Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS on Your Landing Page Is Important

troyhunt.com

Post reply on HN
Print view View original

61–70 of 307 posts

Re: HTTPS on Your Landing Page Is Important

#61

Post by cortesoft »

londons_explore wrote: post #48
cortesoft wrote: post #43

Earlier quoted context omitted.

Yeah, until that happens we won't ever be really secure. I mean, take this case; lets say NatWest DID put their landing page behind SSL... well, lots of people are going to try to go to " rel="nofollow">http:// instead of " rel="nofollow">https:// . Most site will redirect the user to the https version, but if an attacker hijacks the initial request, they could easily serve up a fake version of the landing page that…

HSTS Preloading solves that problem.

Huh, didn't know about that. Glad to see.

Re: HTTPS on Your Landing Page Is Important

#62

Post by nanoscopic »

jackweirdy wrote: post #54
nanoscopic wrote: post #49

What is the exact problem here? Who would be doing a MITM attack on someone and how? It doesn't seem to matter to me if my ISP is MITM, because someone inside the ISP would need to cause that. If my ISP is forced to MITM by government etc, I am in trouble anyway. I could see that it could be done by using a bad/spoofed wireless or a public network connection somewhere. That makes sense. I don't do that though; I only…

Don't think about _you_, think about the layman. Who probably has a WiFi router from 5 years ago with outdated firmware that their ISP can't be bothered patching.

The layman clicks on links that say "you have a virus; download this tool to remove it". They then click 'Yes I authorize' to verify that the downloaded program should be allowed to corrupt their machine.

I fail to see how the bank changing their website to HTTPS is going to save the average Joe.

There are so many websites and things that operate over HTTP that make our machines vulnerable, that I think it is foolishness to use a link that could be MITM to begin with.

That is, it seems to me, that if you simply avoid ever using wireless there is no danger of MITM. I could see that XSS could be done on some sites with ads, and that would be worsened by lack of HTTP.

Is it as simple as "Don't use wifi. Use adblock. HTTP/HTTPS then no longer matters." ?

Re: HTTPS on Your Landing Page Is Important

#63

Post by [deleted] »

nanoscopic wrote: post #49

What is the exact problem here? Who would be doing a MITM attack on someone and how? It doesn't seem to matter to me if my ISP is MITM, because someone inside the ISP would need to cause that. If my ISP is forced to MITM by government etc, I am in trouble anyway. I could see that it could be done by using a bad/spoofed wireless or a public network connection somewhere. That makes sense. I don't do that though; I only…

[deleted]

Re: HTTPS on Your Landing Page Is Important

#64

Post by JepZ »

Well, the bank seems to be stuck in the past...

10 years ago it was best practice for ecommerce shops to serve non sensitive pages (pages without forms or user data) without HTTPS to reduce the server load (HTTPS connections are a little more expensive than HTTP).

Nowadays, even the economical driven ecommerce shops got it that is better to just serve everything via HTTPS. It is very sad to see a bank (which should really know better) arguing that way.

Re: HTTPS on Your Landing Page Is Important

#65

Post by 4rt »

About 8 years ago Natwest had a policy of having a "browser whitelist" which was rarely updated. Each time a security update for chrome or firefox came out it would be 2 weeks before online banking was accessible, and using any pre-release versions were out of the question.

I complained and a member of the dev team phoned me up and after a long discussion about why this was madness he told me that it was better to use older browsers for important things such as online banking (like IE6 which was in their whitelist) because they're tried and tested.

Re: HTTPS on Your Landing Page Is Important

#66

Post by nanoscopic »

leesalminen wrote: post #14

Probably not a good person to piss off. Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox shouldn’t tell users it’s insecure. Within hours his database was pwned.

Are you suggesting that Troy Hunt is involved in illegal pentesting ( pwning their db )? I really doubt that. He is an industry professional.

The problem is not pissing off Troy Hunt; but more that they are advertising that their website is vulnerable and that they don't care.

Re: HTTPS on Your Landing Page Is Important

#67

Post by nerdponx »

iaw wrote: post #59
cm2187 wrote: post #42

Another lesson is to always host the login section on a sub domain of the company which website you visit. A prime example not to follow is Citibank in Europe. My account is with citibank.co.uk, but when I login to my account I get redirected to online.citi.eu. How do I know that citi.eu belongs to Citibank? I have no relationship with citi.eu, that’s not the website I visited. How do I know I can trust it? Microsoft…

Citi has some really bad security practices, when I talked with them about it they mentioned some future changes they were planning that were even worse.

What is the business reasoning behind this kind of domain name silliness?

Re: HTTPS on Your Landing Page Is Important

#68

Post by adenta »

4rt wrote: post #65

About 8 years ago Natwest had a policy of having a "browser whitelist" which was rarely updated. Each time a security update for chrome or firefox came out it would be 2 weeks before online banking was accessible, and using any pre-release versions were out of the question. I complained and a member of the dev team phoned me up and after a long discussion about why this was madness he told me that it was better to us…

When I worked for Chase on their main app, the policy for support was the current version of the browser, minus one.

Re: HTTPS on Your Landing Page Is Important

#69

Post by sundvor »

leesalminen wrote: post #14

Probably not a good person to piss off. Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox shouldn’t tell users it’s insecure. Within hours his database was pwned.

The funny thing is, checking their web site they still haven't managed to secure their landing page. You'd think they'd get the message when everyone's just laughing at them...

Re: HTTPS on Your Landing Page Is Important

#70

Post by untog »

f2n wrote: post #55
WorldMaker wrote: post #31

Earlier quoted context omitted.

There were a lot of complaints about Google doing that with .dev given the number of other companies and developers that use .dev for random LAN things, but an HSTS Preload for random LAN things isn't a bad idea in that it can prevent some types of mistakes going to production like bad HTTPS->HTTP redirects in an application. Obviously, Google themselves thought it a good idea to test that in their development enviro…

The people doing random things with fake .dev domains were going to get bit in the ass one way or another. You can't just make up your own domain and hope no one ever does anything conflicting with it.

> You can't just make up your own domain and hope no one ever does anything conflicting with it.

Actually you can! You just need to use one reserved for that purpose:

> In 1999, the Internet Engineering Task Force reserved the DNS labels example, invalid, localhost, and test so that they may not be installed into the root zone of the Domain Name System.

https://en.wikipedia.org/wiki/.test

Post reply on HN