Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS on Your Landing Page Is Important

troyhunt.com

Post reply on HN
Print view View original

141–150 of 307 posts

Re: HTTPS on Your Landing Page Is Important

#141

Post by pfg »

yjftsjthsd-h wrote: post #101
rocqua wrote: post #94

Earlier quoted context omitted.

You need to get to global DNS to get a valid cert. When certificate transparency logs become mandatory, that case will be detectable though not preventable.

Surely good enough detection is just one step from prevention? Detect fraudulent cert, revoke it. Or have I missed a layer?

Certainly, but depending on the type of attack, that might not be of much use. In a targeted attack, the damage might already be done by the time the certificate is detected. Additionally, revocation as a whole is broken in various ways[1], not to mention that even with hard-fail revocation checking[2], you have a window of several days during which you can staple a "good" OCSP response, from before the certificate was revoked. (The exact lifetime is up to the CA - I think the maximum allowed is 7 or 10 days.)

CT, as currently implemented, is good at two things: Detecting misbehaving CAs, and detecting certificates issued by attackers after a server is compromised or domain is hijacked, assuming the domain owner is monitoring logs for such certificates. The Web PKI does not provide many tools that actually mitigate damage for the second scenario (unless you've deployed HPKP, which is on its way out).

[1]: https://www.imperialviolet.org/2014/04/29/revocationagain.ht...

[2]: Practically no mainstream browser uses hard-failing OCSP. Firefox supports the X.509 Must-Staple extension, which enables hard-failing OCSP, but Must-Staple has a glaring hole: If the attacker gains the ability to issue a certificate for the targeted domain, they can simply request a certificate without the Must-Staple extension. Must-Staple's usefulness is mostly limited to key-compromise scenarios.

Re: HTTPS on Your Landing Page Is Important

#142

Post by [deleted] »

mattmanser wrote: post #77
cm2187 wrote: post #42

Another lesson is to always host the login section on a sub domain of the company which website you visit. A prime example not to follow is Citibank in Europe. My account is with citibank.co.uk, but when I login to my account I get redirected to online.citi.eu. How do I know that citi.eu belongs to Citibank? I have no relationship with citi.eu, that’s not the website I visited. How do I know I can trust it? Microsoft…

Ugh, MS just seem to get worse too, "Try our new login experience, it logs you out every 15 minutes, so much fun!".

[deleted]

Re: HTTPS on Your Landing Page Is Important

#143

Post by SAI_Peregrinus »

toomanybeersies wrote: post #129
CoryG89 wrote: post #115

Earlier quoted context omitted.

Isn't (not) needing HTTPs kind of unrelated to your database being pwned though?

The person who owned the website said this: > We have our own security system, and it has never been breached in more than 15 years. Which leads me to believe that their system was built by scratch, in PHP, 15 years ago, and hasn't been updated since.

And that they have no monitoring to detect breaches.

Re: HTTPS on Your Landing Page Is Important

#145

Post by chrisparton1991 »

toomanybeersies wrote: post #123
cm2187 wrote: post #42

Another lesson is to always host the login section on a sub domain of the company which website you visit. A prime example not to follow is Citibank in Europe. My account is with citibank.co.uk, but when I login to my account I get redirected to online.citi.eu. How do I know that citi.eu belongs to Citibank? I have no relationship with citi.eu, that’s not the website I visited. How do I know I can trust it? Microsoft…

Microsoft's sign in is a real mess, I think in part due to having to make your hotmail login that you made 15 years ago still work, along with the dozens of other services that MS has acquired or integrated. I've had a real shitter of a time trying to login before, with redirect loops, or getting automatically signed out as soon as I sign in. Or accounts being a "games for Windows" account, but not an MS account, or…

I hear you.

I was pulling my hair out the other day trying to find my Microsoft credentials in LastPass. I was searching for "microsoft", "office", "outlook" etc. until I finally found them under "live.com".

Re: HTTPS on Your Landing Page Is Important

#146

Post by jacinabox »

I followed out this logic, and concluded that all pages on a site have to be encrypted, because someone may try to navigate to the login page from any page on the site. If the attacker can intercept one page they can lead the user to their own site (possibly even HTTPS, but with the wrong certificate). In a perfect worlds users would always check which certificate they're trusting (and have a plausible way to check who it belongs to) but that is not the real world.

Re: HTTPS on Your Landing Page Is Important

#147

Post by kuon »

I think the main point is to explain this kind of issue to non tech people.

A bit of programming, but most importantly, general concepts required to understand this kind of issue should be common knowledge.

For me it falls in the same category as the people putting an IP camera to watch their son sleep and broadcasting it to the whole internet. This kind of issue should be understood by them.

In this case, if the "banking manager" was aware of how security works, the issue would not have presented itself in the first place.

Re: HTTPS on Your Landing Page Is Important

#148

Post by alvah »

peterkelly wrote: post #125
megy wrote: post #103

Earlier quoted context omitted.

It is not easy if you are on a shared domain and it is not supported by your host. Please don't run around saying it is easy for everyone.

If you're on a host that doesn't support HTTPS, you should probably find a different one.

Hostgator, to give one fairly large example, does support HTTPS, but only their expensive option, not Lets Encrypt.

Re: HTTPS on Your Landing Page Is Important

#149

Post by jjeaff »

cm2187 wrote: post #42

Another lesson is to always host the login section on a sub domain of the company which website you visit. A prime example not to follow is Citibank in Europe. My account is with citibank.co.uk, but when I login to my account I get redirected to online.citi.eu. How do I know that citi.eu belongs to Citibank? I have no relationship with citi.eu, that’s not the website I visited. How do I know I can trust it? Microsoft…

One of the worst I've seen is Franklin Templeton. They sent out snail mail telling everyone to go to a URL like "accountservices.biz" and reenter private information like your social security number in order to update your account records.

The site itself is branded just like Templeton's own site. From what I could gather, it is actually their site but even the whois is something non descript. Quite ridiculous. And of course they don't have any way whatsoever that I could find to report things like vulnerabilities or phishing attempts.

Re: HTTPS on Your Landing Page Is Important

#150

Post by jjeaff »

exabrial wrote: post #85

It's 2017, and my social media account is protected by a tamper-proof phish-resistant embedded-encryption U2F microcontroller dongle, in addition to a password of virtually unlimited length and charset. Meanwhile, my bank has a max password length of 12 and I can only use an alphabet of roughly 64 characters. The future is here folks. And it sucks.

My bank only recently upgraded max password length from 8 to 12. Oh, and no special characters please.
Post reply on HN