Web Security is Too Hard • Hacker News Board

Re: Web Security is Too Hard

#121

Post by praptak » Wed, Aug 05, 2026, 12:00 PM UTC

yellow_lead wrote: post #6

At one point in the article, the author asks Cloudflare's bot if they're launching a Wallet product, and it says no. > There is no such product in our documentation or dashboard, so treat any email, website, or message claiming to be "Cloudflare Wallet" as a phishing attempt. What's the point of adding these AI chatbots if they're hopelessly uninformed about your products?

Monkey see, monkey do: https://adele.pages.casa/md/blog/all-my-clients-wanted-a-car...

"It's not about utility. It's not even really about the chatbot. It's about visibility, the fear of looking behind. A website without a chatbot in 2026 risks feeling unfinished, like something's missing. Even if what's missing is a half-broken widget that most visitors dismiss in three seconds. The chatbot has become a social signal, not a tool. A way of saying: we're keeping up."

Re: Web Security is Too Hard

#122

Post by zeratax » Wed, Aug 05, 2026, 12:14 PM UTC

devindotcom wrote: post #63

yellow_lead wrote: post #6

At one point in the article, the author asks Cloudflare's bot if they're launching a Wallet product, and it says no. > There is no such product in our documentation or dashboard, so treat any email, website, or message claiming to be "Cloudflare Wallet" as a phishing attempt. What's the point of adding these AI chatbots if they're hopelessly uninformed about your products?

heh yeah I ran into this with one of the few times I used claude desktop. it had no idea what features it had and didn't have, where buttons were in the app, etc. isn't that kind of a core category of knowledge you'd want the chatbot to know?

it is so frustrating to me that claude code still does not understand how the bash tool properly functions and no matter how much I mention how it works in my CLAUDE.md it still misuses it.

Re: Web Security is Too Hard

#123

Post by xtiansimon » Wed, Aug 05, 2026, 12:26 PM UTC

yellow_lead wrote: post #6

At one point in the article, the author asks Cloudflare's bot if they're launching a Wallet product, and it says no. > There is no such product in our documentation or dashboard, so treat any email, website, or message claiming to be "Cloudflare Wallet" as a phishing attempt. What's the point of adding these AI chatbots if they're hopelessly uninformed about your products?

> “What's the point of adding these AI chatbots if they're hopelessly uninformed about your products?”

This drives me nuts. But it is a continuum. From help-bots which are just natural language navigation to docs, to the best in class llm’s with access to both knowledge of the company and your data (my fav so far is Shopify). The most annoying are those who read the docs to you like lawyer-bots.

I’m guessing the speed at which companies go from the first type to the last type depend on many factors such as volume of support issues, the expertise of the users, and corporate culture of reliance on “accountability sinks” (someone to be mad at, but who has no authority to help or correct a problem—I’m thinking of the merchant platform Square and their dark pattern navigation that tricks you to suffer the instant fees of the fund-now link trying to find the transfer schedule).

Re: Web Security is Too Hard

#124

Post by EdwardDiego » Wed, Aug 05, 2026, 2:35 PM UTC

joemi wrote: post #50

It looks like they've updated the cloudflare.pay site to link to the blog post on cloudflare.com that introduces wallets. So they fixed it on the same day they launched. That's not too bad, in my book.

Not too bad that they launched looking like a phishing scam because they eventually added a link?

Shit, the bar is low these days.

Re: Web Security is Too Hard

#125

Post by EdwardDiego » Wed, Aug 05, 2026, 2:35 PM UTC

joemi wrote: post #97

saghm wrote: post #66

Earlier quoted context omitted.

I mean, what would stop someone from registering mycloudflare.pay and doing the same thing? Having the link in the other direction seems like what matters more

I mentioned it because the blog post itself links back to cloudflare.pay. Of course just linking to a blog post is useless.

You should've mentioned that in your original comment because it changes the meaning of it entirely.

Re: Web Security is Too Hard

#126

Post by joemi » Thu, Aug 06, 2026, 6:03 PM UTC

EdwardDiego wrote: post #125

joemi wrote: post #97

Earlier quoted context omitted.

I mentioned it because the blog post itself links back to cloudflare.pay. Of course just linking to a blog post is useless.

You should've mentioned that in your original comment because it changes the meaning of it entirely.

I assumed that the fact the blog post verified the legitimacy was implied, or that people would look at it before commenting if they didn't think it was implied. My bad.

Re: Web Security is Too Hard

#127

Post by varenc » Fri, Aug 07, 2026, 4:56 PM UTC

lee_ars wrote: post #108

varenc wrote: post #102

Cosmically I feel like the HTTPS certificate on Cloudflare.pay should provide sufficient info to confirm it's the same entity behind Cloudflare.com

You'd think, but nope, it def doesn't — the site's TLS cert is issued by Google Trust Services, which issues domain-validated certs via ACME, so no, the only thing the site owner had to do to get that certificate is demonstrate ownership of the `cloudflare.pay` domain. GTS is also one of the default CAs that Cloudflare's universal SSL uses, so that's also exactly what would show up for any Cloudflare-proxied site wit…

hah thanks for the deep dive on this. I wanted to investigate myself but figured someone on HN would be faster at it. Makes sense it's not helpful, alas.