HTTPS on Your Landing Page Is Important • Hacker News Board

Re: HTTPS on Your Landing Page Is Important

#11

Post by paulddraper » Wed, Dec 13, 2017, 11:07 PM UTC

tony101 wrote: post #5

paulddraper wrote: post #2

Troy is way overstating the case. You want to know if the login page is NatWest? Click on the Login link and look at the browsers security bar. If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great. It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution. It seems far mor…

The issue is that users tend not to notice the absence of EV security indicators. If they see a padlock (which a phisher could get for a phishing domain), they assume it's secure and enter their credentials. Also, it may not be apparent to users whether "The Royal Bank of Scotland Group Plc [GB]" would be affiliated with NatWest. Companies often have different names they do business under.

> Companies often have different names they do business under.

If the name is unrecognizable for users, _that_ is the user security concern that you should be posting about.

That handles the widest array of security vulnerabilities on http://personal.natwest.com/, whether MITM, compromised site, misspelled domain, etc.

Re: HTTPS on Your Landing Page Is Important

#12

Post by cdancette » Wed, Dec 13, 2017, 11:08 PM UTC

Maybe someday browsers won't accept http connections by default (except for a few domaines defined for test purpose, or for some specific tld like .local)

Only then we can have 100% of the web encrypted.

Re: HTTPS on Your Landing Page Is Important

#13

Post by konschubert » Wed, Dec 13, 2017, 11:08 PM UTC

That feeling when you're arguing with an idiot, and the idiot isn't listening because he thinks it's YOU who's missing the point.

Re: HTTPS on Your Landing Page Is Important

#14

Post by leesalminen » Wed, Dec 13, 2017, 11:09 PM UTC

Probably not a good person to piss off.

Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox shouldn’t tell users it’s insecure. Within hours his database was pwned.

Re: HTTPS on Your Landing Page Is Important

#15

Post by latortuga » Wed, Dec 13, 2017, 11:10 PM UTC

paulddraper wrote: post #2

Troy is way overstating the case. You want to know if the login page is NatWest? Click on the Login link and look at the browsers security bar. If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great. It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution. It seems far mor…

Wasn't there a post on HN just yesterday about EV certs not being a secure method of authenticating the website you're on? Something about Stripe being spoofed.

The case is not overstated in any way, serving a major trust-building page like a bank homepage over HTTP is crazy. Redirecting to a spoofed webpage is obviously the simple hijack but there's no reason some attacker couldn't drop some custom-built HTML and JS to drop a faux-login form right on the page that's filled with copy about how trustworthy the bank is.

Sidenote: several years ago my bank started POSTing their login form to a completely separate domain to login to my account. So I fill in the username field on the homepage and it sends me to "totallysecurebankloginsite.com" to enter my password. After a few calls to the bank they insist that this is the design they intended and that it's just fine.

Re: HTTPS on Your Landing Page Is Important

#16

Post by paulddraper » Wed, Dec 13, 2017, 11:11 PM UTC

theptip wrote: post #8

paulddraper wrote: post #2

Troy is way overstating the case. You want to know if the login page is NatWest? Click on the Login link and look at the browsers security bar. If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great. It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution. It seems far mor…

Unfortunately EV certs are not bulletproof: https://arstechnica.com/information-technology/2017/12/nope-... For ~$170 apparently you can get an EV cert for "Stripe, Inc" (by forming a company with that name). Even aside from that fact, users are very bad at knowing what a secure site looks like. I would wager that if most users clicked "login" and didn't see an EV cert, but instead saw " Secure" (i.e. a non-EV HTTPS…

Domain names don't solve that either.

For one tenth that cost, you can register stripeinc.net and get an SSL cert. Yay!

Domain registration is available instantly for anyone, anytime, and it can be phished at least as easily as anything else. https://www.xn--80ak6aa92e.com/ looks pretty legit in Firefox.

Re: HTTPS on Your Landing Page Is Important

#17

Post by bribroder » Wed, Dec 13, 2017, 11:14 PM UTC

So more specifically, HTTPS on pages where you log in is important, not necessarily on your landing / homepage? I am not disputing that may be a good idea, but it seems like the main complaint is that users are submitting credentials on an HTTP page?

Re: HTTPS on Your Landing Page Is Important

#18

Post by nkkollaw » Wed, Dec 13, 2017, 11:15 PM UTC

leesalminen wrote: post #14

Probably not a good person to piss off. Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox shouldn’t tell users it’s insecure. Within hours his database was pwned.

And it's so easy for anyone nowadays to get SSL with Let's Encrypt...

I remember a few years ago when there was no way you could do it for side projects because certs were 100/yr., now they're free.

Re: HTTPS on Your Landing Page Is Important

#19

Post by i80and » Wed, Dec 13, 2017, 11:15 PM UTC

bribroder wrote: post #17

So more specifically, HTTPS on pages where you log in is important, not necessarily on your landing / homepage? I am not disputing that may be a good idea, but it seems like the main complaint is that users are submitting credentials on an HTTP page?

This is exactly the opposite of what the article states.

The HTTP landing page serves a link to the login page. This link could be modified by a hostile network to another site. The fact that the login page is served over HTTPS is immaterial for this attack.

Re: HTTPS on Your Landing Page Is Important

#20

Post by f2n » Wed, Dec 13, 2017, 11:17 PM UTC

cdancette wrote: post #12

Maybe someday browsers won't accept http connections by default (except for a few domaines defined for test purpose, or for some specific tld like .local) Only then we can have 100% of the web encrypted.

It's moving that direction. As it stands, any website can opt-in to this behavior for future visitors with HSTS[0], or even for first time visitors with HSTS preload[1]. And Google has been doing HSTS preload on their .google TLD for several years, and recently rolled it out to their .foo and .dev [2] TLDs

[0] https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

[1] https://hstspreload.org/

[2] https://security.googleblog.com/2017/09/broadening-hsts-to-s...