Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS on Your Landing Page Is Important

troyhunt.com

Post reply on HN
Print view View original

21–30 of 307 posts

Re: HTTPS on Your Landing Page Is Important

#21

Post by niftich »

paulddraper wrote: post #2

Troy is way overstating the case. You want to know if the login page is NatWest? Click on the Login link and look at the browsers security bar. If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great. It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution. It seems far mor…

Just one day prior, I wrote that people's mental model of the benefits that EV certs confer is broken [1]: "an EV cert asserts that the domain name is controlled by a legal entity in some jurisdiction. This is a very distinct notion from the site that you've arrived at being the site that you were intending to visit, but people use it as a terrible, flawed proxy for such."

This was on the topic of an EV cert being issued to a different 'Stripe, Inc'.

But also, I observed that for top sites, "people trust their website by fiat, simply by mental associations about their domain names (...)". This is why HTTPS on a landing page is so important: to safeguard the trust chain that most users use to arrive at the login page -- first, the name of their bank, then the bank's URL from memory, then the bank's login page from the homepage's URL.

[1] https://news.ycombinator.com/item?id=15909273

Re: HTTPS on Your Landing Page Is Important

#22

Post by adamson »

bribroder wrote: post #17

So more specifically, HTTPS on pages where you log in is important, not necessarily on your landing / homepage? I am not disputing that may be a good idea, but it seems like the main complaint is that users are submitting credentials on an HTTP page?

Nope, you can MITM the HTTP-only landing page so the link to the login page takes you to a page that looks just like the actual banks login page, but actually just submits your credentials to an attacker.

Modifying the link would not be possible if the landing page were served over an encrypted connection.

Re: HTTPS on Your Landing Page Is Important

#23

Post by paulddraper »

School-Cotton wrote: post #4
paulddraper wrote: post #2

Troy is way overstating the case. You want to know if the login page is NatWest? Click on the Login link and look at the browsers security bar. If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great. It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution. It seems far mor…

What fraction of users will do this, in your opinion?

About the same number of people that have been MITM'ed for personal.natwest.com and divulged login information.

Re: HTTPS on Your Landing Page Is Important

#24

Post by ethbro »

konschubert wrote: post #13

That feeling when you're arguing with an idiot, and the idiot isn't listening because he thinks it's YOU who's missing the point.

The important thing for all of us to remember, is that in any given conversation we may be idiot.

Until I'm sure the other person doesn't know what they're talking about, I try and assume they're right.

Re: HTTPS on Your Landing Page Is Important

#25

Post by swvjeff »

paulddraper wrote: post #16
theptip wrote: post #8

Earlier quoted context omitted.

Unfortunately EV certs are not bulletproof: https://arstechnica.com/information-technology/2017/12/nope-... For ~$170 apparently you can get an EV cert for "Stripe, Inc" (by forming a company with that name). Even aside from that fact, users are very bad at knowing what a secure site looks like. I would wager that if most users clicked "login" and didn't see an EV cert, but instead saw " Secure" (i.e. a non-EV HTTPS…

Domain names don't solve that either. For one tenth that cost, you can register stripeinc.net and get an SSL cert. Yay! Domain registration is available instantly for anyone, anytime, and it can be phished at least as easily as anything else. https://www.xn--80ak6aa92e.com/ looks pretty legit in Firefox.

Sure, but that's just more reason to use HTTPS across their entire domain and would help prevent users from being phished as easily. If I enter "apple.com" I expect all links on that page to point me to the correct location. A MITM attack from a non-HTTP page could easily alter the page and link me to https://www.xn--80ak6aa92e.com/login instead.

Re: HTTPS on Your Landing Page Is Important

#26

Post by [deleted] »

i80and wrote: post #19
bribroder wrote: post #17

So more specifically, HTTPS on pages where you log in is important, not necessarily on your landing / homepage? I am not disputing that may be a good idea, but it seems like the main complaint is that users are submitting credentials on an HTTP page?

This is exactly the opposite of what the article states. The HTTP landing page serves a link to the login page. This link could be modified by a hostile network to another site. The fact that the login page is served over HTTPS is immaterial for this attack.

[deleted]

Re: HTTPS on Your Landing Page Is Important

#29

Post by dasil003 »

paulddraper wrote: post #2

Troy is way overstating the case. You want to know if the login page is NatWest? Click on the Login link and look at the browsers security bar. If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great. It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution. It seems far mor…

Dude, you could walk into a coffee shop in the UK today, set up a honeypot wifi, and over the course of a day collect a handful of credentials with direct access to bank accounts. Unlike the US, once you're into an account you can send money directly and more or less instantaneously to any other UK account. Assuming every single person is verifying the cert/domain after they click the login link is batshit insane, I guarantee you no more than 10% of people would even have a chance of noticing.

Re: HTTPS on Your Landing Page Is Important

#30

Post by cdancette »

ivanbakel wrote: post #28

>you could go register nuuolb.com right now Not anymore! https://www.whois.com/whois/nuuolb.com It seems NatWest has quickly gone to secure this major attack point in their otherwise chink-free armour. Does someone want to inform them about nwalb.com as well?

This is mentioned in the article. He also mentioned they didn't buy nw0lb.com and some other domains.
Post reply on HN