41–50 of 307 posts
The thing about domains is that so many companies register companyname-someotherwords.com for legitimate use that if you are suspicious about the domain name you'll get little done. Azure is a case in point.
What if browsers record "tainted follows"? E.g. you visit http. Once you click a link, anything linked from there onwards is not trusted. No http post information is sent to the server without a hard to get around warning page.
Microsoft is another major offender. When logging in, I get redirected 20 times between various domains, none of which in microsoft.com
Maybe someday browsers won't accept http connections by default (except for a few domaines defined for test purpose, or for some specific tld like .local) Only then we can have 100% of the web encrypted.
I mean, take this case; lets say NatWest DID put their landing page behind SSL... well, lots of people are going to try to go to " rel="nofollow">http:// instead of " rel="nofollow">https://. Most site will redirect the user to the https version, but if an attacker hijacks the initial request, they could easily serve up a fake version of the landing page that has a 'login' link to the malicious site.
Now, at least if NatWest was redirecting http to https, a savvy user could notice that their session wasn't being redirected to https and could be aware something was wrong, but if you didn't know to check, you could be fooled.
There is nothing the site owner can do to prevent that sort of hijacking.
A great example for why we (the Google Web Developer Relations team) advocate for HTTPS everywhere. https://developers.google.com/web/fundamentals/security/encr...
Why is it you (or someone there) chose "Secure" in the address bar rather than something like "Private"? It seems like the people who don't understand what httpS means at all see "Secure" and think "oh this site is safe/secure" no matter what this site is, like if it's a phishing site. I'm not one to be very pedantic, but "Secure" up there really doesn't mean "Secure" at all. I know what it means, but people falling…
That feeling when you're arguing with an idiot, and the idiot isn't listening because he thinks it's YOU who's missing the point.
I'm not really surprised, UK banks are absolutely terrible in terms of their product and even worse in supporting clients having valid points. Another example would be MetroBank that recently changed password prompt to a masked password prompt (in addition to already existing masked PIN alongside) ignoring the research proving its a horrible user experience and in fact lowers the security or (not a bank, but still ma…
A great example for why we (the Google Web Developer Relations team) advocate for HTTPS everywhere. https://developers.google.com/web/fundamentals/security/encr...
Why is it you (or someone there) chose "Secure" in the address bar rather than something like "Private"? It seems like the people who don't understand what httpS means at all see "Secure" and think "oh this site is safe/secure" no matter what this site is, like if it's a phishing site. I'm not one to be very pedantic, but "Secure" up there really doesn't mean "Secure" at all. I know what it means, but people falling…
Maybe someday browsers won't accept http connections by default (except for a few domaines defined for test purpose, or for some specific tld like .local) Only then we can have 100% of the web encrypted.
Yeah, until that happens we won't ever be really secure. I mean, take this case; lets say NatWest DID put their landing page behind SSL... well, lots of people are going to try to go to " rel="nofollow">http:// instead of " rel="nofollow">https:// . Most site will redirect the user to the https version, but if an attacker hijacks the initial request, they could easily serve up a fake version of the landing page that…
It doesn't seem to matter to me if my ISP is MITM, because someone inside the ISP would need to cause that. If my ISP is forced to MITM by government etc, I am in trouble anyway.
I could see that it could be done by using a bad/spoofed wireless or a public network connection somewhere. That makes sense. I don't do that though; I only use my own secure home network in a wired fashion when accessing my bank account.
If people are able to spoof my network connection, they could interfere with non-https software updates on my machine, which would let them replace the root certs of my browser potentially, in which case https wouldn't matter. Is the assumption here that all software updates on my machine are happening via https and only the bank website is a danger?
My point here is that while I agree what the bank is doing is bad practice, I don't see how it would affect me in any way.
A great example for why we (the Google Web Developer Relations team) advocate for HTTPS everywhere. https://developers.google.com/web/fundamentals/security/encr...
Why is it you (or someone there) chose "Secure" in the address bar rather than something like "Private"? It seems like the people who don't understand what httpS means at all see "Secure" and think "oh this site is safe/secure" no matter what this site is, like if it's a phishing site. I'm not one to be very pedantic, but "Secure" up there really doesn't mean "Secure" at all. I know what it means, but people falling…
"secure" means "secure connection" to me, and it sounds perfectly appropriate. Maybe you can't find a better term for "secure" because it's perfectly fine, already..?