That edit, about NatWest buying up the example domain to "fix" the problem, gave me real good laugh. It's interesting how simple mindedness can be so unexpectedly expected.
Yep. I laughed out loud in an empty room at that one.
HTTPS on Your Landing Page Is Important
121–130 of 307 posts
Re: HTTPS on Your Landing Page Is Important
#122Earlier quoted context omitted.
Words are hard. Anyone got an idea for a better word? Send your ideas to the security-dev mailing list (at least, I think that's the best forum...): https://groups.google.com/a/chromium.org/forum/#!forum/secur...
How about all it really means? "Encrypted"
ESL, myself, but I wouldn't know if Encrypted makes a lot of sense for non-technical users?
Re: HTTPS on Your Landing Page Is Important
#123Another lesson is to always host the login section on a sub domain of the company which website you visit. A prime example not to follow is Citibank in Europe. My account is with citibank.co.uk, but when I login to my account I get redirected to online.citi.eu. How do I know that citi.eu belongs to Citibank? I have no relationship with citi.eu, that’s not the website I visited. How do I know I can trust it? Microsoft…
Microsoft's sign in is a real mess, I think in part due to having to make your hotmail login that you made 15 years ago still work, along with the dozens of other services that MS has acquired or integrated.
I've had a real shitter of a time trying to login before, with redirect loops, or getting automatically signed out as soon as I sign in. Or accounts being a "games for Windows" account, but not an MS account, or an Xbox live account, so some other account. Often I've just found it easier to give up and make a new account.
Re: HTTPS on Your Landing Page Is Important
#124It's 2017, and my social media account is protected by a tamper-proof phish-resistant embedded-encryption U2F microcontroller dongle, in addition to a password of virtually unlimited length and charset. Meanwhile, my bank has a max password length of 12 and I can only use an alphabet of roughly 64 characters. The future is here folks. And it sucks.
BMO in Canada forces 6 digits or alphanumerics as your account password. No more, no less. What's worse, because it can be entered on the phone, aAbBcC are all == 1. So it's really just 6 digits.
Somewhere, in the background, there's a poor old unix mainframe running Cobol, unaware that the world around it has changed, and that it should put to pasture, where it can live out the rest of its days in peace.
Re: HTTPS on Your Landing Page Is Important
#125Earlier quoted context omitted.
And it's so easy for anyone nowadays to get SSL with Let's Encrypt... I remember a few years ago when there was no way you could do it for side projects because certs were 100/yr., now they're free.
It is not easy if you are on a shared domain and it is not supported by your host. Please don't run around saying it is easy for everyone.
If you're on a host that doesn't support HTTPS, you should probably find a different one.
Re: HTTPS on Your Landing Page Is Important
#126About 8 years ago Natwest had a policy of having a "browser whitelist" which was rarely updated. Each time a security update for chrome or firefox came out it would be 2 weeks before online banking was accessible, and using any pre-release versions were out of the question. I complained and a member of the dev team phoned me up and after a long discussion about why this was madness he told me that it was better to us…
Reminiscent of Amex's password policy (at least what it was a few years ago): can't use punctuation in your password, because those keys are less frequently used, and using them frequently in passwords will cause visible wear on the keys, indicating to an attacker with physical access to your keyboard which punctuation characters are in your password. Trying so hard, but failing so badly.
"we require passwords to be a maximum of 8 characters, because if they were longer, people would forget them, and would have to write them down"
I'm sure that has been said by some manager somewhere.
Re: HTTPS on Your Landing Page Is Important
#127Earlier quoted context omitted.
This is exactly the opposite of what the article states. The HTTP landing page serves a link to the login page. This link could be modified by a hostile network to another site. The fact that the login page is served over HTTPS is immaterial for this attack.
Honest question... Under that attack, wouldn't be the same whether you are using https or not? If you are in a hostile network with a compromised DNS, Couldn't the domain be phished too? Meaning that a valid certificate trusted by a fake CA would be used by the browser?
No, the whole point of TLS is that you don't have to trust the network. At all.
Re: HTTPS on Your Landing Page Is Important
#128Earlier quoted context omitted.
> valid certificate trusted by a fake CA I don't think that's possible. A fake CA can't issue out valid certificates because you wouldn't trust their certs to begin with -- it's all about trust and if you know they are a fake CA, then you would never trust them or anything they issue. It's like if a known counterfeiter claims to be selling legit products, you probably wouldn't trust them.
A compromised, but legitimate CA is a vector of attack in this case. Any CA can be compromised by nation-states through legal coercion, and all of them probably have some vulnerabilities that have yet to be found. There are also new CAs that are not yet trusted, and sometimes old ones that are on their way to being delisted. So you need an up-to-date list of trusted CAs (which most of us are relying on google for, in…
Which is why certrificate transparency is coming, so those will be distrusted ASAP.
Re: HTTPS on Your Landing Page Is Important
#129Probably not a good person to piss off. Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox shouldn’t tell users it’s insecure. Within hours his database was pwned.
Isn't (not) needing HTTPs kind of unrelated to your database being pwned though?
The person who owned the website said this:
> We have our own security system, and it has never been breached in more than 15 years.
Which leads me to believe that their system was built by scratch, in PHP, 15 years ago, and hasn't been updated since.
Re: HTTPS on Your Landing Page Is Important
#130A tweet from Troy Hunt is like a telelphone call from Brian Krebs: a sign your day is not going to get better, if you're a company infosec person.