Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Security is Too Hard

textslashplain.com

Post reply on HN
Print view View original

61–70 of 127 posts

Re: Web Security is Too Hard

#61

Post by saghm »

spc476 wrote: post #33
Joker_vD wrote: post #3

Another entry in "Marketing department starts a promotion campaign for the new product that's indistinguishable from a phishing attack" list. Starting with not using a subdomain on your own, very well-known domain but instead using a completely different one, then not having it shown with the rest of your services on your main web site, et cetera.

It's probably easier for the marketing department to get a new domain up and running that it is for a new subdomain within their own company. Battling Business Units and all that.

That's a problem that should be solved then, because literally everyone loses when it's done this way

Re: Web Security is Too Hard

#62

Post by saghm »

LocalH wrote: post #39
OkayPhysicist wrote: post #31

Earlier quoted context omitted.

None of this required Javascript. At all. The same potential attack could have been done with good ol' forms. Sure, you think you're signing into "BigBensSuperStore.com", but you're actually handing your credentials right over to "BigBensSuperStore.net".

JavaScript (and other forms of executing logic within the browser) have made the situation worse, though. To me, there's a big difference between a domain misread and actively malicious code running in the browser context as a design point.

If a malicious site gets your password, I'm not sure why it matters whether it happened in the frontend or not.

Re: Web Security is Too Hard

#63

Post by devindotcom »

yellow_lead wrote: post #6

At one point in the article, the author asks Cloudflare's bot if they're launching a Wallet product, and it says no. > There is no such product in our documentation or dashboard, so treat any email, website, or message claiming to be "Cloudflare Wallet" as a phishing attempt. What's the point of adding these AI chatbots if they're hopelessly uninformed about your products?

heh yeah I ran into this with one of the few times I used claude desktop. it had no idea what features it had and didn't have, where buttons were in the app, etc. isn't that kind of a core category of knowledge you'd want the chatbot to know?

Re: Web Security is Too Hard

#64

Post by marcta »

1970-01-01 wrote: post #17

This isn't a secfail. Why is pay.cloudflare.com so hard to establish? Why does marketing always get to overpower engineering? I expect Cloudflare services to avoid some sketchy .pay TLD for exactly the reasons this person went through.

Presumably the big scary sysadmins have access to the *.cloudflare.com DNS records, and marketing just needs to push this thing right now and can't wait, so it's easier for them to buy a new domain with a shiny new TLD than wait for pay.cloudflare.com to be authorised.

cloudflare.com/pay probably has a similar chain of approval: if every marketing idea had its own top-level route, it would get pretty crazy with such a big company.

Re: Web Security is Too Hard

#65

Post by sgarman »

sholladay wrote: post #25
mirashii wrote: post #12

Earlier quoted context omitted.

What’s the point? To save money paying a human to man a support email. That human would have also been hopelessly uninformed for all the same reasons.

> That human would have also been hopelessly uninformed for all the same reasons. Not really. At minimum, a half-way decent support person would ask a few people internally or search Slack before answering. In fact, they would have likely already heard about the new product at lunch or something.

Last time Coinbase had a breach I wrote in to support chat to see what I needed to do. They said there was no breach. I sent them a link to their own blogpost about it. They responded with "wow this is the fist time I'm hearing about this."

Re: Web Security is Too Hard

#66

Post by saghm »

joemi wrote: post #50

It looks like they've updated the cloudflare.pay site to link to the blog post on cloudflare.com that introduces wallets. So they fixed it on the same day they launched. That's not too bad, in my book.

I mean, what would stop someone from registering mycloudflare.pay and doing the same thing? Having the link in the other direction seems like what matters more

Re: Web Security is Too Hard

#67

Post by sholladay »

vntok wrote: post #40
sholladay wrote: post #25

Earlier quoted context omitted.

> That human would have also been hopelessly uninformed for all the same reasons. Not really. At minimum, a half-way decent support person would ask a few people internally or search Slack before answering. In fact, they would have likely already heard about the new product at lunch or something.

> At minimum, a half-way decent support person would ask a few people internally or search Slack before answering. Of course not. The extremely vast majority of support staff aren't connected to "internal people" and certainly don't have any access to the main company's Slack. Most of all, those people are paid very little on very tight length-per-interaction targets. They can't spend any time at all looking for stuf…

Everything I said applies to overseas labor, too. I’ve worked at both types of companies, those that co-locate support with the product teams, and those that pay bottom dollar and don’t care at all about support.

With the latter type, there’s still almost always a line of communication to corporate. And the support staff still try to help. They are decent human beings, even if the end result kind of sucks.

Re: Web Security is Too Hard

#68

Post by InsideOutSanta »

madeofpalk wrote: post #18
63stack wrote: post #2

My main takeaway from this is not that "security is hard" but that cloudflare is pretty incompetent.

The takeaway is that everyone makes security hard. Everyone does this anti-pattern of having these other domains that defeat all their own security recommendations. GitHub for ages had something like githubnext.com where they would make you do this same OAuth dance (except IIRC it was worse - it explicitly said that it WASNT GitHub). Apple has/had an apple.tv microsite or something they hosted content on. Your bank w…

Fricken Proton has a separate domain that lists all of their apps, https://protonapps.com/. This absolutely screams "scam", but no, it's real.

Ffs, just put this on apps.proton.me or something so I actually know it's real!

Re: Web Security is Too Hard

#69

Post by fl0id »

devindotcom wrote: post #63
yellow_lead wrote: post #6

At one point in the article, the author asks Cloudflare's bot if they're launching a Wallet product, and it says no. > There is no such product in our documentation or dashboard, so treat any email, website, or message claiming to be "Cloudflare Wallet" as a phishing attempt. What's the point of adding these AI chatbots if they're hopelessly uninformed about your products?

heh yeah I ran into this with one of the few times I used claude desktop. it had no idea what features it had and didn't have, where buttons were in the app, etc. isn't that kind of a core category of knowledge you'd want the chatbot to know?

in my experience, usually it knows this (it is in the system prompt) but it can still get confused. Especially with skills for example, some skills might only work in claude code/outside of sandbox or in desktop but not on web. And it would sometimes not know if it was on the web or desktop.

Re: Web Security is Too Hard

#70

Post by nemothekid »

1970-01-01 wrote: post #17

This isn't a secfail. Why is pay.cloudflare.com so hard to establish? Why does marketing always get to overpower engineering? I expect Cloudflare services to avoid some sketchy .pay TLD for exactly the reasons this person went through.

>Why is pay.cloudflare.com so hard to establish?

An engineer who vibes up a marketing site, and attempts to put it on the same origin as *.cloudflare.com now has to jump through 1,000 hoops of security clearance, customer notifications, etc.

> `pay.cloudflare.com` can't be launched because it doesn't have the proper WAF preventing 25 year old Wordpress exploits, please make sure pay.cloudflare.com/wp-admin.php is blocked. I don't care that it's a Zig application.

I remember just doing SOC2 for a startup and it made just spinning up an EC2 instance require several steps of rigamarole just to be "in-compliance". And if anything goes wrong? Well why didn't you follow the 2,000 step process?

I don't envy anyone who has to deal with issues like these.

Post reply on HN