Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Security is Too Hard

textslashplain.com

Post reply on HN
Print view View original

31–40 of 127 posts

Re: Web Security is Too Hard

#31

Post by OkayPhysicist »

LocalH wrote: post #21

Web security wasn't hard before we started trying to make the web a platform for full executable software. I never got hacked through the web before JavaScript (never got hacked after either, yet, but it wasn't really possible in the same way to hack someone through the web without some way to execute program logic , which in the old days would have required a much more specific browser exploit to gain RCE). JavaScri…

None of this required Javascript. At all. The same potential attack could have been done with good ol' forms. Sure, you think you're signing into "BigBensSuperStore.com", but you're actually handing your credentials right over to "BigBensSuperStore.net".

Re: Web Security is Too Hard

#32

Post by munk-a »

sholladay wrote: post #25
mirashii wrote: post #12

Earlier quoted context omitted.

What’s the point? To save money paying a human to man a support email. That human would have also been hopelessly uninformed for all the same reasons.

> That human would have also been hopelessly uninformed for all the same reasons. Not really. At minimum, a half-way decent support person would ask a few people internally or search Slack before answering. In fact, they would have likely already heard about the new product at lunch or something.

Most chat support people were contractors hired from third party companies that were given dossiers about their products that were often quite out of date because poor management has always been a thing.

Re: Web Security is Too Hard

#33

Post by spc476 »

Joker_vD wrote: post #3

Another entry in "Marketing department starts a promotion campaign for the new product that's indistinguishable from a phishing attack" list. Starting with not using a subdomain on your own, very well-known domain but instead using a completely different one, then not having it shown with the rest of your services on your main web site, et cetera.

It's probably easier for the marketing department to get a new domain up and running that it is for a new subdomain within their own company. Battling Business Units and all that.

Re: Web Security is Too Hard

#34

Post by OkayPhysicist »

epochbtc wrote: post #20

Ironically, this might be at least partially because the internal security controls at Cloudflare for using or provisioning new domains/subdomains is so difficult and arduous that the team decided the fastest way to go to market is to get an entirely new domain. Possible bonus that the official bug bounty program won't apply either, since it's on a new domain so any vulnerabilities found won't have to be paid out (as…

Why is this so, so common? They're subdomains. They're free. It's not hitting anybody's budget to publish a new DNS entry. If someone has permission to publish anything in your name, they probably should be able to go make themselves a subdomain.

Re: Web Security is Too Hard

#38

Post by Panino »

thataccount wrote: post #26
ericlaw wrote: post #22

Earlier quoted context omitted.

Note that I said: "One of my", and Cloudflare has hired a HUGE percentage of the best networking talent I've encountered.

Another company named Cisco used to do that. They built the Great Firewall of China. Hiring talent does not equal good company.

I hadn't read that so I looked it up to verify, and it appears true:

https://www.eff.org/deeplinks/2016/04/ciscos-latest-attempt-...

Cisco looks to have made money from repression and torture.

Meanwhile a large fraction of neo-nazis, credit card thieves, and DDoS-for-hire sites are on Cloudflare. It takes serious talent (not morals) to attack humanity at scale.

Re: Web Security is Too Hard

#39

Post by LocalH »

OkayPhysicist wrote: post #31
LocalH wrote: post #21

Web security wasn't hard before we started trying to make the web a platform for full executable software. I never got hacked through the web before JavaScript (never got hacked after either, yet, but it wasn't really possible in the same way to hack someone through the web without some way to execute program logic , which in the old days would have required a much more specific browser exploit to gain RCE). JavaScri…

None of this required Javascript. At all. The same potential attack could have been done with good ol' forms. Sure, you think you're signing into "BigBensSuperStore.com", but you're actually handing your credentials right over to "BigBensSuperStore.net".

JavaScript (and other forms of executing logic within the browser) have made the situation worse, though.

To me, there's a big difference between a domain misread and actively malicious code running in the browser context as a design point.

Re: Web Security is Too Hard

#40

Post by vntok »

sholladay wrote: post #25
mirashii wrote: post #12

Earlier quoted context omitted.

What’s the point? To save money paying a human to man a support email. That human would have also been hopelessly uninformed for all the same reasons.

> That human would have also been hopelessly uninformed for all the same reasons. Not really. At minimum, a half-way decent support person would ask a few people internally or search Slack before answering. In fact, they would have likely already heard about the new product at lunch or something.

> At minimum, a half-way decent support person would ask a few people internally or search Slack before answering.

Of course not. The extremely vast majority of support staff aren't connected to "internal people" and certainly don't have any access to the main company's Slack.

Most of all, those people are paid very little on very tight length-per-interaction targets. They can't spend any time at all looking for stuff outside the docs package or chatting with peeps outside the immediate costaff.

Post reply on HN