Web Security is Too Hard • Hacker News Board

Re: Web Security is Too Hard

#11

Post by thadt » Tue, Aug 04, 2026, 6:53 PM UTC

In the movie Sneakers, a whole scene is taken up sending some guy on a date with Mary McDonnell so she could record clips of his voice. Today she'd just need a phone call or his Instagram. It's getting harder to keep up with who _people_ are online, much less organizations and domain names.

Identity is hard y'all.

Re: Web Security is Too Hard

#12

Post by mirashii » Tue, Aug 04, 2026, 6:54 PM UTC

yellow_lead wrote: post #6

At one point in the article, the author asks Cloudflare's bot if they're launching a Wallet product, and it says no. > There is no such product in our documentation or dashboard, so treat any email, website, or message claiming to be "Cloudflare Wallet" as a phishing attempt. What's the point of adding these AI chatbots if they're hopelessly uninformed about your products?

What’s the point? To save money paying a human to man a support email. That human would have also been hopelessly uninformed for all the same reasons.

Re: Web Security is Too Hard

#13

Post by sghiassy » Tue, Aug 04, 2026, 6:57 PM UTC

Just use LLMs. They can apparently doing everything and all the things

Re: Web Security is Too Hard

#14

Post by wslh » Tue, Aug 04, 2026, 6:59 PM UTC

mirashii wrote: post #12

yellow_lead wrote: post #6

At one point in the article, the author asks Cloudflare's bot if they're launching a Wallet product, and it says no. > There is no such product in our documentation or dashboard, so treat any email, website, or message claiming to be "Cloudflare Wallet" as a phishing attempt. What's the point of adding these AI chatbots if they're hopelessly uninformed about your products?

What’s the point? To save money paying a human to man a support email. That human would have also been hopelessly uninformed for all the same reasons.

And as a dark pattern it adds "positive friction" for the company reducing the number of people that will have the motivation of obtaining the real people support.

Re: Web Security is Too Hard

#15

Post by [deleted] » Tue, Aug 04, 2026, 7:02 PM UTC

[deleted]

Re: Web Security is Too Hard

#16

Post by raesene9 » Tue, Aug 04, 2026, 7:06 PM UTC

Joker_vD wrote: post #3

Another entry in "Marketing department starts a promotion campaign for the new product that's indistinguishable from a phishing attack" list. Starting with not using a subdomain on your own, very well-known domain but instead using a completely different one, then not having it shown with the rest of your services on your main web site, et cetera.

Same Story as it ever was. The first time I encountered what I thought was a phishing attack at the bank I worked at 25 years ago, it turned out to be a marketing campaign, with URLs that put our company name as a user before the domain name (back in the day when creds could go in the URL).

Re: Web Security is Too Hard

#17

Post by 1970-01-01 » Tue, Aug 04, 2026, 7:08 PM UTC

This isn't a secfail. Why is pay.cloudflare.com so hard to establish? Why does marketing always get to overpower engineering? I expect Cloudflare services to avoid some sketchy .pay TLD for exactly the reasons this person went through.

Re: Web Security is Too Hard

#18

Post by madeofpalk » Tue, Aug 04, 2026, 7:10 PM UTC

63stack wrote: post #2

My main takeaway from this is not that "security is hard" but that cloudflare is pretty incompetent.

The takeaway is that everyone makes security hard. Everyone does this anti-pattern of having these other domains that defeat all their own security recommendations.

GitHub for ages had something like githubnext.com where they would make you do this same OAuth dance (except IIRC it was worse - it explicitly said that it WASNT GitHub). Apple has/had an apple.tv microsite or something they hosted content on.

Your bank will send you “legitimate” surveys or communication from some third party domain like qualtropics.com.

Re: Web Security is Too Hard

#19

Post by ericlaw » Tue, Aug 04, 2026, 7:13 PM UTC

raesene9 wrote: post #16

Joker_vD wrote: post #3

Another entry in "Marketing department starts a promotion campaign for the new product that's indistinguishable from a phishing attack" list. Starting with not using a subdomain on your own, very well-known domain but instead using a completely different one, then not having it shown with the rest of your services on your main web site, et cetera.

Same Story as it ever was. The first time I encountered what I thought was a phishing attack at the bank I worked at 25 years ago , it turned out to be a marketing campaign, with URLs that put our company name as a user before the domain name (back in the day when creds could go in the URL).

Fun fact: still can in Chromium-based browsers. https://textslashplain.com/2023/03/22/attack-techniques-spoo...

Re: Web Security is Too Hard

#20

Post by epochbtc » Tue, Aug 04, 2026, 7:14 PM UTC

Ironically, this might be at least partially because the internal security controls at Cloudflare for using or provisioning new domains/subdomains is so difficult and arduous that the team decided the fastest way to go to market is to get an entirely new domain. Possible bonus that the official bug bounty program won't apply either, since it's on a new domain so any vulnerabilities found won't have to be paid out (as much).