Live data from Hacker News

HTTPS on Your Landing Page Is Important

troyhunt.com

261–270 of 307 posts

Re: HTTPS on Your Landing Page Is Important

#261
post #226

Earlier quoted context omitted.

Guess what! If your financial service restricts your password to letters and numbers, it's most likely because they want you to be able to enter your password on the phone. So the passwords 'abc' 'ABC' and '222' are treated as equivalent. Try it out for fun!

I don't want to enter my password on the phone, I have fingerprint or pin in mobile banking app.

He meant over the phone, not on a phone.

Ex : I call my bank and I have to go through a menu leading me to the right agent. Eventually, it asks for my password over the phone that I need to type using the 10 numbers on a phone dial.

Good luck using your fingerprint there :)

Re: HTTPS on Your Landing Page Is Important

#263
post #262

There need to be a public directory for these websites. Something similar to https://haveibeenpwned.com/ . Something like is-this-site-stupid.com. Ridiculous password policy, http home page, virtual keyboard for password, loading javascript from http and what not..

Perhaps something like https://securethe.news/sites/ but for every website, not just news sites?

Re: HTTPS on Your Landing Page Is Important

#264

Earlier quoted context omitted.

"we require passwords to be a maximum of 8 characters, because if they were longer, people would forget them, and would have to write them down" I'm sure that has been said by some manager somewhere.

Not that it's an excuse, but I've personally seen many "technology averse" people struggle with the changing "rules" about passwords. When they started using computers, they were taught to NEVER write your password down and to do things like replace letters like I with numbers like 1 for security. Not only are those not true any more, but the opposite is recommended. Making a unique LONG password is much more importa…

Well a lack of rules (but a list of recommendations, perhaps) would be a solution there, not a maximum of 8 characters. Maximum password lengths just screams out to me that they're not hashing and just storing passwords directly in a database with a fixed-size column for passwords.

Re: HTTPS on Your Landing Page Is Important

#265
post #262

There need to be a public directory for these websites. Something similar to https://haveibeenpwned.com/ . Something like is-this-site-stupid.com. Ridiculous password policy, http home page, virtual keyboard for password, loading javascript from http and what not..

Perhaps something like https://securethe.news/sites/ but for every website, not just news sites?

Thanks for the link! Yes, would love to have one for every website. And visitor can input a website for "stupidness"

Re: HTTPS on Your Landing Page Is Important

#266

Earlier quoted context omitted.

> my bank has a max password length of 12 Look at Mr. PrivateBanking over there, my one is 5. Amount in words : Five. And that is after they updated all their software and moved to a new datacenter and everything recently. Granted I have a hardware dongle to authenticate any transactions , but to gain access to all my information, five characters is all the protection they wish to offer...

Why are you still with them?

In Germany is the same with Sparkasse, the largest retail bank in the country. username + 5 digits is enough to open your bank statements.

Re: HTTPS on Your Landing Page Is Important

#267

Earlier quoted context omitted.

Not that it's an excuse, but I've personally seen many "technology averse" people struggle with the changing "rules" about passwords. When they started using computers, they were taught to NEVER write your password down and to do things like replace letters like I with numbers like 1 for security. Not only are those not true any more, but the opposite is recommended. Making a unique LONG password is much more importa…

Well a lack of rules (but a list of recommendations, perhaps) would be a solution there, not a maximum of 8 characters. Maximum password lengths just screams out to me that they're not hashing and just storing passwords directly in a database with a fixed-size column for passwords.

Oh I absolutely 100% agree, I just wanted to point out that sometimes a lot of these seemingly crazy reasons come from somewhere, and that as developers that might work with product managers like this, it's our job to help teach them.

But maximum lengths (that aren't measured in kb) are a monumentally stupid thing, as are most other password "rules" (No, disallowing words in your password is not a good idea...)

Provide a minimum length, and check passwords against common password lists, and use a damn good hashing algorithm with a process in place to easily allow upgrading that hash.

Re: HTTPS on Your Landing Page Is Important

#268
post #37
post #32

I'm not really surprised, UK banks are absolutely terrible in terms of their product and even worse in supporting clients having valid points. Another example would be MetroBank that recently changed password prompt to a masked password prompt (in addition to already existing masked PIN alongside) ignoring the research proving its a horrible user experience and in fact lowers the security or (not a bank, but still ma…

> Three mobile provider that asks your for your password while calling in for support When I got a new nano-SIM (in 2012, one hopes they've changed this since), they didn't check any ID and only needed a postcode and date of birth to move my account to a new SIM.

When I went in a couple of months ago to do the same thing (_slightly_ more complicated situation - I had two accounts but only one SIM card and had topped up the wrong account), the store manager told me he couldn't help me and handed me their store phone dialled to their call centre (!).

The man on the other end of the phone was totally unable to solve my problem and in the end just gave me £10 of free credit on the account I'd meant to top up. He didn't ask for any ID or verification at any point, except for the serial number on the SIM card. It was a pretty bizarre customer service experience.

Re: HTTPS on Your Landing Page Is Important

#269
post #211

Earlier quoted context omitted.

marksandspencer.com very.co.uk asos.com next.co.uk and many more.

Other than shopping privacy, who cares? As long as the checkout and account management pages are https, then I don't see the big issue here. I'm just not one of these people who think there are armies of people at the NSA/GCHQ spying on me. I'm also against forcing every website in the world onto https. Doing so will significantly raise the bar of accessibility for tinkerers and makers. If I had a webcam that showed…

> Other than shopping privacy, who cares? As long as the checkout and account management pages are https, then I don't see the big issue here.

Please understand that you are wrong here.

You need to go and read the article, and then perhaps some more writing around why it's important for the whole site to be served over TLS.

Once you can read and understand the linked article and why what was described is a real issue you will no-longer sound like you don't know what you're talking about on the Internet.

> I'm just not one of these people who think there are armies of people at the NSA/GCHQ spying on me.

This isn't about NSA/GCHQ, it's about "bad actors". Which bad actors are relevant depends on your circumstances. It's quite likely that the bad actors in the case of maliciously tampering with the login links of a bank, or the link a checkout process on an e-commerce site will not be a government entity, but a criminal operation.

> I'm also against forcing every website in the world onto https.

It's really not that hard to implement TLS on the average website, and the benefits are great.

However the main focus of this article was about TLS on sites that link to sensitive information, such as banks.

> Doing so will significantly raise the bar of accessibility for tinkerers and makers.

There's two things wrong here.

1. It's really not raising the bar very high. Lets encrypt is easy to use, and as a member of a hackspace myself I know that most people there could use it, or get help using it.

2. Just because some "tinkerers and makers" may struggle with some aspect of security doesn't mean that e-commerce sites or banks etc. need to downgrade their security, or that the rest of us need to suffer.

> If I had a webcam that showed the world whether my coffee put needed refilling[1], are we all saying (on this thread, and troy hunt) that it needs serving over https because the privacy and security of coffee watchers is such a closely guarded secret that they need to be secure in their coffee pot watching habit?

This is a straw man argument. We're not talking about, and likely don't care about, your coffee pot.

We do however care about not having our personal data intercepted, our identities stolen, our credit card data misused, or ourselves be profiled etc. All concerns with things like e-commerce, bank, news sites etc. etc.

> By all means, https up important pages and sites, but lets not make it mandatory to the extent that http is no longer supported by browsers.

Ultimately this may happen in the interests of everyone's online safety, and when it does there won't be some sort of "end of times" scenario where coffee pot sites are dissapeared from the Internet, people will just move to use TLS on them.

> As an aside... a Barclays bank advert running in the UK at the moment is showing users that 'a padlock in your browser bar ensures that you are safe and that the site you are visiting is who you think it is' - which is utter bullshit, all a padlock tells you is that site owner has spent 5 minutes setting up LetsEncrypt - it in NO way confirms that they are who they say they are, and it's this lie that Joe Public are being sold right now.

Yes, and it's typical of banks to get this aspect of security wrong, however it's still better than not having TLS, and at this point you're just going to have to go and work out why yourself because I have other stuff to do.

> [1] Apparently this was a thing once ;)

Yes, it famously was: https://en.wikipedia.org/wiki/Trojan_Room_coffee_pot

Re: HTTPS on Your Landing Page Is Important

#270

Earlier quoted context omitted.

To be fair Chase seems (on the surface) to have the best site/app/whatever of the major US banks. The app is pretty great.

Chase doesn't like chromium. It'll randomly load a mobile page if your user agent string is chromium. Not to mention, none of the US banks allow standard 2FA (TOTP). If they have 2FA at all, it'll be SMS.

I think there’s some way to get a hardware token from Chase (no idea who you’d call about that) but you’re right, that part annoys me.
Post reply on HN