Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Half of All Phishing Sites Now Have the Padlock

krebsonsecurity.com

Post reply on HN
Print view View original

21–30 of 79 posts

Re: Half of All Phishing Sites Now Have the Padlock

#21

Post by tialaramex »

sandov wrote: post #18

Noob question, if a.com gets a certificate, then b.a.com can use the same cert, right? As in the example of the fb impostor in 000webhost. So, in that same vein, can a TLD get a certificate? For example, com gets a certificate, so now anything.com has a valid certificate. Also, can I issue a cert specifically for d.c.b.a.com?

In the Web PKI, which is what you care about:

A certificate can have an effectively unlimited (CAs impose an arbitrary limit like 100, nobody is sure the maximum that could work) number of names listed (the subscriber will have to achieve proof of control for all these names to get the cert).

Each name can either be an exact fully qualified domain name, and will match only that single name, or it can be a "wildcard" like *.example.com which matches any DNS name with exactly one label (a part with no dots in, essentially) where the asterisk is and the rest an exact match.

Thus, a wildcard in com, even if it could exist (it is forbidden to issue such a thing) would not match service.example.com only the exact name example.com itself.

Re: Half of All Phishing Sites Now Have the Padlock

#22

Post by vezycash »

penagwin wrote: post #17
paraditedc wrote: post #13

Earlier quoted context omitted.

On the positive side, with apps, there's a lower chance to land on a phishing app, because apps need to be reviewed before they appear on the store.

RIP Microsoft. IMO this is a big reason why their phones/app store died. Try finding the real VLC player in the store - last I checked they dont even have a app store version (but you'll find tons of results for it).

There's real vlc app in both Windows and WP app store. In fact there were two official VlC apps for Windows Phone. One was written with c/c++ and the other UWP version

Re: Half of All Phishing Sites Now Have the Padlock

#23

Post by eli »

vezycash wrote: post #2

The many mobile browsers which hide the address bar are training people to ignore website urls. Sites who use lots of nonsensical malware-ish url redirects (Google, Microsoft are guilty) train people to accept random urls. I guess the chief culprits are email tracking links. Everyone including banks use them. Often tracking domains have nothing in common with the destination URL. This teaches people to disable or ign…

Relying on users manually confirming that the domain is correct has never been a good strategy. The user is supposed to tell microsoft.com from micros0ft.com from microsoft.co from microsoft-corp.com?

Re: Half of All Phishing Sites Now Have the Padlock

#24

Post by RcouF1uZ4gsC »

vezycash wrote: post #2

The many mobile browsers which hide the address bar are training people to ignore website urls. Sites who use lots of nonsensical malware-ish url redirects (Google, Microsoft are guilty) train people to accept random urls. I guess the chief culprits are email tracking links. Everyone including banks use them. Often tracking domains have nothing in common with the destination URL. This teaches people to disable or ign…

Another thing is the login with Google/Facebook buttons that do a redirect where you enter your password. It always makes me nervous that a website could create a fake Google/Facebook login page and collect my password, and I make a point of looking at the login page extra carefully. However, I bet that the average computer user doesn't do this.

Re: Half of All Phishing Sites Now Have the Padlock

#26

Post by todopoderoso »

eli wrote: post #23
vezycash wrote: post #2

The many mobile browsers which hide the address bar are training people to ignore website urls. Sites who use lots of nonsensical malware-ish url redirects (Google, Microsoft are guilty) train people to accept random urls. I guess the chief culprits are email tracking links. Everyone including banks use them. Often tracking domains have nothing in common with the destination URL. This teaches people to disable or ign…

Relying on users manually confirming that the domain is correct has never been a good strategy. The user is supposed to tell microsoft.com from micros0ft.com from microsoft.co from microsoft-corp.com?

I recently saw a MacKeeper landing page url: "www.apple.com-spamsite.info/landing"

It was truncated in the url-bar enough to look like "www.apple.com".

The landing page, of course, was a clone of the apple.com website with a "Scan Computer" button that did the ol trick of showing you some animations before suggesting you use MacKeeper to clean up 17 viruses.

Re: Half of All Phishing Sites Now Have the Padlock

#27

Post by tialaramex »

nerdponx wrote: post #19

I thought this was the point of EV certs.

EV certificates are a compromise between the CAs and the browser vendors (today effectively all OS vendors except Mozilla stands in for the free Unixes).

The CAs wanted a product with a distinct UI that could drive sales of a more expensive certificate.

The browsers wanted CAs to do a better job of validation.

So the agreement was: we'll add a fancy UI for these certificates if you promise to ensure all your certificates are properly validated.

But validating the shiny organisation data in the EV cert, while useful, is not a major priority for the browsers. A machine can't do anything with it. The browsers mostly care about validating the Fully Qualified Domain Name, which is done even in DV and OV certificates just the same.

Trying to solve security problems with EV means relying on fallible humans not to make mistakes. It won't work. If it makes you feel better to try, be my guest but the browser vendors have been there, tried that.

Re: Half of All Phishing Sites Now Have the Padlock

#29

Post by jekub »

erkose wrote: post #25
bonestamp2 wrote: post #3

On the bright side, at least your data won't get stolen by a fourth party while it's being stolen by a third party.

Your data is being sold by the 1st party.

Your data are sold by the second party. The first party give them for free most of the time...
Post reply on HN