Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS on Your Landing Page Is Important

troyhunt.com

Post reply on HN
Print view View original

251–260 of 307 posts

Re: HTTPS on Your Landing Page Is Important

#251

Post by Gorgor »

shak77 wrote: post #237
toomanybeersies wrote: post #118

A bit side topic: It seems that every time Troy interacts with a company on Twitter, they never seem to click on to who he is, until it's probably too late and they look like fools. It's just so amusing to see companies trying to condescend to Troy, when he's one of the most visible authorities on web security on the planet (not necessarily the most authoritative, but the most well known). I occasionally get this whe…

>It seems that every time Troy interacts with a company on Twitter, they never seem to click on to who he is, until it's probably too late and they look like fools. On the other hand, Troy is looking like a fool for trying to argue about security with a girl intern that works with social media and has no clue about netsec. Every one of his posts and threads on Twitter are "let's bully this poor intern". He's fucking…

How is it relevant that it may be a girl?

Re: HTTPS on Your Landing Page Is Important

#252

Post by dingo_bat »

thanksgiving wrote: post #224
snowwindwaves wrote: post #161

Earlier quoted context omitted.

But did you call the support phone number shown on the dodgy domain?

T-Mobile called me back one time instead of me waiting on hold. This was after I went through the song and dance of giving the automated system my details. The first thing this representative wanted to do was, again, confirm I am who I said I was. I said think about what you're asking for a second. Should I answer your questions? Couldn't get them to understand. Wound up hanging up and calling again and waiting on ho…

I hate it when someone calls me and asks me who I am. You called, you tell me who you want to talk to.

Re: HTTPS on Your Landing Page Is Important

#253

Post by dingo_bat »

Gorgor wrote: post #251
shak77 wrote: post #237

Earlier quoted context omitted.

>It seems that every time Troy interacts with a company on Twitter, they never seem to click on to who he is, until it's probably too late and they look like fools. On the other hand, Troy is looking like a fool for trying to argue about security with a girl intern that works with social media and has no clue about netsec. Every one of his posts and threads on Twitter are "let's bully this poor intern". He's fucking…

How is it relevant that it may be a girl?

Everyone knows girls are stupid and know nothing about a serious topic like computer security.

Re: HTTPS on Your Landing Page Is Important

#254

Post by ryandvm »

rocqua wrote: post #89
ryandvm wrote: post #83

Earlier quoted context omitted.

How about all it really means? "Encrypted"

HTTPS means more than just encryption. There is also authentication and integrity guarantees in SSL.

That's my point. There is no guarantee about authenticity. Anyone can register a domain and have an SSL cert from Let's Encrypt in less than 15 minutes.

The only thing that HTTPS guarantees is that you are communicating securely with the person that owns the domain. That's it.

Re: HTTPS on Your Landing Page Is Important

#255

Post by astura »

astura wrote: post #235
foobarbazetc wrote: post #114

Earlier quoted context omitted.

To be fair Chase seems (on the surface) to have the best site/app/whatever of the major US banks. The app is pretty great.

What? Chase.com is horribly bloated. It takes a good 25 seconds to load. (I measured) I open it in another tab and just go do something else.

Also their passwords are not case sensitive (try it yourself)

Re: HTTPS on Your Landing Page Is Important

#256

Post by Titi67 »

Jaruzel wrote: post #231
dazc wrote: post #211

Earlier quoted context omitted.

marksandspencer.com very.co.uk asos.com next.co.uk and many more.

Other than shopping privacy, who cares? As long as the checkout and account management pages are https, then I don't see the big issue here. I'm just not one of these people who think there are armies of people at the NSA/GCHQ spying on me. I'm also against forcing every website in the world onto https. Doing so will significantly raise the bar of accessibility for tinkerers and makers. If I had a webcam that showed…

Well... you didn't read the article, did you?...

Re: HTTPS on Your Landing Page Is Important

#257

Post by tzs »

toomanybeersies wrote: post #124
morinted wrote: post #119

Earlier quoted context omitted.

BMO in Canada forces 6 digits or alphanumerics as your account password. No more, no less. What's worse, because it can be entered on the phone, aAbBcC are all == 1. So it's really just 6 digits.

Somewhere, in the background, there's a poor old unix mainframe running Cobol, unaware that the world around it has changed, and that it should put to pasture, where it can live out the rest of its days in peace.

I've heard of a bank actually trying to use that excuse when asked why their online banking passwords were so limited.

That is, of course, complete bullshit.

Sure, it is plausible that a bank has an old mainframe handling their accounts. It is also plausible that user account passwords on that old mainframe are only 6 or 8 characters and from a limited alphabet.

What does that have to do with customer online banking accounts? Nothing!

When you open a bank account they don't make a user account for you on their mainframe. What they make for you is an entry in an application database that their banking applications use. The only mainframe user accounts involved are the account that the database runs under and the account that the banking application runs under, both of which are the same for all banking customers.

Even if, for some strange reason, they do actually have to make a mainframe login account for each banking customer there is no reason for the banking customer to ever directly access that. Online banking is accessed through the web, so only the web server needs to access your banking account on the mainframe. They could make the website have its own password system, without the mainframe login restrictions. The restricted mainframe login information would only be known by the mainframe and the website back end. The banking customer should never deal with that.

Re: HTTPS on Your Landing Page Is Important

#258

Post by AngeloAnolin »

What's concerning here is that they could have easily bought a certificate and configured it to their site.

Instead what they did as preventive measure is to buy the domain name that Troy mentioned as one of the possible vector to spoof their site.

Hate to say this, but whoever made that decision as a course of resolution should be axed.

Re: HTTPS on Your Landing Page Is Important

#259

Post by MarkMc »

dan1234 wrote: post #238
MarkMc wrote: post #216

NatWest is also guilty of storing passwords in plain text: their login page says 'enter the 5th, 8th and 12th character of your password'

Who's to say they haven't just hashed each individual character of the password?

Does that offer any real protection? I could try each possible character until I find the hash.

Re: HTTPS on Your Landing Page Is Important

#260

Post by wlll »

Fun story, my once CC provider (the now defunct "Egg") for a period responded with three A records for their main site (egg.com or something).

This is fine, except one of these A records was a 192.168.x.x address so their site didn't work intermittently.

I called them to report it and they refused to listen. Claimed the site was worked as intended from their office and they wouldn't escalate.

Post reply on HN