Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS on Your Landing Page Is Important

troyhunt.com

Post reply on HN
Print view View original

71–80 of 307 posts

Re: HTTPS on Your Landing Page Is Important

#71

Post by drspacemonkey »

nanoscopic wrote: post #66
leesalminen wrote: post #14

Probably not a good person to piss off. Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox shouldn’t tell users it’s insecure. Within hours his database was pwned.

Are you suggesting that Troy Hunt is involved in illegal pentesting ( pwning their db )? I really doubt that. He is an industry professional. The problem is not pissing off Troy Hunt; but more that they are advertising that their website is vulnerable and that they don't care.

I think it was more that Troy Hunt is incredibly high-profile in the security arena. If he blogs that your site security sucks, some of his readers will prove it.

Re: HTTPS on Your Landing Page Is Important

#72

Post by swsieber »

nanoscopic wrote: post #66
leesalminen wrote: post #14

Probably not a good person to piss off. Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox shouldn’t tell users it’s insecure. Within hours his database was pwned.

Are you suggesting that Troy Hunt is involved in illegal pentesting ( pwning their db )? I really doubt that. He is an industry professional. The problem is not pissing off Troy Hunt; but more that they are advertising that their website is vulnerable and that they don't care.

I took as more of a "if troy is pissed at someone, then everyone knows the person he's pissed at is hackable" statement.

Re: HTTPS on Your Landing Page Is Important

#73

Post by nerdponx »

cdancette wrote: post #12

Maybe someday browsers won't accept http connections by default (except for a few domaines defined for test purpose, or for some specific tld like .local) Only then we can have 100% of the web encrypted.

At that point, will we start seeing attackers targeting DNS instead?

Re: HTTPS on Your Landing Page Is Important

#74

Post by johnsoft »

nerdponx wrote: post #67
iaw wrote: post #59

Earlier quoted context omitted.

Citi has some really bad security practices, when I talked with them about it they mentioned some future changes they were planning that were even worse.

What is the business reasoning behind this kind of domain name silliness?

I assume one team is responsible for the home page, and another team is responsible for the banking portal, and they can't be bothered to coordinate with each other.

Re: HTTPS on Your Landing Page Is Important

#75

Post by zodPod »

ivanbakel wrote: post #28

>you could go register nuuolb.com right now Not anymore! https://www.whois.com/whois/nuuolb.com It seems NatWest has quickly gone to secure this major attack point in their otherwise chink-free armour. Does someone want to inform them about nwalb.com as well?

Gives me an idea! Why not go buy up a bunch of these types of names then tell them that they look similar to their login url. THEN when they come to try to buy it they find you own it and then charge them an arm and a leg for the domain?!

Re: HTTPS on Your Landing Page Is Important

#76

Post by ashelmire »

wayfarer2s wrote: post #52
pmelendez wrote: post #38

Earlier quoted context omitted.

Honest question... Under that attack, wouldn't be the same whether you are using https or not? If you are in a hostile network with a compromised DNS, Couldn't the domain be phished too? Meaning that a valid certificate trusted by a fake CA would be used by the browser?

> valid certificate trusted by a fake CA I don't think that's possible. A fake CA can't issue out valid certificates because you wouldn't trust their certs to begin with -- it's all about trust and if you know they are a fake CA, then you would never trust them or anything they issue. It's like if a known counterfeiter claims to be selling legit products, you probably wouldn't trust them.

A compromised, but legitimate CA is a vector of attack in this case. Any CA can be compromised by nation-states through legal coercion, and all of them probably have some vulnerabilities that have yet to be found. There are also new CAs that are not yet trusted, and sometimes old ones that are on their way to being delisted.

So you need an up-to-date list of trusted CAs (which most of us are relying on google for, in this case), which means trusting google at the very least (a company that compiles and sells your data, and is also based in a nation that issues secret warrants and orders to tech companies). It would be pretty surprising if this wasn't already a vector of attack being actively used (the fact that a trusted list needs to be maintained suggests that it is).

Re: HTTPS on Your Landing Page Is Important

#77

Post by mattmanser »

cm2187 wrote: post #42

Another lesson is to always host the login section on a sub domain of the company which website you visit. A prime example not to follow is Citibank in Europe. My account is with citibank.co.uk, but when I login to my account I get redirected to online.citi.eu. How do I know that citi.eu belongs to Citibank? I have no relationship with citi.eu, that’s not the website I visited. How do I know I can trust it? Microsoft…

Ugh, MS just seem to get worse too, "Try our new login experience, it logs you out every 15 minutes, so much fun!".

Re: HTTPS on Your Landing Page Is Important

#78

Post by wepple »

cm2187 wrote: post #42

Another lesson is to always host the login section on a sub domain of the company which website you visit. A prime example not to follow is Citibank in Europe. My account is with citibank.co.uk, but when I login to my account I get redirected to online.citi.eu. How do I know that citi.eu belongs to Citibank? I have no relationship with citi.eu, that’s not the website I visited. How do I know I can trust it? Microsoft…

I was looking up details of the new Microsoft Surface recently, so hit the top link in a google search which was (supposedly) on Microsoft.com

It wouldn’t load because Facebook.com was blocked and apparently they were doing a full redirect via fb. Crazy.

Re: HTTPS on Your Landing Page Is Important

#79

Post by biggio »

nanoscopic wrote: post #62
jackweirdy wrote: post #54

Earlier quoted context omitted.

Don't think about _you_, think about the layman. Who probably has a WiFi router from 5 years ago with outdated firmware that their ISP can't be bothered patching.

The layman clicks on links that say "you have a virus; download this tool to remove it". They then click 'Yes I authorize' to verify that the downloaded program should be allowed to corrupt their machine. I fail to see how the bank changing their website to HTTPS is going to save the average Joe. There are so many websites and things that operate over HTTP that make our machines vulnerable, that I think it is foolish…

With the layman example, you are describing man in the browser attack. It doesn't matter if you use wireless or not.

Re: HTTPS on Your Landing Page Is Important

#80

Post by wepple »

paulddraper wrote: post #2

Troy is way overstating the case. You want to know if the login page is NatWest? Click on the Login link and look at the browsers security bar. If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great. It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution. It seems far mor…

Most users check the URL when they first browse to a page.

You want them to continuously keep verifying it’s the correct domain/cert just because this company is too lazy/cheap to buy a cert?

Post reply on HN