr wrote: post #43
Phantom wrote: post #7

Earlier quoted context omitted.

Exactly! Imagine if your bank had such a redirect URL available, Phishing would be so simple.

Some banks display a customer preselected image after the user name & before entering a password. This seems to be a good solution to phishing if one keeps the username private. Otherwise a site could give you the option of using two part passwords.

Isn't this incredibly simple to defeat? The phishing site can send your username to the real bank's website and retrieve the image.

Re: This link says it's from YouTube but it's not

#54

Post by oscardelben »

abentspoon wrote: post #48
mrcharles wrote: post #9

I don't know a single non-technical but non-internet-ignorant user who wouldn't be suckered in by this. I've taught people how to scan for valid links, and now they can't even trust that.

On proggit, we just found that even techical, internet savvy users can be suckered in by this. http://www.reddit.com/r/programming/comments/bpy7h/think_you... 1 in 5 attempted to sign in. The results are hardly scientific, but the comments are full of users who were fooled.

Sorry but I'm not sure users from reddit are all web savvy. It's still interesting that people don't look at urls when asked for passwords.

Re: This link says it's from YouTube but it's not

#55

Post by johnswamps »

oscardelben wrote: post #54
abentspoon wrote: post #48

Earlier quoted context omitted.

On proggit, we just found that even techical, internet savvy users can be suckered in by this. http://www.reddit.com/r/programming/comments/bpy7h/think_you... 1 in 5 attempted to sign in. The results are hardly scientific, but the comments are full of users who were fooled.

Sorry but I'm not sure users from reddit are all web savvy. It's still interesting that people don't look at urls when asked for passwords.

Maybe not reddit as whole, but surely the people reading the programming subreddit are a bit more web savvy than the average person?

Re: This link says it's from YouTube but it's not

#57

Post by alex1 »

xtacy wrote: post #20
tednaleid wrote: post #15

This is a common exploit. So common that it's #8 on the 2010 OWASP top 10 most critical web application security risks: "Unvalidated Redirects and Forwards". http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Projec... Every web app developer should review these vulnerabilities before releasing their code to the world.

Interesting. Facebook had a similar exploit earlier but they seem to have solved it easily by attaching a hash to the redirect: site.com/redirect?l= &h=hash(secret,url)

Facebook also presents you with a warning page before redirecting you:

http://www.facebook.com/l.php?u=http%3A%2F%2Fnews.ycombinato...

Re: This link says it's from YouTube but it's not

#58

Post by invisible »

jrockway wrote: post #33

URLs are not a security mechanism. They are a non-canonical resource locator, where each part is resolved by a different server. It's a way to write a "program" that does a DNS lookup and HTTP query in a simple way. Nothing more, nothing less. If you want security, start a CA, give each site you like its own SSL cert (signed by you), and enjoy.

I've looked at the costs of starting a CA and they are absolutely astronomical for the average person. Not that every person should be able to start a full-fledged CA, but the whole thing is scammy on the tail-end.

Re: This link says it's from YouTube but it's not

#59

Post by invisible »

URSpider94 wrote: post #51
harshavr wrote: post #43

Earlier quoted context omitted.

Some banks display a customer preselected image after the user name & before entering a password. This seems to be a good solution to phishing if one keeps the username private. Otherwise a site could give you the option of using two part passwords.

... and a study a while back showed that, if you simply don't show that image, a large majority of users don't notice. For this reason, the whole "sitekey" phenomenon strikes me as a waste of time.

This? http://usablesecurity.org/emperor/ - it is an interesting read.

It should also be noted that it's not even a 25% benefit for them, but it does help security, even if slightly. I think lowering phishing 1% could be massive for any major bank.

Re: This link says it's from YouTube but it's not

#60

Post by sagarm »

ced wrote: post #53
harshavr wrote: post #43

Earlier quoted context omitted.

Some banks display a customer preselected image after the user name & before entering a password. This seems to be a good solution to phishing if one keeps the username private. Otherwise a site could give you the option of using two part passwords.

Isn't this incredibly simple to defeat? The phishing site can send your username to the real bank's website and retrieve the image.

If you do that, the bank will notice a bunch of connections from the same IP for different usernames.

You could use a botnet to do the lookups, but that still makes the attack substantially more difficult.

Post reply on HN