Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Half of All Phishing Sites Now Have the Padlock

krebsonsecurity.com

Post reply on HN
Print view View original

41–50 of 79 posts

Re: Half of All Phishing Sites Now Have the Padlock

#41

Post by ecesena »

sandov wrote: post #18

Noob question, if a.com gets a certificate, then b.a.com can use the same cert, right? As in the example of the fb impostor in 000webhost. So, in that same vein, can a TLD get a certificate? For example, com gets a certificate, so now anything.com has a valid certificate. Also, can I issue a cert specifically for d.c.b.a.com?

Yes, you can have a single certificate for both a.com and b.a.com. You can also have it for a.com and .a.com.

No, you can't get .com. Typically, at least for known root CAs, you have to prove ownership of your top level domain. If you own a.com, they'll ask you to either put a file on a.com/random, or register random.a.com. If you try to do so with .com, you'll likely fail (but please feel free to try and prove me wrong!).

Yes, you can get a certificate for d.c.b.a.com, I don't see any reason why not if you own a.com. Unless your specific root CA has constrains on the depth of the domains.

Edit: replaced '*' with

Re: Half of All Phishing Sites Now Have the Padlock

#43

Post by yebyen »

cutler wrote: post #34

Great so every 3 months when I have to manually renew all the LetsEncrypt certs I manage for clients I know it's giving them zero protection. Kinda reminds me of the British Government's decision to insert road humps into all the roads in the towns and cities of the land just to deter speeding drivers. All it produced was more work for garages mending damaged exhaust pipes.

Why are you manually renewing letsencrypt certs?

The point of the 3 month limit is to encourage you to set up automatic renewal.

Re: Half of All Phishing Sites Now Have the Padlock

#44

Post by isostatic »

cutler wrote: post #34

Great so every 3 months when I have to manually renew all the LetsEncrypt certs I manage for clients I know it's giving them zero protection. Kinda reminds me of the British Government's decision to insert road humps into all the roads in the towns and cities of the land just to deter speeding drivers. All it produced was more work for garages mending damaged exhaust pipes.

Why haven't you automated it? It's not exactly hard to automate the renewal, that's the great thing about letsencrypt, and the whole point about the 3 month period is to encourage you to automate this stuff.

Re: Half of All Phishing Sites Now Have the Padlock

#46

Post by Rjevski »

jstarfish wrote: post #11

Users are not discerning enough to look for the padlock; they'll get taken either way. They are not the problem here. The bigger problem with this is that the paths being requested can't be monitored by intermediary devices unless you're MITMing all outbound traffic. It becomes impossible to tell whether a domain is simply cybersquatting or if they're up to something more sinister. '/' may return a parking page, '/lo…

I think it’s still a worthwhile trade off.

The percentage of people using network inspection for “good” like malware/phishing filtering is much lower than the percentage using it for bad stuff like ad/cancer tracking.

Re: Half of All Phishing Sites Now Have the Padlock

#48

Post by dagenix »

cutler wrote: post #34

Great so every 3 months when I have to manually renew all the LetsEncrypt certs I manage for clients I know it's giving them zero protection. Kinda reminds me of the British Government's decision to insert road humps into all the roads in the towns and cities of the land just to deter speeding drivers. All it produced was more work for garages mending damaged exhaust pipes.

> Great so every 3 months when I have to manually renew all the LetsEncrypt certs I manage for clients I know it's giving them zero protection.

I'm not sure I understand how a server certificate was supposed to provide protection against an entirely unrelated server hosting a phishing website.

Re: Half of All Phishing Sites Now Have the Padlock

#49

Post by woodruffw »

hanoz wrote: post #5
vezycash wrote: post #2

The many mobile browsers which hide the address bar are training people to ignore website urls. Sites who use lots of nonsensical malware-ish url redirects (Google, Microsoft are guilty) train people to accept random urls. I guess the chief culprits are email tracking links. Everyone including banks use them. Often tracking domains have nothing in common with the destination URL. This teaches people to disable or ign…

Banks and credit card companies have always been the absolute worst offenders for this, requiring people to use hidden iframes from all sorts of acmegenericsecure.net domains, and all the while professing to be the high priests of good practice with their absurd PCI racket, not to mention asking people to install random third party software just to use their websites because browsers apparently aren't good enough.

Chase likes to send emails from the not-at-all-suspicious "acctmanagement.com" domain[1].

[1]: https://twitter.com/8x5clPW2/status/1046244493203263488

Re: Half of All Phishing Sites Now Have the Padlock

#50

Post by mr_toad »

olliej wrote: post #8

Well yes (that it’s only 50% is surprising), but realistically the presence/absence of a padlock is a terrible security indicator. Long term I would hope it goes away and you get an “insecure” UI only.

There are still valid reasons for not using ssl for everything. Internal facing sites, device admin pages, development servers etc. If I have to deal with obnoxious warning pages doing local Node.js development & testing I’m switching browsers.
Post reply on HN