Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS on Your Landing Page Is Important

troyhunt.com

Post reply on HN
Print view View original

31–40 of 307 posts

Re: HTTPS on Your Landing Page Is Important

#31

Post by WorldMaker »

f2n wrote: post #20
cdancette wrote: post #12

Maybe someday browsers won't accept http connections by default (except for a few domaines defined for test purpose, or for some specific tld like .local) Only then we can have 100% of the web encrypted.

It's moving that direction. As it stands, any website can opt-in to this behavior for future visitors with HSTS[0], or even for first time visitors with HSTS preload[1]. And Google has been doing HSTS preload on their .google TLD for several years, and recently rolled it out to their .foo and .dev [2] TLDs [0] https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security [1] https://hstspreload.org/ [2] https://securi…

There were a lot of complaints about Google doing that with .dev given the number of other companies and developers that use .dev for random LAN things, but an HSTS Preload for random LAN things isn't a bad idea in that it can prevent some types of mistakes going to production like bad HTTPS->HTTP redirects in an application. Obviously, Google themselves thought it a good idea to test that in their development environments.

Re: HTTPS on Your Landing Page Is Important

#32

Post by tachion »

I'm not really surprised, UK banks are absolutely terrible in terms of their product and even worse in supporting clients having valid points. Another example would be MetroBank that recently changed password prompt to a masked password prompt (in addition to already existing masked PIN alongside) ignoring the research proving its a horrible user experience and in fact lowers the security or (not a bank, but still major company) Three mobile provider that asks your for your password while calling in for support. You heard it right, support representative asks you for your password to verify you are the account holder. There is no other way and no amount of explaining that it's insane and won't happen till I'm conscious was able to convince them to stop.

Re: HTTPS on Your Landing Page Is Important

#34

Post by choward »

bribroder wrote: post #17

So more specifically, HTTPS on pages where you log in is important, not necessarily on your landing / homepage? I am not disputing that may be a good idea, but it seems like the main complaint is that users are submitting credentials on an HTTP page?

Not to be a dick, but did you even read the article? Is the video what confused you? He's showing that he changed the homepage to link to a login page that he controlled.

Re: HTTPS on Your Landing Page Is Important

#35

Post by quickthrower2 »

freeflight wrote: post #27

That edit, about NatWest buying up the example domain to "fix" the problem, gave me real good laugh. It's interesting how simple mindedness can be so unexpectedly expected.

Actually that is a smart thing to do in it's own right, as long as they quickly move to https.

Re: HTTPS on Your Landing Page Is Important

#36

Post by blakesterz »

kaycebasques wrote: post #33

A great example for why we (the Google Web Developer Relations team) advocate for HTTPS everywhere. https://developers.google.com/web/fundamentals/security/encr...

Why is it you (or someone there) chose "Secure" in the address bar rather than something like "Private"? It seems like the people who don't understand what httpS means at all see "Secure" and think "oh this site is safe/secure" no matter what this site is, like if it's a phishing site. I'm not one to be very pedantic, but "Secure" up there really doesn't mean "Secure" at all. I know what it means, but people falling for dangerous sites don't get that at all. I don't really know what the best word is, but "Secure" seems like not the best choice there.

[Edit] Thank you to those people who had some honest replies, not sure why this got down voted, it was an honest question. When you go to the "Learn More" page on Chrome it doesn't even say "Secure" it says "Information you send or get through the site is private."

Re: HTTPS on Your Landing Page Is Important

#37

Post by tolien »

tachion wrote: post #32

I'm not really surprised, UK banks are absolutely terrible in terms of their product and even worse in supporting clients having valid points. Another example would be MetroBank that recently changed password prompt to a masked password prompt (in addition to already existing masked PIN alongside) ignoring the research proving its a horrible user experience and in fact lowers the security or (not a bank, but still ma…

> Three mobile provider that asks your for your password while calling in for support

When I got a new nano-SIM (in 2012, one hopes they've changed this since), they didn't check any ID and only needed a postcode and date of birth to move my account to a new SIM.

Re: HTTPS on Your Landing Page Is Important

#38

Post by pmelendez »

i80and wrote: post #19
bribroder wrote: post #17

So more specifically, HTTPS on pages where you log in is important, not necessarily on your landing / homepage? I am not disputing that may be a good idea, but it seems like the main complaint is that users are submitting credentials on an HTTP page?

This is exactly the opposite of what the article states. The HTTP landing page serves a link to the login page. This link could be modified by a hostile network to another site. The fact that the login page is served over HTTPS is immaterial for this attack.

Honest question...

Under that attack, wouldn't be the same whether you are using https or not? If you are in a hostile network with a compromised DNS, Couldn't the domain be phished too? Meaning that a valid certificate trusted by a fake CA would be used by the browser?

Re: HTTPS on Your Landing Page Is Important

#39

Post by QAPereo »

ethbro wrote: post #24
konschubert wrote: post #13

That feeling when you're arguing with an idiot, and the idiot isn't listening because he thinks it's YOU who's missing the point.

The important thing for all of us to remember, is that in any given conversation we may be idiot. Until I'm sure the other person doesn't know what they're talking about, I try and assume they're right.

The problem is that for all of the stereotypes to the contrary, tech is really full of people who worry, "Am I wrong? Am I the idiot?" Banks clearly don't attract the same kind of person, with the same intellectual gifts and challenges. Your advice is great, but it's probably already being taken to a fault by people like Troy Hunt, and people like the goober on the other end of the line think Dunning-Kruger is a brand of champagne.

Re: HTTPS on Your Landing Page Is Important

#40

Post by msla »

ethbro wrote: post #24
konschubert wrote: post #13

That feeling when you're arguing with an idiot, and the idiot isn't listening because he thinks it's YOU who's missing the point.

The important thing for all of us to remember, is that in any given conversation we may be idiot. Until I'm sure the other person doesn't know what they're talking about, I try and assume they're right.

The most important scientific mindset is being willing and able to prove yourself wrong.

It's an important legal mindset, too, because it's an important mindset for any honest debater: You prepare an argument by attacking it, and trying your damndest to be the best argument for the opposition you can possibly be.

That's important in moral issues, where there arguably is no "right answer" to certain questions, but it's vital when things come down to factual questions where one position is right, any other position is wrong, and being able to recognize when you're holding a position which is wrong is vital to being honest, not only with others but with yourself.

Post reply on HN