Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why not to whitelist operating system user agents

neelc.org

Post reply on HN
Print view View original

71–80 of 122 posts

Re: Why not to whitelist operating system user agents

#71

Post by flyinghamster »

Blue Cross and Blue Shield of Illinois (I can't vouch for any of the other Blue Cross affiliates) recently redid their website. I was wondering why the hell it was kicking me out after logging in, with a "did you forget your password?" message. Multiple password reset attempts later, I called their tech support and asked what was up. I use Firefox on Linux as my daily driver.

What was up was that on their new site, I had to use Google Chrome and only Google Chrome. Not Firefox, not even Chromium. I wonder if Edge even works.

I'm seriously considering switching providers over it.

Re: Why not to whitelist operating system user agents

#72

Post by nynx »

zxcvbn4038 wrote: post #62

Banks do stuff like this all the time - they are always the long tail of security - could be a topic in itself. I contemplated this for a very long time and decided that JP Morgan would rather take the hit for bad security then pay wages and benefits to support people to deal with password resets, lost yubikeys, etc. No other answer makes sense. My advise to OP is to dump Chase, Citibank, Bank Of America, ASAP. Move…

Any suggestions?

Re: Why not to whitelist operating system user agents

#73

Post by c-swa »

zxcvbn4038 wrote: post #62

Banks do stuff like this all the time - they are always the long tail of security - could be a topic in itself. I contemplated this for a very long time and decided that JP Morgan would rather take the hit for bad security then pay wages and benefits to support people to deal with password resets, lost yubikeys, etc. No other answer makes sense. My advise to OP is to dump Chase, Citibank, Bank Of America, ASAP. Move…

Unfortunately can’t change loan providers, as my auto loan when was financed through the dealer ended up at Jp Morgan & Chase.

Re: Why not to whitelist operating system user agents

#74

Post by JshWright »

Freak_NL wrote: post #51

I ran into a similar problem with the website of my general practitioner. It worked fine in all cases, except when using Firefox on Linux, which I use. After lots of testing and trying to contact whoever built the website I found that it blocked only user-agents which contained this literal string: X11; Ubuntu; Linux Only when that string was in there verbatim would it fail all requests with a 403 Forbidden. After I…

If you're in the US, call your doc and mention that this may be a violation of the 21st Century Cures Act, as it is preventing or interfering with the access, exchange, or use of electronic health information.

It would be a stretch to call this an outright violation (as they could satisfy the requirement by printing the information you want and mailing it to you...), but it's a trendy topic in healthcare right now, so it might be enough of a motivator.

Re: Why not to whitelist operating system user agents

#75

Post by diggan »

ricardobayes wrote: post #69
roobs wrote: post #14

Try Japanese business banking - where you have to pick an OS and stick with it when registering (with a paper form), and must use either the ESR release of Firefox or Internet Explorer. If you don't have a user agent of either of those it won't even let you sign in.

Try Spanish online digital administration. The digital certificates only worked in IE. And mid-process they require installing a Java-based program that required a different type of digital certificate. That of course make you restart the browser and lose all the data entered. Just wow. I couldn't even come up with such a bad process if I wanted.

Not sure if you're referring to something old, I've only been in Spain since 2012 but I'm having zero issues with the digital certificate for various government websites, from hacienda to local city governments websites. Never have I been forced to install Java either. I usually use Firefox on Linux and seems to work fine, at least for me.

Re: Why not to whitelist operating system user agents

#76

Post by hacker_newz »

beervirus wrote: post #67

> Worse, Chase even openly admits to being hostile to Linux and BSD to someone on Reddit. It’s something even Microsoft, Windows PC/hardware OEMs, or Apple won’t do. If you click through to the link, you will see that this claim is totally made up.

Seriously, it sounds like the author of that post claimed discrimination for not supporting Linux.

Re: Why not to whitelist operating system user agents

#77

Post by JshWright »

c-swa wrote: post #73
zxcvbn4038 wrote: post #62

Banks do stuff like this all the time - they are always the long tail of security - could be a topic in itself. I contemplated this for a very long time and decided that JP Morgan would rather take the hit for bad security then pay wages and benefits to support people to deal with password resets, lost yubikeys, etc. No other answer makes sense. My advise to OP is to dump Chase, Citibank, Bank Of America, ASAP. Move…

Unfortunately can’t change loan providers, as my auto loan when was financed through the dealer ended up at Jp Morgan & Chase.

You definitely can do that, if you want to. Refinancing a loan is not especially complicated.

Re: Why not to whitelist operating system user agents

#78

Post by coredog64 »

zxcvbn4038 wrote: post #62

Banks do stuff like this all the time - they are always the long tail of security - could be a topic in itself. I contemplated this for a very long time and decided that JP Morgan would rather take the hit for bad security then pay wages and benefits to support people to deal with password resets, lost yubikeys, etc. No other answer makes sense. My advise to OP is to dump Chase, Citibank, Bank Of America, ASAP. Move…

ETrade is now a subsidiary of Morgan Stanley. While MS is only half the size of JPMC, they’re not really a small bank.

(Wikipedia isn’t up to date BTW. Even before the Etrade they had over $1T in AUM)

Re: Why not to whitelist operating system user agents

#79

Post by Neil44 »

Freak_NL wrote: post #51

I ran into a similar problem with the website of my general practitioner. It worked fine in all cases, except when using Firefox on Linux, which I use. After lots of testing and trying to contact whoever built the website I found that it blocked only user-agents which contained this literal string: X11; Ubuntu; Linux Only when that string was in there verbatim would it fail all requests with a 403 Forbidden. After I…

I host a few hundred wordpress sites and I recognise that string by sight! Tons of bots seem to use it. I haven’t 403’d it (yet) though.

Re: Why not to whitelist operating system user agents

#80

Post by tootie »

jakub_g wrote: post #56

For anyone who works at the company who does that: why you do it? Is it to reduce amount of testing, and only have a few "blessed" browsers with guaranteed happy experience? Any other reasons?

I mean there's an excellent and obvious answer and that's cost benefit when it comes to QA. Anything transactional, banks in particular, want to be 100% sure that end user experiences are doing exactly what they're expected to at all times. No one is being served incorrect information or is improperly served terms or disclaimers that they can use a leverage in a lawsuit. The tech teams likely have an explicit support matrix of browsers to test against and anything not on the list is considered untested and unreliable. They can't legally indemnify themselves against defects.
Post reply on HN