> Alarmingly though, nw0lb.com is still available as is nuu0lb.com and it-doesnt-matter-because-that-isnt-the-point.com.
I can just imagine NatWest: "Oh, is that the problem? Ah, ok, well, let's just go get that domain then. Sorted!"
HTTPS on Your Landing Page Is Important
131–140 of 307 posts
Re: HTTPS on Your Landing Page Is Important
#132Earlier quoted context omitted.
Do you have any examples of "You might get sued for this"?
There is the horrible example of the nice computer company that had called itself by a certain name. [1] They registered their domain in good faith and conducted business. Later, a multi-million dollar car company decided they wanted the domain for the name they choose after Datsun and lawyered up on the mom-and-pop computer company. 1: http://nissan.com/
Well they've made the most of their situation by putting ads on the page.
I can also get "complex web design" for $100 per hour from them. Judging by the quality of that site, I might pass.
Re: HTTPS on Your Landing Page Is Important
#133Earlier quoted context omitted.
What is the business reasoning behind this kind of domain name silliness?
I assume one team is responsible for the home page, and another team is responsible for the banking portal, and they can't be bothered to coordinate with each other.
True true true. I know of some banks where invest.examplebank.com and bank.examplebank.com are controlled by mutually distrustful organizations. They really should put their stuff into the public suffix list at https://publicsuffix.org/, because, session cookies. But that would assume they knew something about what they were doing.
Re: HTTPS on Your Landing Page Is Important
#134Earlier quoted context omitted.
Actually that is a smart thing to do in it's own right, as long as they quickly move to https.
Not even predicated on HTTPS; owning more domains helps combat some obvious forms of fraud. Though, really, I agree that HTTPS is more important.
> Not even predicated on HTTPS
Sorry that's what I meant. Both moves are smart. Doing both is smartest.
Re: HTTPS on Your Landing Page Is Important
#135Earlier quoted context omitted.
I assume one team is responsible for the home page, and another team is responsible for the banking portal, and they can't be bothered to coordinate with each other.
I agree. There is no technical reason behind this sort of bollocks. One day S&M will catch up and have a fit at the fragmented "front face" - quite right too. To be honest the board should also give a shit about their org's outward appearance. Bit of a fail all 'round, really.
[deleted]
Re: HTTPS on Your Landing Page Is Important
#136Earlier quoted context omitted.
There are plenty of people accessing their banks on public / insecure networks; it’s folly to assume that MITM attacks just can’t happen. You yourself might not be at risk, but you’re not the only person out there. The assumption is that yes, all of your machine’s updates are served over HTTPS. If they weren’t, then of course you’re right - it’d be possible to hijack your machine by serving malicious binaries. That’d…
I stated specifically that I agree it is bad in situations where you could be MITM. I also agree many people do that. My question here is only how it could effect me or people who follow the practice I follow.
Your assumption that there is such a thing as a "secure network" is foolish. ISPs inject vulnerable javascript into pages, ISPs have vulnerable routers, ISPs have bad passwords on their devices, ISPs have criminals on staff, ISPs run traffic through unencrypted microwave links that anyone close to the beam can listen in to, ISPs have devices running in remote locations, ... and your traffic is going to run through who knows how many ISPs, possibly even through other countries, ... in short, it simply doesn't make sense to build anything on the assumption that the network is secure.
Re: HTTPS on Your Landing Page Is Important
#137Re: HTTPS on Your Landing Page Is Important
#138Another lesson is to always host the login section on a sub domain of the company which website you visit. A prime example not to follow is Citibank in Europe. My account is with citibank.co.uk, but when I login to my account I get redirected to online.citi.eu. How do I know that citi.eu belongs to Citibank? I have no relationship with citi.eu, that’s not the website I visited. How do I know I can trust it? Microsoft…
My citibank credit card redirects me to "cardservicesdirect.com.au" -- which reads like a phishing site if I've ever seen one.
I confirmed over the phone with their support that was indeed the correct site before typing anything into it.
Re: HTTPS on Your Landing Page Is Important
#139Probably not a good person to piss off. Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox shouldn’t tell users it’s insecure. Within hours his database was pwned.
No Troy and co do not work like that - per se. What is most likely is that someone noticed the public discussion and took advantage. I see where you are coming from but the fix was easy and wasting time whining about being called out on rubbish practice was the wrong response. Besides, if the DB was pwned, it is unlikely that http -> https would have any real bearing anyway. There was probably a XSS exploit or whatev…
I think in this case it's some kind of a broken window theory.
If you don't think HTTPS is important you're probably not worried about SQL injection either.
Re: HTTPS on Your Landing Page Is Important
#140It's 2017, and my social media account is protected by a tamper-proof phish-resistant embedded-encryption U2F microcontroller dongle, in addition to a password of virtually unlimited length and charset. Meanwhile, my bank has a max password length of 12 and I can only use an alphabet of roughly 64 characters. The future is here folks. And it sucks.
BMO in Canada forces 6 digits or alphanumerics as your account password. No more, no less. What's worse, because it can be entered on the phone, aAbBcC are all == 1. So it's really just 6 digits.
To be fair though, at least they offer the guarantee that if your online banking is hacked they will reimburse 100%. Though not sure how truthful it is having never needed it.
https://i.imgur.com/O2eOwLw.jpg
Edit:
"You may be liable for all losses from unauthorized use of your Account if you:
contributed to its unauthorized use; used a PIN combination selected from your name, telephone number, date of birth, address, or Social Insurance Number; did not use reasonable care to safeguard your Secret ID Code; did not keep your Secret ID Code separate from your Card; did not comply with your reporting obligations in Section 11 of this Agreement unless there were exceptional circumstances for your failure to do so; or shared a mobile device that you registered with us for Electronic Banking Services. In those cases, your liability may exceed the funds in an Account, your credit limit or any daily transaction limits. In other words, your liability will not be limited by your Account balance, your credit limit or any daily transaction limits. You must cooperate and assist in any investigation that we initiate into the unauthorized use you reported, which is a precondition to being reimbursed for any losses. This cooperation may include filing a report with law enforcement authorities."
Overall seems fair enough protection.