Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Security is Too Hard

textslashplain.com

Post reply on HN
Print view View original

81–90 of 127 posts

Re: Web Security is Too Hard

#81

Post by peanut-walrus »

OkayPhysicist wrote: post #34
epochbtc wrote: post #20

Ironically, this might be at least partially because the internal security controls at Cloudflare for using or provisioning new domains/subdomains is so difficult and arduous that the team decided the fastest way to go to market is to get an entirely new domain. Possible bonus that the official bug bounty program won't apply either, since it's on a new domain so any vulnerabilities found won't have to be paid out (as…

Why is this so, so common? They're subdomains. They're free. It's not hitting anybody's budget to publish a new DNS entry. If someone has permission to publish anything in your name, they probably should be able to go make themselves a subdomain.

Because web security has a lot of legacy crap. Such as cookies. Oh you added Domain=foo.com to your cookie? Now marketingvibecodedapp.foo.com can access the cookie from your main domain. What do you mean you thought adding the domain field restricts the cookie to just that domain? Lol no, it's the exact opposite, gotcha, dumbass.

Re: Web Security is Too Hard

#82

Post by j45 »

Depending on how possible it is for a use case, reducing the attack surfaces and vectors can help, such as being mindful of how much client side javascript exposes anything.

Re: Web Security is Too Hard

#83

Post by inigyou »

yellow_lead wrote: post #6

At one point in the article, the author asks Cloudflare's bot if they're launching a Wallet product, and it says no. > There is no such product in our documentation or dashboard, so treat any email, website, or message claiming to be "Cloudflare Wallet" as a phishing attempt. What's the point of adding these AI chatbots if they're hopelessly uninformed about your products?

The point is to show how AI you are.

Re: Web Security is Too Hard

#84

Post by inigyou »

ozim wrote: post #44

Web Developers, please follow every best practice, I’m begging you Marketing people just make bunch of marketing domains. Business people push all kind of BS ideas. No one is asking Web Developers about their opinion man. STOP making everything developers fault.

Who made the website?

Re: Web Security is Too Hard

#85

Post by Joker_vD »

saghm wrote: post #66
joemi wrote: post #50

It looks like they've updated the cloudflare.pay site to link to the blog post on cloudflare.com that introduces wallets. So they fixed it on the same day they launched. That's not too bad, in my book.

I mean, what would stop someone from registering mycloudflare.pay and doing the same thing? Having the link in the other direction seems like what matters more

By "the same thing", you mean writing the blog post on Cloudflare's official blog?

Re: Web Security is Too Hard

#86

Post by eaf7e281 »

I also immediately check to see if it's an actual Cloudflare product because cloudflare[.]pay seems too suspicious to me.

Luckily, Google didn't fail me this time. Found a blog about this product with a link to the same domain.

Re: Web Security is Too Hard

#87

Post by inigyou »

madeofpalk wrote: post #18
63stack wrote: post #2

My main takeaway from this is not that "security is hard" but that cloudflare is pretty incompetent.

The takeaway is that everyone makes security hard. Everyone does this anti-pattern of having these other domains that defeat all their own security recommendations. GitHub for ages had something like githubnext.com where they would make you do this same OAuth dance (except IIRC it was worse - it explicitly said that it WASNT GitHub). Apple has/had an apple.tv microsite or something they hosted content on. Your bank w…

Once upon a time, RuneScape ran a promotion where World of Warcraft players could join a special world with double XP (experience points) or something by clicking this promotion link.

RuneScape has an in-game dungeon designed to teach players about account security. One of the questions is whether you should click on a link that promises double XP...

Re: Web Security is Too Hard

#88

Post by inigyou »

OkayPhysicist wrote: post #34
epochbtc wrote: post #20

Ironically, this might be at least partially because the internal security controls at Cloudflare for using or provisioning new domains/subdomains is so difficult and arduous that the team decided the fastest way to go to market is to get an entirely new domain. Possible bonus that the official bug bounty program won't apply either, since it's on a new domain so any vulnerabilities found won't have to be paid out (as…

Why is this so, so common? They're subdomains. They're free. It's not hitting anybody's budget to publish a new DNS entry. If someone has permission to publish anything in your name, they probably should be able to go make themselves a subdomain.

Because corporate security has nothing to do with security, and everything to do with adding bureaucracy roadblocks to legitimate activity.

Re: Web Security is Too Hard

#89

Post by inigyou »

Joker_vD wrote: post #85
saghm wrote: post #66

Earlier quoted context omitted.

I mean, what would stop someone from registering mycloudflare.pay and doing the same thing? Having the link in the other direction seems like what matters more

By "the same thing", you mean writing the blog post on Cloudflare's official blog?

No, they mean making it link to the blog.
Post reply on HN