Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS on Your Landing Page Is Important

troyhunt.com

Post reply on HN
Print view View original

151–160 of 307 posts

Re: HTTPS on Your Landing Page Is Important

#151

Post by bigiain »

toomanybeersies wrote: post #124
morinted wrote: post #119

Earlier quoted context omitted.

BMO in Canada forces 6 digits or alphanumerics as your account password. No more, no less. What's worse, because it can be entered on the phone, aAbBcC are all == 1. So it's really just 6 digits.

Somewhere, in the background, there's a poor old unix mainframe running Cobol, unaware that the world around it has changed, and that it should put to pasture, where it can live out the rest of its days in peace.

Worse, it's probably an emulation of a Unix mainframe running the original Cobol code - with the emulator running in machine generated JavaScript in Nodejs on AWS...

(Obligatory xkcd comic: https://xkcd.com/1926/ )

Re: HTTPS on Your Landing Page Is Important

#152

Post by wruza »

toomanybeersies wrote: post #118

A bit side topic: It seems that every time Troy interacts with a company on Twitter, they never seem to click on to who he is, until it's probably too late and they look like fools. It's just so amusing to see companies trying to condescend to Troy, when he's one of the most visible authorities on web security on the planet (not necessarily the most authoritative, but the most well known). I occasionally get this whe…

Authority is a bad thing here, since the person who spoke to him is in a shadow of his own tech team authority. Don’t get me wrong, but if there is an objective security/xyz problem, then it doesn’t matter who’s reporting it and what does he make for a living.

Re: HTTPS on Your Landing Page Is Important

#153

Post by bowmessage »

lionelione43 wrote: post #140
morinted wrote: post #119

Earlier quoted context omitted.

BMO in Canada forces 6 digits or alphanumerics as your account password. No more, no less. What's worse, because it can be entered on the phone, aAbBcC are all == 1. So it's really just 6 digits.

To be fair though, at least they offer the guarantee that if your online banking is hacked they will reimburse 100%. Though not sure how truthful it is having never needed it. https://i.imgur.com/O2eOwLw.jpg Edit: "You may be liable for all losses from unauthorized use of your Account if you: contributed to its unauthorized use; used a PIN combination selected from your name, telephone number, date of birth, address,…

Ok this sounds like a terrible question but how do they stop people from "hacking" themselves...

Re: HTTPS on Your Landing Page Is Important

#154

Post by chc »

OliverJones wrote: post #133
johnsoft wrote: post #74

Earlier quoted context omitted.

I assume one team is responsible for the home page, and another team is responsible for the banking portal, and they can't be bothered to coordinate with each other.

True true true. I know of some banks where invest.examplebank.com and bank.examplebank.com are controlled by mutually distrustful organizations. They really should put their stuff into the public suffix list at https://publicsuffix.org/ , because, session cookies. But that would assume they knew something about what they were doing.

How in the world is listing your corporate domain as a public suffix the most appropriate solution to two of the company's teams not working together?

Re: HTTPS on Your Landing Page Is Important

#155

Post by AgentME »

toomanybeersies wrote: post #123
cm2187 wrote: post #42

Another lesson is to always host the login section on a sub domain of the company which website you visit. A prime example not to follow is Citibank in Europe. My account is with citibank.co.uk, but when I login to my account I get redirected to online.citi.eu. How do I know that citi.eu belongs to Citibank? I have no relationship with citi.eu, that’s not the website I visited. How do I know I can trust it? Microsoft…

Microsoft's sign in is a real mess, I think in part due to having to make your hotmail login that you made 15 years ago still work, along with the dozens of other services that MS has acquired or integrated. I've had a real shitter of a time trying to login before, with redirect loops, or getting automatically signed out as soon as I sign in. Or accounts being a "games for Windows" account, but not an MS account, or…

A ridiculous number of times that I've tried to go to xbox.com while previously signed in, the site redirects me around a bit before dropping me onto a blank page. Ugh.

Re: HTTPS on Your Landing Page Is Important

#156

Post by sunsetMurk »

MiddleEndian wrote: post #120
exabrial wrote: post #85

It's 2017, and my social media account is protected by a tamper-proof phish-resistant embedded-encryption U2F microcontroller dongle, in addition to a password of virtually unlimited length and charset. Meanwhile, my bank has a max password length of 12 and I can only use an alphabet of roughly 64 characters. The future is here folks. And it sucks.

Guess what! If your financial service restricts your password to letters and numbers, it's most likely because they want you to be able to enter your password on the phone. So the passwords 'abc' 'ABC' and '222' are treated as equivalent. Try it out for fun!

that's disgusting :-/

Re: HTTPS on Your Landing Page Is Important

#157

Post by ktta »

MiddleEndian wrote: post #120
exabrial wrote: post #85

It's 2017, and my social media account is protected by a tamper-proof phish-resistant embedded-encryption U2F microcontroller dongle, in addition to a password of virtually unlimited length and charset. Meanwhile, my bank has a max password length of 12 and I can only use an alphabet of roughly 64 characters. The future is here folks. And it sucks.

Guess what! If your financial service restricts your password to letters and numbers, it's most likely because they want you to be able to enter your password on the phone. So the passwords 'abc' 'ABC' and '222' are treated as equivalent. Try it out for fun!

What banks do this? AFAIK, Wells Fargo doesn't care about case-sensitivity but that's it.

Re: HTTPS on Your Landing Page Is Important

#158

Post by AgentME »

lionelione43 wrote: post #140
morinted wrote: post #119

Earlier quoted context omitted.

BMO in Canada forces 6 digits or alphanumerics as your account password. No more, no less. What's worse, because it can be entered on the phone, aAbBcC are all == 1. So it's really just 6 digits.

To be fair though, at least they offer the guarantee that if your online banking is hacked they will reimburse 100%. Though not sure how truthful it is having never needed it. https://i.imgur.com/O2eOwLw.jpg Edit: "You may be liable for all losses from unauthorized use of your Account if you: contributed to its unauthorized use; used a PIN combination selected from your name, telephone number, date of birth, address,…

I think I'd rather risk some money to hacks on an otherwise more secure system than look forward to whatever hellish phone support calls and hoop-jumping I expect I'd have to go through to get charges reversed.

Re: HTTPS on Your Landing Page Is Important

#159

Post by [deleted] »

berbec wrote: post #112
npgatech wrote: post #88

Earlier quoted context omitted.

Do you have any examples of "You might get sued for this"?

There is the horrible example of the nice computer company that had called itself by a certain name. [1] They registered their domain in good faith and conducted business. Later, a multi-million dollar car company decided they wanted the domain for the name they choose after Datsun and lawyered up on the mom-and-pop computer company. 1: http://nissan.com/

[deleted]

Re: HTTPS on Your Landing Page Is Important

#160

Post by SAI_Peregrinus »

yjftsjthsd-h wrote: post #102
palencharizard wrote: post #87

it-doesnt-matter-because-that-isnt-the-point.com

What is the point?

An insecure page can be MITMed. The landing page is insecure. The links from the landing page to the login page can be redirected by an attacker to go to the attacker's login page. Links on HTTP pages cannot be trusted. NOTHING on HTTP pages can be trusted.
Post reply on HN