HTTPS on Your Landing Page Is Important
troyhunt.com
HTTPS on Your Landing Page Is Important
1–10 of 307 posts
Re: HTTPS on Your Landing Page Is Important
#2Troy is way overstating the case.
You want to know if the login page is NatWest?
Click on the Login link and look at the browsers security bar.
If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great.
It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution.
It seems far more likely that you care about the entity you are working with (Royal Bank of Scotland), than the domain of the referring page (personal.natwest.com).
Re: HTTPS on Your Landing Page Is Important
#3Troy is way overstating the case. You want to know if the login page is NatWest? Click on the Login link and look at the browsers security bar. If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great. It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution. It seems far mor…
NatWest is a subsidiary of RBS.
Re: HTTPS on Your Landing Page Is Important
#4Troy is way overstating the case. You want to know if the login page is NatWest? Click on the Login link and look at the browsers security bar. If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great. It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution. It seems far mor…
What fraction of users will do this, in your opinion?
Re: HTTPS on Your Landing Page Is Important
#5Troy is way overstating the case. You want to know if the login page is NatWest? Click on the Login link and look at the browsers security bar. If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great. It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution. It seems far mor…
The issue is that users tend not to notice the absence of EV security indicators. If they see a padlock (which a phisher could get for a phishing domain), they assume it's secure and enter their credentials.
Also, it may not be apparent to users whether "The Royal Bank of Scotland Group Plc [GB]" would be affiliated with NatWest. Companies often have different names they do business under.
Re: HTTPS on Your Landing Page Is Important
#6Troy is way overstating the case. You want to know if the login page is NatWest? Click on the Login link and look at the browsers security bar. If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great. It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution. It seems far mor…
And if you aren't familiar with the details of how web browsers work (eg most people who use them), you would have no idea something was wrong. Not to mention potential problems such as http://stripe.ian.sh
Re: HTTPS on Your Landing Page Is Important
#7Troy is way overstating the case. You want to know if the login page is NatWest? Click on the Login link and look at the browsers security bar. If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great. It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution. It seems far mor…
Uhh, yeah you could do that. Do most people do that after they click the login page on their bank's website? No.
The issue is that most non-technical users would not even think about checking. They went to their "secure" bank website and clicked login, why should they have to worry?
Re: HTTPS on Your Landing Page Is Important
#8Troy is way overstating the case. You want to know if the login page is NatWest? Click on the Login link and look at the browsers security bar. If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great. It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution. It seems far mor…
Unfortunately EV certs are not bulletproof:
https://arstechnica.com/information-technology/2017/12/nope-...
For ~$170 apparently you can get an EV cert for "Stripe, Inc" (by forming a company with that name).
Even aside from that fact, users are very bad at knowing what a secure site looks like. I would wager that if most users clicked "login" and didn't see an EV cert, but instead saw " Secure" (i.e. a non-EV HTTPS connection), they would not notice the difference.
Troy is right to kick up a fuss about this; this is a significant attack vector (anyone on a wifi network can MITM your banking login URL), and it's more egregious because of how easy it is to set up HTTPS.
Re: HTTPS on Your Landing Page Is Important
#9Troy is way overstating the case. You want to know if the login page is NatWest? Click on the Login link and look at the browsers security bar. If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great. It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution. It seems far mor…
Or put another way, don't notice the absence of "The Royal Bank of Scotland Group Plc [GB]". Or don't notice if it's been changed to "RBSG [GB]" or "Royal Bank [GB]". Then there's this:
Re: HTTPS on Your Landing Page Is Important
#10Troy is way overstating the case. You want to know if the login page is NatWest? Click on the Login link and look at the browsers security bar. If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great. It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution. It seems far mor…
I think Troy will be just fine -- it's the average user NatWest should be protecting.