Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I recorded user behaviour on my competitor’s websites

dejanseo.com.au

Post reply on HN
Print view View original

191–200 of 329 posts

Re: How I recorded user behaviour on my competitor’s websites

#191

Post by justaguyhere »

GedByrne wrote: post #159

I’d like to defend this guy. What he is doing is testing the trust mechanism. If he went to Google and said ‘I think the trust mechanism is broken’ Google would say: ‘We know, that’s why we are pushing to move everyone to https.’ ‘That isn’t enough. The padlock on the https page gives users a false sense of security.’ ‘We don’t agree with that. Where’s your data?’ Google wouldn’t have accepted this. They have pushed…

Agreed. Forget a huge, third party like Google, many times (at least in my experience) even our own bosses in small companies wouldn't listen. And even if they did listen, they wouldn't act. Unless of course, it is proven with data and it is big enough to cause them a headache. I'd guess mostly it is due to laziness and not any malicious intent.

Re: How I recorded user behaviour on my competitor’s websites

#192

Post by SquareWheel »

Invictus0 wrote: post #183
nothrabannosir wrote: post #174

For context: Firefox greys out anything that is not the "real" domain, which remains black. So: google.com.fakesite.io/foobar becomes: (grey "google.com.")(black "fakesite.com")(grey "/foobar") This makes it at least a little more obvious you're not on Google. Although that's still a tricky one for non technical users to protect against. Aside from EV, I can't immediately think of anything else a browser could system…

> Domain names being little endian has been one of the most expensive web sec mistakes in history. Can you clarify what you mean by this?

Presumably that authority works from right-to-left. .com, then domain, then subdomain. It would be easier to gauge trust if it were left-to-right.

Re: How I recorded user behaviour on my competitor’s websites

#193

Post by shawn »

dejanseo wrote: post #181
shawn wrote: post #149

Earlier quoted context omitted.

Howdy, former Matasano pentester here. FWIW, I would probably have done something similar to them before I'd worked in the security industry. It's an easy mistake to make, because it's one you make by default: intellectual curiosity doesn't absolve you from legal judgement, and people on the internet tend to flip out if you do something illegal and say anything but "You're right, I was mistaken. I've learned my lesso…

Thank you, I did mess up and wish I could take it back. To everyone bashing on me, I'm truly sorry to offend so many people. That was not the intention. This was purely as you describe it, intellectual curiosity. I really appreciate your comment and hope it's OK that I added it here: https://dejanseo.com.au/competitor-hack/#shawn

The good news is, if you're ever interested in a career as a pentester, this is an excellent portfolio piece. :) (Really!)

Also, don't worry too much. I think everyone knows your heart was in the right place, and ultimately that counts for something.

Re: How I recorded user behaviour on my competitor’s websites

#194

Post by [deleted] »

_gok2 wrote: post #188
SquareWheel wrote: post #185

Earlier quoted context omitted.

>‘That isn’t enough. The padlock on the https page gives users a false sense of security.’ >‘We don’t agree with that. Where’s your data?’ Where is your source that this is Google's position? Considering they have some of the best security employees in the business, I find that hard to believe.

Allowing sites to intercept browser actions that should make a user leave the site, and inject other operations is obviously and plainly a security issue. I reported this to google several years ago, and it was never addressed.

[deleted]

Re: How I recorded user behaviour on my competitor’s websites

#195

Post by SquareWheel »

_gok2 wrote: post #188
SquareWheel wrote: post #185

Earlier quoted context omitted.

>‘That isn’t enough. The padlock on the https page gives users a false sense of security.’ >‘We don’t agree with that. Where’s your data?’ Where is your source that this is Google's position? Considering they have some of the best security employees in the business, I find that hard to believe.

Allowing sites to intercept browser actions that should make a user leave the site, and inject other operations is obviously and plainly a security issue. I reported this to google several years ago, and it was never addressed.

>Allowing sites to intercept browser actions that should make a user leave the site, and inject other operations is obviously and plainly a security issue.

Sure, I agree. But what does it have to do with the parent comment's claim?

I've read much of the discussions involving the early push for HTTPS, and the developers involved were very fastidious.

Re: How I recorded user behaviour on my competitor’s websites

#196

Post by wiether »

azeirah wrote: post #87
wiether wrote: post #70

Earlier quoted context omitted.

In that case, just not using useless thing like "back" button will be perfectly fine. A good website don't need using this button. And to navigate between websites, using a tab for each website is fine. Especially when comparing results from Google.

... Don't use the back button? What? I actually kind of like the ability to move between pages and domains with the back button.

A good website give you the ability to move without this button.

It's like Android VS iOS.

The first one has a back button, the other don't.

Re: How I recorded user behaviour on my competitor’s websites

#197

Post by lixtra »

brynjolf wrote: post #184
lixtra wrote: post #94

Earlier quoted context omitted.

I think in this situation it would be best to admit that it was improper behavior. You can agree that you should have either - used your own site - or someone that explicitly agreed to run this experiment. Then you can go on that you regret your wrong approach in this case, you will do better next time and finally point out that very little damage was done, which you regret nonetheless. Then we all move on, - agree t…

Why? Why are you siding with the big corporations?

Am I? Which big corporation? dejanseo? google?

I'm siding with dejanseo (the user) because I screwed up myself before. And I will possibly do it again. I see some recklessness but not malicious intent.

This whole branch got flagged away anyway.

Re: How I recorded user behaviour on my competitor’s websites

#198

Post by palotasb »

Klathmon wrote: post #178
GedByrne wrote: post #159

I’d like to defend this guy. What he is doing is testing the trust mechanism. If he went to Google and said ‘I think the trust mechanism is broken’ Google would say: ‘We know, that’s why we are pushing to move everyone to https.’ ‘That isn’t enough. The padlock on the https page gives users a false sense of security.’ ‘We don’t agree with that. Where’s your data?’ Google wouldn’t have accepted this. They have pushed…

So you are implying that HTTPS made this attack easier or more impactful? I don't buy it. This same attack would work the same with or without HTTPS having existed, and the only reason it wouldn't work as well in practice is because HTTPS is a baseline of security. It's like saying that airbags cause people to trust unsafe cars. An HTTP only site is a red flag now, but HTTPS just means it won't be instantly considere…

There is a similar debate about making wearing bicycle helmets mandatory. [1] One problem is basically that with cyclists wearing helmets, they and drivers around them might think that smaller safety margins are necessary. (Both physically as drivers drive closer to them and e.g., cyclists more likely to drive at unsafe speeds.)

I think the argument here is the same: the green padlock makes people feel too safe. I could easily buy an argument that if HTTPS was not highlighted prominently as a SAFE thing by the browser, people would pay more attention to other indicators such as the domain when browsing the internet.

[1] https://discerningcyclist.com/2018/05/mandatory-bicycle-helm...

Re: How I recorded user behaviour on my competitor’s websites

#199

Post by ams6110 »

rauhl wrote: post #165
dorgo wrote: post #105

Earlier quoted context omitted.

>dding another 3 clicks, then another 2 for the inline JavaScript contained within after reload makes the internet incredibly annoying to use. Yes, it is annoying. It reminds me each time how annoying websites are which use Javascript for things which could be done without. And it lets me search for alternatives or just abandon such websites.

> how annoying websites are which use Javascript for things which could be done without A good example of sites which use JavaScript for things they don’t really need are those GP mentions: ‘government sites, e-stores, banking.’ Government sites: the vast majority of government sites are simply informative text. There’s absolutely no need for me to grant the government permission execute code on my computer (which is…

JavaScript is popular for the same reasons Flash was popular.

a) It objectively can make web pages more usable and convenient.

b) The fancy animations and other effects make marketers and managers happy.

c) You an use it to build interactive games, which many users like.

Re: How I recorded user behaviour on my competitor’s websites

#200

Post by test1235 »

nothrabannosir wrote: post #174

For context: Firefox greys out anything that is not the "real" domain, which remains black. So: google.com.fakesite.io/foobar becomes: (grey "google.com.")(black "fakesite.com")(grey "/foobar") This makes it at least a little more obvious you're not on Google. Although that's still a tricky one for non technical users to protect against. Aside from EV, I can't immediately think of anything else a browser could system…

just to illustrate: https://i.imgur.com/gzdStyw.png
Post reply on HN