Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS on Your Landing Page Is Important

troyhunt.com

Post reply on HN
Print view View original

231–240 of 307 posts

Re: HTTPS on Your Landing Page Is Important

#231

Post by Jaruzel »

dazc wrote: post #211
mprev wrote: post #200

Earlier quoted context omitted.

Major sites, really?

marksandspencer.com very.co.uk asos.com next.co.uk and many more.

Other than shopping privacy, who cares? As long as the checkout and account management pages are https, then I don't see the big issue here.

I'm just not one of these people who think there are armies of people at the NSA/GCHQ spying on me. I'm also against forcing every website in the world onto https. Doing so will significantly raise the bar of accessibility for tinkerers and makers. If I had a webcam that showed the world whether my coffee put needed refilling[1], are we all saying (on this thread, and troy hunt) that it needs serving over https because the privacy and security of coffee watchers is such a closely guarded secret that they need to be secure in their coffee pot watching habit?

By all means, https up important pages and sites, but lets not make it mandatory to the extent that http is no longer supported by browsers.

As an aside... a Barclays bank advert running in the UK at the moment is showing users that 'a padlock in your browser bar ensures that you are safe and that the site you are visiting is who you think it is' - which is utter bullshit, all a padlock tells you is that site owner has spent 5 minutes setting up LetsEncrypt - it in NO way confirms that they are who they say they are, and it's this lie that Joe Public are being sold right now.

---

[1] Apparently this was a thing once ;)

Re: HTTPS on Your Landing Page Is Important

#232

Post by nerdponx »

johnsoft wrote: post #74
nerdponx wrote: post #67

Earlier quoted context omitted.

What is the business reasoning behind this kind of domain name silliness?

I assume one team is responsible for the home page, and another team is responsible for the banking portal, and they can't be bothered to coordinate with each other.

This makes sense but it seems to be bigger than that. For example, most companies with a major internet presence have a CDN on a totally separate domain, like "twimg.com", "chasecdn.com", etc. there must be a good technical reason for this, because everybody does it.

Or is that an unrelated thing?

Re: HTTPS on Your Landing Page Is Important

#233

Post by astura »

morinted wrote: post #119
exabrial wrote: post #85

It's 2017, and my social media account is protected by a tamper-proof phish-resistant embedded-encryption U2F microcontroller dongle, in addition to a password of virtually unlimited length and charset. Meanwhile, my bank has a max password length of 12 and I can only use an alphabet of roughly 64 characters. The future is here folks. And it sucks.

BMO in Canada forces 6 digits or alphanumerics as your account password. No more, no less. What's worse, because it can be entered on the phone, aAbBcC are all == 1. So it's really just 6 digits.

I signed up for a US BMO account for the sign up bonus... Man is that bank's website bad. The version of jQuery they are using is from 2008 (1.3xx IIRC) and they give you a pop-up if you try to right click saying "right-click has been disabled for security purposes."

Re: HTTPS on Your Landing Page Is Important

#234

Post by astura »

bowmessage wrote: post #153
lionelione43 wrote: post #140

Earlier quoted context omitted.

To be fair though, at least they offer the guarantee that if your online banking is hacked they will reimburse 100%. Though not sure how truthful it is having never needed it. https://i.imgur.com/O2eOwLw.jpg Edit: "You may be liable for all losses from unauthorized use of your Account if you: contributed to its unauthorized use; used a PIN combination selected from your name, telephone number, date of birth, address,…

Ok this sounds like a terrible question but how do they stop people from "hacking" themselves...

Insurance fraud is illegal; you can go to jail for it.

Re: HTTPS on Your Landing Page Is Important

#235

Post by astura »

foobarbazetc wrote: post #114
adenta wrote: post #68

Earlier quoted context omitted.

When I worked for Chase on their main app, the policy for support was the current version of the browser, minus one.

To be fair Chase seems (on the surface) to have the best site/app/whatever of the major US banks. The app is pretty great.

What? Chase.com is horribly bloated. It takes a good 25 seconds to load. (I measured)

I open it in another tab and just go do something else.

Re: HTTPS on Your Landing Page Is Important

#236

Post by momania »

toomanybeersies wrote: post #123
cm2187 wrote: post #42

Another lesson is to always host the login section on a sub domain of the company which website you visit. A prime example not to follow is Citibank in Europe. My account is with citibank.co.uk, but when I login to my account I get redirected to online.citi.eu. How do I know that citi.eu belongs to Citibank? I have no relationship with citi.eu, that’s not the website I visited. How do I know I can trust it? Microsoft…

Microsoft's sign in is a real mess, I think in part due to having to make your hotmail login that you made 15 years ago still work, along with the dozens of other services that MS has acquired or integrated. I've had a real shitter of a time trying to login before, with redirect loops, or getting automatically signed out as soon as I sign in. Or accounts being a "games for Windows" account, but not an MS account, or…

I wanted to sign up for Office 365 a while ago. First thing that bothered me was the password limit of min 8 and max 16 characters (plus all the capital, special character, etc sacrifices you have to make). Second, after I signed up, you get a recommendation to switch off automatic password expiry! What the hell MS?

Re: HTTPS on Your Landing Page Is Important

#237

Post by shak77 »

toomanybeersies wrote: post #118

A bit side topic: It seems that every time Troy interacts with a company on Twitter, they never seem to click on to who he is, until it's probably too late and they look like fools. It's just so amusing to see companies trying to condescend to Troy, when he's one of the most visible authorities on web security on the planet (not necessarily the most authoritative, but the most well known). I occasionally get this whe…

>It seems that every time Troy interacts with a company on Twitter, they never seem to click on to who he is, until it's probably too late and they look like fools.

On the other hand, Troy is looking like a fool for trying to argue about security with a girl intern that works with social media and has no clue about netsec.

Every one of his posts and threads on Twitter are "let's bully this poor intern". He's fucking pathetic.

Re: HTTPS on Your Landing Page Is Important

#239

Post by cesarb »

Jaruzel wrote: post #231
dazc wrote: post #211

Earlier quoted context omitted.

marksandspencer.com very.co.uk asos.com next.co.uk and many more.

Other than shopping privacy, who cares? As long as the checkout and account management pages are https, then I don't see the big issue here. I'm just not one of these people who think there are armies of people at the NSA/GCHQ spying on me. I'm also against forcing every website in the world onto https. Doing so will significantly raise the bar of accessibility for tinkerers and makers. If I had a webcam that showed…

> As long as the checkout and account management pages are https, then I don't see the big issue here.

How do you arrive at the checkout and account management pages? By clicking on a link. If the whole site isn't encrypted, the link can be modified to point to false checkout and account management pages. HTTPS is not only for privacy, it's also for integrity.

Re: HTTPS on Your Landing Page Is Important

#240

Post by Klathmon »

nerdponx wrote: post #232
johnsoft wrote: post #74

Earlier quoted context omitted.

I assume one team is responsible for the home page, and another team is responsible for the banking portal, and they can't be bothered to coordinate with each other.

This makes sense but it seems to be bigger than that. For example, most companies with a major internet presence have a CDN on a totally separate domain, like "twimg.com", "chasecdn.com", etc. there must be a good technical reason for this, because everybody does it. Or is that an unrelated thing?

That's an unrelated thing.

By having CDN assets on a separate domain, you not only easily avoid accidentally sending any cookies along to the other domains (so if your CDN gets owned at least they aren't getting user credentials or session cookies), but it's also a small performance optimization as there are less things sent in the headers.

The important distinction is that the user should never ENTER any information onto those domains directly. They should be for displaying static resources only, so there is no need to "build trust" for them.

Post reply on HN