Web Security is Too Hard

#1

Post by kevincox » Tue, Aug 04, 2026, 6:29 PM UTC

Web Security is Too Hard
textslashplain.com

Re: Web Security is Too Hard

#2

Post by 63stack » Tue, Aug 04, 2026, 6:46 PM UTC

My main takeaway from this is not that "security is hard" but that cloudflare is pretty incompetent.

Re: Web Security is Too Hard

#3

Post by Joker_vD » Tue, Aug 04, 2026, 6:47 PM UTC

Another entry in "Marketing department starts a promotion campaign for the new product that's indistinguishable from a phishing attack" list. Starting with not using a subdomain on your own, very well-known domain but instead using a completely different one, then not having it shown with the rest of your services on your main web site, et cetera.

Re: Web Security is Too Hard

#4

Post by dwedge » Tue, Aug 04, 2026, 6:47 PM UTC

I guess it's easy to judge from the sidelines but was the screenshot of the site, if not the first tweet, not an obvious scam? And you can say it's from context but I only read the title before my eyes jumped to the screenshot

Re: Web Security is Too Hard

#5

Post by dwedge » Tue, Aug 04, 2026, 6:48 PM UTC

dwedge wrote: post #4

I guess it's easy to judge from the sidelines but was the screenshot of the site, if not the first tweet, not an obvious scam? And you can say it's from context but I only read the title before my eyes jumped to the screenshot

I just read the rest of the article and I'm back with my tail between my legs. I guess I made the author's point.

Re: Web Security is Too Hard

#6

Post by yellow_lead » Tue, Aug 04, 2026, 6:49 PM UTC

At one point in the article, the author asks Cloudflare's bot if they're launching a Wallet product, and it says no.

> There is no such product in our documentation or dashboard, so treat any email, website, or message claiming to be "Cloudflare Wallet" as a phishing attempt.

What's the point of adding these AI chatbots if they're hopelessly uninformed about your products?

Re: Web Security is Too Hard

#7

Post by make3 » Tue, Aug 04, 2026, 6:52 PM UTC

Joker_vD wrote: post #3

Another entry in "Marketing department starts a promotion campaign for the new product that's indistinguishable from a phishing attack" list. Starting with not using a subdomain on your own, very well-known domain but instead using a completely different one, then not having it shown with the rest of your services on your main web site, et cetera.

this is the correct take

Re: Web Security is Too Hard

#8

Post by derektank » Tue, Aug 04, 2026, 6:52 PM UTC

Joker_vD wrote: post #3

Another entry in "Marketing department starts a promotion campaign for the new product that's indistinguishable from a phishing attack" list. Starting with not using a subdomain on your own, very well-known domain but instead using a completely different one, then not having it shown with the rest of your services on your main web site, et cetera.

You really would think that at least in theory a company like Cloudflare would make it very easy for internal teams to automatically request new subdomains

Re: Web Security is Too Hard

#9

Post by thataccount » Tue, Aug 04, 2026, 6:53 PM UTC

Cloudflare is your favorite company and they are geniuses?

Dear Diary,

Today my fanboy bubble was burst.

Signed,

Author

Re: Web Security is Too Hard

#10

Post by Hovertruck » Tue, Aug 04, 2026, 6:53 PM UTC

dwedge wrote: post #5

dwedge wrote: post #4

I guess it's easy to judge from the sidelines but was the screenshot of the site, if not the first tweet, not an obvious scam? And you can say it's from context but I only read the title before my eyes jumped to the screenshot

I just read the rest of the article and I'm back with my tail between my legs. I guess I made the author's point.

Don't worry, I think everyone probably went on the same roller coaster with this one