Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS on Your Landing Page Is Important

troyhunt.com

Post reply on HN
Print view View original

211–220 of 307 posts

Re: HTTPS on Your Landing Page Is Important

#213

Post by einrealist »

cm2187 wrote: post #42

Another lesson is to always host the login section on a sub domain of the company which website you visit. A prime example not to follow is Citibank in Europe. My account is with citibank.co.uk, but when I login to my account I get redirected to online.citi.eu. How do I know that citi.eu belongs to Citibank? I have no relationship with citi.eu, that’s not the website I visited. How do I know I can trust it? Microsoft…

That is typical for organizations, where a DNS change takes weeks or months or isn't even possible, because of different legal entities. "Lets just register our own domain. Its faster...."

Having a bank as a current client, I am often joking about what would happen if Jeff Bezos takes control for a month. And when I am angry, I ask what would happen if Amazon or Google start selling credits or insurances, tomorrow.

Re: HTTPS on Your Landing Page Is Important

#214

Post by tachion »

philipwhiuk wrote: post #82
tachion wrote: post #32

I'm not really surprised, UK banks are absolutely terrible in terms of their product and even worse in supporting clients having valid points. Another example would be MetroBank that recently changed password prompt to a masked password prompt (in addition to already existing masked PIN alongside) ignoring the research proving its a horrible user experience and in fact lowers the security or (not a bank, but still ma…

I'm with Three and I've not encountered that. That's terrible and I'll probably change my password. But Nationwide is pretty good for banking.

I've had to deal with the call-in support twice in last 6 months and each time I was asked for my actual password (no one asked me for any 'telephone password' but I don't have one and even if I would, I wouldn't tell it to anyone either). Given I wasn't inclined to do so, after trying to explain how wrong this practice is, trying to escalate it, in the end I've meet the similar wall of 'we are sorry you feel this way, can we help you with something else?'.

Re: HTTPS on Your Landing Page Is Important

#215

Post by masklinn »

alvah wrote: post #148
peterkelly wrote: post #125

Earlier quoted context omitted.

If you're on a host that doesn't support HTTPS, you should probably find a different one.

Hostgator, to give one fairly large example, does support HTTPS, but only their expensive option, not Lets Encrypt.

If you're on hostgator, you definitely need to find a different host.

Re: HTTPS on Your Landing Page Is Important

#217

Post by masklinn »

giancarlostoro wrote: post #180
megy wrote: post #103

Earlier quoted context omitted.

It is not easy if you are on a shared domain and it is not supported by your host. Please don't run around saying it is easy for everyone.

I have a shared hosting provider that lets me use Let's Encrypt certs on any of my domains through CPanel even. For anyone interested : http://buyshared.net I'm only a customer for small niche sites, not associated in any other way, works fine enough for my needs.

Same with webfaction and I expect pretty much all non-shit hosts.

Only annoyance (at least with webfaction) is that they don't currently support letsencrypt auto-renewal, so you have to remember to update your cert manually every 12 weeks.

Re: HTTPS on Your Landing Page Is Important

#218

Post by rocqua »

berbec wrote: post #107
rocqua wrote: post #89

Earlier quoted context omitted.

HTTPS means more than just encryption. There is also authentication and integrity guarantees in SSL.

But the extras beyond encryption are definately not guarantees. [1] HTTPS means encrypted HTTP. Everything else is "I trust the certificate authority to provide oversight and verification." It may just be me, but I don't trust the fine, upstanding CAs we have now-a-days. 1: https://stripe.ian.sh/

Authenticity indeed is only guaranteed if you trust the CAs. Though it is still nice to know that getting a false cert isn't trivial.

However, message integrity is a real benefit of SSL that doesn't need CAs. Consider the original article. In this case encryption doesn't matter and integrity does.

Without message integrity, considering the login link has a known location and value, using bit-flips one might be able to change the login link (depending on the kind of encryption used).

This message integrity is getting to be a much more important part of https. There are a lot of things that you don't want other parties able to change. Maybe even more things than you don't want them to be able to read.

Post reply on HN