Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Half of All Phishing Sites Now Have the Padlock

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 79 posts

Re: Half of All Phishing Sites Now Have the Padlock

#61

Post by cutler »

isostatic wrote: post #44
cutler wrote: post #34

Great so every 3 months when I have to manually renew all the LetsEncrypt certs I manage for clients I know it's giving them zero protection. Kinda reminds me of the British Government's decision to insert road humps into all the roads in the towns and cities of the land just to deter speeding drivers. All it produced was more work for garages mending damaged exhaust pipes.

Why haven't you automated it? It's not exactly hard to automate the renewal, that's the great thing about letsencrypt, and the whole point about the 3 month period is to encourage you to automate this stuff.

Not possible because the domains are pointed to the webserver from a different host. It has to be done manually with:

`certbot certonly -d $1 -d www.$1 --manual --preferred-challenges dns-01`

The TXT records have to be edited manually then checked with DNS Toolbox. Once visible certbot can be allowed to process.

Re: Half of All Phishing Sites Now Have the Padlock

#62

Post by cutler »

yebyen wrote: post #43
cutler wrote: post #34

Great so every 3 months when I have to manually renew all the LetsEncrypt certs I manage for clients I know it's giving them zero protection. Kinda reminds me of the British Government's decision to insert road humps into all the roads in the towns and cities of the land just to deter speeding drivers. All it produced was more work for garages mending damaged exhaust pipes.

Why are you manually renewing letsencrypt certs? The point of the 3 month limit is to encourage you to set up automatic renewal.

That's only possible when the domain is hosted on the same network as the site. Doesn't apply in this case. See above.

Re: Half of All Phishing Sites Now Have the Padlock

#63

Post by beatgammit »

andrewflnr wrote: post #54
Analemma_ wrote: post #37

Earlier quoted context omitted.

Most users do not understand the “necessary but not sufficient” condition. They need a “if (condition) { SAFE; } else { NOT SAFE; }” test, not an endless checklist, and the security community has continuously failed to deliver on this.

I'm pretty sure that's actually impossible. If someone registers a domain and cert that's essentially a homoglyph attack against a common website, you're basically stuck with heuristics to detect it. You need a global database of targetable domains that supports similarity checking with arbitrary Unicode. You need some kind of fuzzy hash of the website to see whether the website your user is looking at is actually an…

Whatever happened to the Web of Trust thing? We could have a curated one so that an extension can indicate:

- whether the domain is substantially similar to a trusted one - recent data breaches - whether the site has been known to sell data

Those could be indicated by different, intuitive colors:

- red - high likelihood of phishing/malware - yellow - recent data breach; user intervention required, but the service itself isn't fraudulent - green - reasonable safe - green padlock - trusted

It would be awesome to get all major browser vendors on board to ship it by default, and make sure that data is never sent upstream (download a database).

Re: Half of All Phishing Sites Now Have the Padlock

#64

Post by anoncake »

hanoz wrote: post #5
vezycash wrote: post #2

The many mobile browsers which hide the address bar are training people to ignore website urls. Sites who use lots of nonsensical malware-ish url redirects (Google, Microsoft are guilty) train people to accept random urls. I guess the chief culprits are email tracking links. Everyone including banks use them. Often tracking domains have nothing in common with the destination URL. This teaches people to disable or ign…

Banks and credit card companies have always been the absolute worst offenders for this, requiring people to use hidden iframes from all sorts of acmegenericsecure.net domains, and all the while professing to be the high priests of good practice with their absurd PCI racket, not to mention asking people to install random third party software just to use their websites because browsers apparently aren't good enough.

The sensible thing would be to have dedicated software for anything involving handling money, in particular banking. Then you could tell people to never interact with their bank using a web browser.

Re: Half of All Phishing Sites Now Have the Padlock

#65

Post by heyoni »

Mistri wrote: post #56
woodruffw wrote: post #49

Earlier quoted context omitted.

Chase likes to send emails from the not-at-all-suspicious "acctmanagement.com" domain[1]. [1]: https://twitter.com/8x5clPW2/status/1046244493203263488

Their reply to your tweet pisses me off

Not as bad as T-Mobile defending the practice of storing passwords in plaintext!

Re: Half of All Phishing Sites Now Have the Padlock

#66

Post by jspash »

woodruffw wrote: post #49
hanoz wrote: post #5

Earlier quoted context omitted.

Banks and credit card companies have always been the absolute worst offenders for this, requiring people to use hidden iframes from all sorts of acmegenericsecure.net domains, and all the while professing to be the high priests of good practice with their absurd PCI racket, not to mention asking people to install random third party software just to use their websites because browsers apparently aren't good enough.

Chase likes to send emails from the not-at-all-suspicious "acctmanagement.com" domain[1]. [1]: https://twitter.com/8x5clPW2/status/1046244493203263488

Google's use of gvt1.com had me convinced for the longest time that I was backdoor'd by some unknown branch of the government that was either not bright enough to cover their tracks or ballsy enough to just say "yea, it's us. the government. and we're in your computer"

Re: Half of All Phishing Sites Now Have the Padlock

#67

Post by olliej »

mr_toad wrote: post #50
olliej wrote: post #8

Well yes (that it’s only 50% is surprising), but realistically the presence/absence of a padlock is a terrible security indicator. Long term I would hope it goes away and you get an “insecure” UI only.

There are still valid reasons for not using ssl for everything. Internal facing sites, device admin pages, development servers etc. If I have to deal with obnoxious warning pages doing local Node.js development & testing I’m switching browsers.

internal facing site: so hopefully no logins, no confidential info, right? Similar for dev servers.

For local development localhost(and 127.0.0.1, and ::1) is explicitly in the definition of "secure" used by browsers and the html specs.

Device admin pages are about the only place you could legit claim the ssl isn't viable (because it isn't). But that's a problem that needs to be solved - if you can't make a secure connection to your device, then anyone can intercept the login creds. Those various peering steps required for a lot of new devices are explicitly there to act us a side channel to establish trust (either a shared key, or certs, or whatever) as until you have a source of trust that isn't from the network, you can't trust anything you receive from the device (and the device can't trust you).

Re: Half of All Phishing Sites Now Have the Padlock

#69

Post by yebyen »

cutler wrote: post #61
isostatic wrote: post #44

Earlier quoted context omitted.

Why haven't you automated it? It's not exactly hard to automate the renewal, that's the great thing about letsencrypt, and the whole point about the 3 month period is to encourage you to automate this stuff.

Not possible because the domains are pointed to the webserver from a different host. It has to be done manually with: `certbot certonly -d $1 -d www.$1 --manual --preferred-challenges dns-01` The TXT records have to be edited manually then checked with DNS Toolbox. Once visible certbot can be allowed to process.

Any reason you couldn't use the http-01 challenge? I think there are thousands of people who are using LetsEncrypt and have automated it successfully. So whatever you just said,

> all the LetsEncrypt certs I manage for clients

... if this contains some technical reason why it won't work, I think that's the problem.

But I'd be more inclined to believe you if you just told me that, your clients periodically need your assistance for other things, but they weren't going to call because as every good salesperson knows, "if you don't call, they don't come"... and since they trust you already, this is a reliable door-opener that gets you back into their offices, where you get to bill for something, even if this time they didn't need anything else... it gets you valuable face time and a pretty reliable, even if only nominal, payday.

If that's not it, then tell me that's not it, but... I think that's what you're doing. (And there's nothing wrong with that.)

Re: Half of All Phishing Sites Now Have the Padlock

#70

Post by Piskvorrr »

vezycash wrote: post #2

The many mobile browsers which hide the address bar are training people to ignore website urls. Sites who use lots of nonsensical malware-ish url redirects (Google, Microsoft are guilty) train people to accept random urls. I guess the chief culprits are email tracking links. Everyone including banks use them. Often tracking domains have nothing in common with the destination URL. This teaches people to disable or ign…

Whatever.ms/login? Mont-fricking-serrat? Well that's all but screaming FAKEFAKEFAKE.
Post reply on HN