HTTPS on Your Landing Page Is Important

https://www.troyhunt.com/im-sorry-you-feel-this-way-natwest-but-https-on-your-landing-page-is-important/

by f2n • 9 years ago

639 286 9 years ago

troyhunt.com

paulddraper4• 9 years ago

Troy is way overstating the case.

You want to know if the login page is NatWest?

Click on the Login link and look at the browsers security bar.

If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great.

It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution.

It seems far more likely that you care about the entity you are working with (Royal Bank of Scotland), than the domain of the referring page (personal.natwest.com).

lucaspiller• 9 years ago

NatWest is a subsidiary of RBS.

umanwizard• 9 years ago

What fraction of users will do this, in your opinion?

paulddraper4• 9 years ago

About the same number of people that have been MITM'ed for personal.natwest.com and divulged login information.

tony101• 9 years ago

The issue is that users tend not to notice the absence of EV security indicators. If they see a padlock (which a phisher could get for a phishing domain), they assume it's secure and enter their credentials.

Also, it may not be apparent to users whether "The Royal Bank of Scotland Group Plc [GB]" would be affiliated with NatWest. Companies often have different names they do business under.

paulddraper4• 9 years ago

Companies often have different names they do business under.

If the name is unrecognizable for users, _that_ is the user security concern that you should be posting about.

That handles the widest array of security vulnerabilities on http://personal.natwest.com/, whether MITM, compromised site, misspelled domain, etc.

f2n3• 9 years ago

And if you aren't familiar with the details of how web browsers work (eg most people who use them), you would have no idea something was wrong. Not to mention potential problems such as http://stripe.ian.sh

steve_musk• 9 years ago

Uhh, yeah you could do that. Do most people do that after they click the login page on their bank's website? No.

The issue is that most non-technical users would not even think about checking. They went to their "secure" bank website and clicked login, why should they have to worry?

theptip• 9 years ago

Unfortunately EV certs are not bulletproof:

https://arstechnica.com/information-technology/2017/12/nope-...

For ~$170 apparently you can get an EV cert for "Stripe, Inc" (by forming a company with that name).

Even aside from that fact, users are very bad at knowing what a secure site looks like. I would wager that if most users clicked "login" and didn't see an EV cert, but instead saw "<padlock> Secure" (i.e. a non-EV HTTPS connection), they would not notice the difference.

Troy is right to kick up a fuss about this; this is a significant attack vector (anyone on a wifi network can MITM your banking login URL), and it's more egregious because of how easy it is to set up HTTPS.

paulddraper4• 9 years ago

Domain names don't solve that either.

For one tenth that cost, you can register stripeinc.net and get an SSL cert. Yay!

Domain registration is available instantly for anyone, anytime, and it can be phished at least as easily as anything else. https://www.xn--80ak6aa92e.com/ looks pretty legit in Firefox.

chickenfries• 9 years ago

Or put another way, don't notice the absence of "The Royal Bank of Scotland Group Plc [GB]". Or don't notice if it's been changed to "RBSG [GB]" or "Royal Bank [GB]". Then there's this:

https://stripe.ian.sh/

ithilglin909• 9 years ago

I think Troy will be just fine -- it's the average user NatWest should be protecting.

latortuga• 9 years ago

Wasn't there a post on HN just yesterday about EV certs not being a secure method of authenticating the website you're on? Something about Stripe being spoofed.

The case is not overstated in any way, serving a major trust-building page like a bank homepage over HTTP is crazy. Redirecting to a spoofed webpage is obviously the simple hijack but there's no reason some attacker couldn't drop some custom-built HTML and JS to drop a faux-login form right on the page that's filled with copy about how trustworthy the bank is.

Sidenote: several years ago my bank started POSTing their login form to a completely separate domain to login to my account. So I fill in the username field on the homepage and it sends me to "totallysecurebankloginsite.com" to enter my password. After a few calls to the bank they insist that this is the design they intended and that it's just fine.

niftich• 9 years ago

Just one day prior, I wrote that people's mental model of the benefits that EV certs confer is broken [1]: "an EV cert asserts that the domain name is controlled by a legal entity in some jurisdiction. This is a very distinct notion from the site that you've arrived at being the site that you were intending to visit, but people use it as a terrible, flawed proxy for such."

This was on the topic of an EV cert being issued to a different 'Stripe, Inc'.

But also, I observed that for top sites, "people trust their website by fiat, simply by mental associations about their domain names (...)". This is why HTTPS on a landing page is so important: to safeguard the trust chain that most users use to arrive at the login page -- first, the name of their bank, then the bank's URL from memory, then the bank's login page from the homepage's URL.

[1] https://news.ycombinator.com/item?id=15909273

dasil003• 9 years ago

Dude, you could walk into a coffee shop in the UK today, set up a honeypot wifi, and over the course of a day collect a handful of credentials with direct access to bank accounts. Unlike the US, once you're into an account you can send money directly and more or less instantaneously to any other UK account. Assuming every single person is verifying the cert/domain after they click the login link is batshit insane, I guarantee you no more than 10% of people would even have a chance of noticing.

wepple2• 9 years ago

Most users check the URL when they first browse to a page.

You want them to continuously keep verifying it’s the correct domain/cert just because this company is too lazy/cheap to buy a cert?

cdancette3• 9 years ago

Maybe someday browsers won't accept http connections by default (except for a few domaines defined for test purpose, or for some specific tld like .local)

Only then we can have 100% of the web encrypted.

f2n3• 9 years ago

It's moving that direction. As it stands, any website can opt-in to this behavior for future visitors with HSTS[0], or even for first time visitors with HSTS preload[1]. And Google has been doing HSTS preload on their .google TLD for several years, and recently rolled it out to their .foo and .dev [2] TLDs

[0] https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

[1] https://hstspreload.org/

[2] https://security.googleblog.com/2017/09/broadening-hsts-to-s...

WorldMaker• 9 years ago

There were a lot of complaints about Google doing that with .dev given the number of other companies and developers that use .dev for random LAN things, but an HSTS Preload for random LAN things isn't a bad idea in that it can prevent some types of mistakes going to production like bad HTTPS->HTTP redirects in an application. Obviously, Google themselves thought it a good idea to test that in their development environments.

scott_karana• 9 years ago

I was excited until I realized that HSTS Preload is just a hardcoded list in the Chrome source!? Ugh, that's sort of disappointing :(

Couldn't something like a TXT record also address this, but on a cross-client, scalable fashion? Like how SMTP with SPF or DKIM works right now.

(And yes, I know DNS also has trust problems!)

At the very worst, a central, programmatic source of truth, like DNSBL and company... just like how Google offers their "malware sites" hash table for all to use.

JepZ3• 9 years ago

While I understand why HSTS makes sense I hate it and I think it comes from poorly tooling around it. Two examples:

1. HSTS Preload: I am not 100% sure but, AFAIK your browser gets the list once during installation and then sticks with it until he receives another software update. I think the list should be dynamic (e.g. like adblock lists). That way even older browsers would have an up-to-date HSTS Preload list.

2. Like everything else HSTS records have a lifetime, but when you use your dev-tools to delete your browser cache it doesn't delete the HSTS information. So every time you want to delete them you have to go to some net-internals... browser configuration to explicitly delete a HSTS record for a specific domain. It's even easier to delete serviceworkers...

For a long time I also didn't like that you could not easily remove your own domain from a preload list, but that fortunately changed and now there is a website where you can easily request to be deleted from the preload lists. The only hitch here is that as it takes a few month until every browser on this planet got a software update the new list will also have to wait for a while: https://hstspreload.org/removal/

cortesoft2• 9 years ago

Yeah, until that happens we won't ever be really secure.

I mean, take this case; lets say NatWest DID put their landing page behind SSL... well, lots of people are going to try to go to http://<url> instead of https://<url>. Most site will redirect the user to the https version, but if an attacker hijacks the initial request, they could easily serve up a fake version of the landing page that has a 'login' link to the malicious site.

Now, at least if NatWest was redirecting http to https, a savvy user could notice that their session wasn't being redirected to https and could be aware something was wrong, but if you didn't know to check, you could be fooled.

There is nothing the site owner can do to prevent that sort of hijacking.

londons_explore• 9 years ago

HSTS Preloading solves that problem.

nerdponx3• 9 years ago

At that point, will we start seeing attackers targeting DNS instead?

rocqua3• 9 years ago

You need to get to global DNS to get a valid cert. When certificate transparency logs become mandatory, that case will be detectable though not preventable.

konschubert• 9 years ago

That feeling when you're arguing with an idiot, and the idiot isn't listening because he thinks it's YOU who's missing the point.

ethbro• 9 years ago

The important thing for all of us to remember, is that in any given conversation we may be idiot.

Until I'm sure the other person doesn't know what they're talking about, I try and assume they're right.

QAPereo• 9 years ago

The problem is that for all of the stereotypes to the contrary, tech is really full of people who worry, "Am I wrong? Am I the idiot?" Banks clearly don't attract the same kind of person, with the same intellectual gifts and challenges. Your advice is great, but it's probably already being taken to a fault by people like Troy Hunt, and people like the goober on the other end of the line think Dunning-Kruger is a brand of champagne.

msla• 9 years ago

The most important scientific mindset is being willing and able to prove yourself wrong.

It's an important legal mindset, too, because it's an important mindset for any honest debater: You prepare an argument by attacking it, and trying your damndest to be the best argument for the opposition you can possibly be.

That's important in moral issues, where there arguably is no "right answer" to certain questions, but it's vital when things come down to factual questions where one position is right, any other position is wrong, and being able to recognize when you're holding a position which is wrong is vital to being honest, not only with others but with yourself.

Twirrim• 9 years ago

The important thing for all of us to remember, is that in any given conversation we may be idiot.

Alternative take, particularly pertinent to this situation:

The person handling twitter is not a technical person, but a customer support person who handles hundreds of dumb questions, day in, day out, from customers who have no clue what they're doing but will often throw technical terms around.

Expecting solid technical answers from a general twitter account for a business is beyond absurd.

EADGBE3• 9 years ago

Unfortunately, you're a minority in this.

leesalminen• 9 years ago

Probably not a good person to piss off.

Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox shouldn’t tell users it’s insecure. Within hours his database was pwned.

nkkollaw3• 9 years ago

And it's so easy for anyone nowadays to get SSL with Let's Encrypt...

I remember a few years ago when there was no way you could do it for side projects because certs were 100/yr., now they're free.

megy• 9 years ago

It is not easy if you are on a shared domain and it is not supported by your host. Please don't run around saying it is easy for everyone.

nanoscopic4• 9 years ago

Are you suggesting that Troy Hunt is involved in illegal pentesting ( pwning their db )? I really doubt that. He is an industry professional.

The problem is not pissing off Troy Hunt; but more that they are advertising that their website is vulnerable and that they don't care.

drspacemonkey• 9 years ago

I think it was more that Troy Hunt is incredibly high-profile in the security arena. If he blogs that your site security sucks, some of his readers will prove it.

swsieber• 9 years ago

I took as more of a "if troy is pissed at someone, then everyone knows the person he's pissed at is hackable" statement.

skeletonjelly• 9 years ago

Flagged hey? I'm serious, look at his LinkedIn if you don't believe me. His professional title is PluralSight author which he put on his senate inquiry docs. His CV for that was his LinkedIn page

sundvor2• 9 years ago

The funny thing is, checking their web site they still haven't managed to secure their landing page. You'd think they'd get the message when everyone's just laughing at them...

EADGBE3• 9 years ago

To play devil's advocate:

everyone = Hacker News

Mostly likely not their customers; whom they have a vested interest in keeping money with.

tc313• 9 years ago

Here's the story: https://arstechnica.com/information-technology/2017/03/firef...

CoryG89• 9 years ago

Isn't (not) needing HTTPs kind of unrelated to your database being pwned though?

toomanybeersies7• 9 years ago

The person who owned the website said this:

We have our own security system, and it has never been breached in more than 15 years.

Which leads me to believe that their system was built by scratch, in PHP, 15 years ago, and hasn't been updated since.

gerdesj3• 9 years ago

No Troy and co do not work like that - per se. What is most likely is that someone noticed the public discussion and took advantage. I see where you are coming from but the fix was easy and wasting time whining about being called out on rubbish practice was the wrong response.

Besides, if the DB was pwned, it is unlikely that http -> https would have any real bearing anyway. There was probably a XSS exploit or whatever.

mulmen• 9 years ago

I think in this case it's some kind of a broken window theory.

If you don't think HTTPS is important you're probably not worried about SQL injection either.

davchana• 9 years ago

It was some big oil company, blaming Mozilla for the NotSecure tag near input boxes.

bribroder• 9 years ago

So more specifically, HTTPS on pages where you log in is important, not necessarily on your landing / homepage? I am not disputing that may be a good idea, but it seems like the main complaint is that users are submitting credentials on an HTTP page?

i80and• 9 years ago

This is exactly the opposite of what the article states.

The HTTP landing page serves a link to the login page. This link could be modified by a hostile network to another site. The fact that the login page is served over HTTPS is immaterial for this attack.

pmelendez• 9 years ago

Honest question...

Under that attack, wouldn't be the same whether you are using https or not? If you are in a hostile network with a compromised DNS, Couldn't the domain be phished too? Meaning that a valid certificate trusted by a fake CA would be used by the browser?

adamson• 9 years ago

Nope, you can MITM the HTTP-only landing page so the link to the login page takes you to a page that looks just like the actual banks login page, but actually just submits your credentials to an attacker.

Modifying the link would not be possible if the landing page were served over an encrypted connection.

choward• 9 years ago

Not to be a dick, but did you even read the article? Is the video what confused you? He's showing that he changed the homepage to link to a login page that he controlled.

freeflight• 9 years ago

That edit, about NatWest buying up the example domain to "fix" the problem, gave me real good laugh. It's interesting how simple mindedness can be so unexpectedly expected.

quickthrower23• 9 years ago

Actually that is a smart thing to do in it's own right, as long as they quickly move to https.

yjftsjthsd-h4• 9 years ago

Not even predicated on HTTPS; owning more domains helps combat some obvious forms of fraud. Though, really, I agree that HTTPS is more important.

andrewflnr• 9 years ago

Yep. I laughed out loud in an empty room at that one.

marksomnian• 9 years ago

Alarmingly though, nw0lb.com is still available as is nuu0lb.com and it-doesnt-matter-because-that-isnt-the-point.com.

My sides.

JepZ3• 9 years ago

Well, they probably got a process for buying domains, but changing the websites architecture requires a project/task-force/whatever, which can't be set up so quickly (I'm just guessing).

ivanbakel• 9 years ago

you could go register nuuolb.com right now

Not anymore!

https://www.whois.com/whois/nuuolb.com

It seems NatWest has quickly gone to secure this major attack point in their otherwise chink-free armour. Does someone want to inform them about nwalb.com as well?

cdancette3• 9 years ago

This is mentioned in the article. He also mentioned they didn't buy nw0lb.com and some other domains.

zodPod2• 9 years ago

Gives me an idea! Why not go buy up a bunch of these types of names then tell them that they look similar to their login url. THEN when they come to try to buy it they find you own it and then charge them an arm and a leg for the domain?!

cdancette3• 9 years ago

That's typosquatting and it's not very ethical. It's also in a grey legal zone, you might get sued for this.

So I would advise you not to do it.

tachion2• 9 years ago

I'm not really surprised, UK banks are absolutely terrible in terms of their product and even worse in supporting clients having valid points. Another example would be MetroBank that recently changed password prompt to a masked password prompt (in addition to already existing masked PIN alongside) ignoring the research proving its a horrible user experience and in fact lowers the security or (not a bank, but still major company) Three mobile provider that asks your for your password while calling in for support. You heard it right, support representative asks you for your password to verify you are the account holder. There is no other way and no amount of explaining that it's insane and won't happen till I'm conscious was able to convince them to stop.

tolien• 9 years ago

Three mobile provider that asks your for your password while calling in for support

When I got a new nano-SIM (in 2012, one hopes they've changed this since), they didn't check any ID and only needed a postcode and date of birth to move my account to a new SIM.

IneffablePigeon• 9 years ago

When I went in a couple of months ago to do the same thing (_slightly_ more complicated situation - I had two accounts but only one SIM card and had topped up the wrong account), the store manager told me he couldn't help me and handed me their store phone dialled to their call centre (!).

The man on the other end of the phone was totally unable to solve my problem and in the end just gave me £10 of free credit on the account I'd meant to top up. He didn't ask for any ID or verification at any point, except for the serial number on the SIM card. It was a pretty bizarre customer service experience.

sumitgt• 9 years ago

I think it's not just the UK. In fact, in many countries you don't have enough protections for security researchers. So no one bothers reporting these things because it would get you in trouble.

philipwhiuk2• 9 years ago

I'm with Three and I've not encountered that. That's terrible and I'll probably change my password.

But Nationwide is pretty good for banking.

tachion2• 9 years ago

I've had to deal with the call-in support twice in last 6 months and each time I was asked for my actual password (no one asked me for any 'telephone password' but I don't have one and even if I would, I wouldn't tell it to anyone either). Given I wasn't inclined to do so, after trying to explain how wrong this practice is, trying to escalate it, in the end I've meet the similar wall of 'we are sorry you feel this way, can we help you with something else?'.

mathw2• 9 years ago

When I was with Three they had a phone password which was not the same password as my online account password. I have nothing informed to say on the security of this approach, other than that asking customers for their online account password would be completely unacceptable in all circumstances, and shouldn't even be helpful because as we all know passwords should not be stored in a reversible format.

rikkus• 9 years ago

Giving them the benefit of the doubt, if they're asking for a phone password, hopefully they're just keying it into their systems for verification against a hash, not manually comparing to a plaintext copy.

kaycebasques2• 9 years ago

A great example for why we (the Google Web Developer Relations team) advocate for HTTPS everywhere.

https://developers.google.com/web/fundamentals/security/encr...

blakesterz3• 9 years ago

Why is it you (or someone there) chose "Secure" in the address bar rather than something like "Private"? It seems like the people who don't understand what httpS means at all see "Secure" and think "oh this site is safe/secure" no matter what this site is, like if it's a phishing site. I'm not one to be very pedantic, but "Secure" up there really doesn't mean "Secure" at all. I know what it means, but people falling for dangerous sites don't get that at all. I don't really know what the best word is, but "Secure" seems like not the best choice there.

[Edit] Thank you to those people who had some honest replies, not sure why this got down voted, it was an honest question. When you go to the "Learn More" page on Chrome it doesn't even say "Secure" it says "Information you send or get through the site is private."

kaycebasques2• 9 years ago

Words are hard. Anyone got an idea for a better word? Send your ideas to the security-dev mailing list (at least, I think that's the best forum...): https://groups.google.com/a/chromium.org/forum/#!forum/secur...

UncleMeat2• 9 years ago

This is bikeshedding. The only users who would be able to distinguish the meaning of "secure" and "private" in their address bar are people who already understand what https is and isn't.

nkkollaw3• 9 years ago

Couldn't "private" also not mean "private"? For instance: when you're on Facebook, couldn't people think they are exchanging private messages because the address bar says "private"?

"secure" means "secure connection" to me, and it sounds perfectly appropriate. Maybe you can't find a better term for "secure" because it's perfectly fine, already..?

tyingq• 9 years ago

Google likes https for their own selfish reasons. Yes, it's still a good thing. But what Google really likes is that it keeps ISPs, hotspot operators, and others from enjoying the same ubiquitous traffic snooping they get via AdSense, Google Analytics, Android, Chrome, their CDN, etc.

It's nice that their goals align with something actually helpful. But don't mistake the motive. This extends their dominance in global snooping.

quickthrower23• 9 years ago

A Bank! There is no excuse.

The thing about domains is that so many companies register companyname-someotherwords.com for legitimate use that if you are suspicious about the domain name you'll get little done. Azure is a case in point.

What if browsers record "tainted follows"? E.g. you visit http. Once you click a link, anything linked from there onwards is not trusted. No http post information is sent to the server without a hard to get around warning page.

cm2187• 9 years ago

Another lesson is to always host the login section on a sub domain of the company which website you visit. A prime example not to follow is Citibank in Europe. My account is with citibank.co.uk, but when I login to my account I get redirected to online.citi.eu. How do I know that citi.eu belongs to Citibank? I have no relationship with citi.eu, that’s not the website I visited. How do I know I can trust it?

Microsoft is another major offender. When logging in, I get redirected 20 times between various domains, none of which in microsoft.com

iaw• 9 years ago

Citi has some really bad security practices, when I talked with them about it they mentioned some future changes they were planning that were even worse.

nerdponx3• 9 years ago

What is the business reasoning behind this kind of domain name silliness?

astura6• 9 years ago

Citi just had a terrible IT team. Their website is always broken and their back end computer systems, until recently, were filled with reward loopholes.

mattmanser• 9 years ago

Ugh, MS just seem to get worse too, "Try our new login experience, it logs you out every 15 minutes, so much fun!".

wepple2• 9 years ago

I was looking up details of the new Microsoft Surface recently, so hit the top link in a google search which was (supposedly) on Microsoft.com

It wouldn’t load because Facebook.com was blocked and apparently they were doing a full redirect via fb. Crazy.

ocdtrekkie• 9 years ago

This may in fact be because Google lets advertisers set a totally different URL than the one that they actually direct you to, so that advertisers can implement various tracking schemes.

This is also exploited by malicious actors to occasionally buy out fake ads for amazon.com or bestbuy.com (or even, hilariously, youtube.com) which actually direct you to support scam websites claiming your computer is infected.

Google seems to have no desire to correct this by making their advertisements show you the actual URL are you going to be directed to.

Verify that any link you click on is not an ad. Always look for the first native result. The policies permitted around ads make them simply a security risk to click on.

mevile2• 9 years ago

You didn't click on a search result, you clicked on an advertisement.

toomanybeersies7• 9 years ago

Microsoft's sign in is a real mess, I think in part due to having to make your hotmail login that you made 15 years ago still work, along with the dozens of other services that MS has acquired or integrated.

I've had a real shitter of a time trying to login before, with redirect loops, or getting automatically signed out as soon as I sign in. Or accounts being a "games for Windows" account, but not an MS account, or an Xbox live account, so some other account. Often I've just found it easier to give up and make a new account.

chrisparton1991• 9 years ago

I hear you.

I was pulling my hair out the other day trying to find my Microsoft credentials in LastPass. I was searching for "microsoft", "office", "outlook" etc. until I finally found them under "live.com".

AgentME2• 9 years ago

A ridiculous number of times that I've tried to go to xbox.com while previously signed in, the site redirects me around a bit before dropping me onto a blank page. Ugh.

frik• 9 years ago

Microsoft login is still the very old Hotmail login dating back to 1996 or so. The Hotmail mail and account system got rebranded several times like MSN, Live, Outlook, Microsoft ID, etc.

Well, a login system is a very central part, and other websites suck too, like Amazon still uses the old account login page since 1996 too. But Microsoft redirects way too often, it is worse.

TuringNYC• 9 years ago

Speaking of Microsoft's signin, I can no longer access my decade-old-held Skype since their SSO integration. I've tried over and over and over and tried every route possible. It is some edge case where the email was previously a microsoft account and the password cannot be reset. I'm not the only one with the issue. Shocking something like this doesnt get resolved for years on.

momania• 9 years ago

I wanted to sign up for Office 365 a while ago. First thing that bothered me was the password limit of min 8 and max 16 characters (plus all the capital, special character, etc sacrifices you have to make). Second, after I signed up, you get a recommendation to switch off automatic password expiry! What the hell MS?

hug• 9 years ago

My citibank credit card redirects me to "cardservicesdirect.com.au" -- which reads like a phishing site if I've ever seen one.

I confirmed over the phone with their support that was indeed the correct site before typing anything into it.

snowwindwaves• 9 years ago

But did you call the support phone number shown on the dodgy domain?

flavor8• 9 years ago

My previous mortgage company was a subsidiary of CENLAR. So the corporate branding of the monthly bill listed x&y.com, the actual owner of the company was cenlar.com, and the mortage was paid at loanadministration.com, which until recently had minimal branding even tying it back to cenlar, let alone the company I ostensibly have the direct relationship with.

jjeaff2• 9 years ago

One of the worst I've seen is Franklin Templeton. They sent out snail mail telling everyone to go to a URL like "accountservices.biz" and reenter private information like your social security number in order to update your account records.

The site itself is branded just like Templeton's own site. From what I could gather, it is actually their site but even the whois is something non descript. Quite ridiculous. And of course they don't have any way whatsoever that I could find to report things like vulnerabilities or phishing attempts.

stuff4ben• 9 years ago

That would be a fascinating way to do a scam. Send snail mail to people directing them to a site that looks like a major company, ask them to enter in their PII and boom, there you go. Of course now you've committed untold amounts of federal crime by using the postal system and you'd definitely get sent to federal PMITA prison if you got caught. But I could definitely see this working on older people who, bless their little hearts, just don't know any better.

JohnTHaller2• 9 years ago

Microsoft's login experience has been generally broken for years. Multiple redirects through different domains. Heck it uses Javascript redirects. In 2017. So your back button won't work. And it has a habit of just not working. I went to visit a public page on docs.microsoft.com and wound up dead on a white page on login.live.com because it decided I needed to be redirected to login. Just to view a docs page.

drchickensalad• 9 years ago

What is the alternative to javascript redirecting when you can't do it as the http response?

noxToken• 9 years ago

I don't know if this is still the case, but you couldn't login if you had 3rd party cookies disabled. Somewhere in the authentication phase, it would silently fail. No error message like incorrect username/password. You'd get kicked back to the login screen as if you just got there. It was a hassle trying to find exactly which cookies were necessary.

heywire2• 9 years ago

It is even worse if you work for a large company with Office 365 that uses your organizations domain for authentication. I think there are about 6 redirects to get logged in. Even worse than that, they made us create a "personal" account with the exact same username for accessing MSDN because it wasn't compatible with our SSO at the time. So every time I log in, I have to type in my username, wait for the redirect, then choose personal account, wait for redirect, etc...

einrealist• 9 years ago

That is typical for organizations, where a DNS change takes weeks or months or isn't even possible, because of different legal entities. "Lets just register our own domain. Its faster...."

Having a bank as a current client, I am often joking about what would happen if Jeff Bezos takes control for a month. And when I am angry, I ask what would happen if Amazon or Google start selling credits or insurances, tomorrow.

nanoscopic4• 9 years ago

What is the exact problem here? Who would be doing a MITM attack on someone and how?

It doesn't seem to matter to me if my ISP is MITM, because someone inside the ISP would need to cause that. If my ISP is forced to MITM by government etc, I am in trouble anyway.

I could see that it could be done by using a bad/spoofed wireless or a public network connection somewhere. That makes sense. I don't do that though; I only use my own secure home network in a wired fashion when accessing my bank account.

If people are able to spoof my network connection, they could interfere with non-https software updates on my machine, which would let them replace the root certs of my browser potentially, in which case https wouldn't matter. Is the assumption here that all software updates on my machine are happening via https and only the bank website is a danger?

My point here is that while I agree what the bank is doing is bad practice, I don't see how it would affect me in any way.

moreira• 9 years ago

There are plenty of people accessing their banks on public / insecure networks; it’s folly to assume that MITM attacks just can’t happen. You yourself might not be at risk, but you’re not the only person out there.

The assumption is that yes, all of your machine’s updates are served over HTTPS. If they weren’t, then of course you’re right - it’d be possible to hijack your machine by serving malicious binaries. That’d be one hell of a security hole.

nanoscopic4• 9 years ago

I stated specifically that I agree it is bad in situations where you could be MITM. I also agree many people do that. My question here is only how it could effect me or people who follow the practice I follow.

jackweirdy• 9 years ago

Don't think about _you_, think about the layman. Who probably has a WiFi router from 5 years ago with outdated firmware that their ISP can't be bothered patching.

nanoscopic4• 9 years ago

The layman clicks on links that say "you have a virus; download this tool to remove it". They then click 'Yes I authorize' to verify that the downloaded program should be allowed to corrupt their machine.

I fail to see how the bank changing their website to HTTPS is going to save the average Joe.

There are so many websites and things that operate over HTTP that make our machines vulnerable, that I think it is foolishness to use a link that could be MITM to begin with.

That is, it seems to me, that if you simply avoid ever using wireless there is no danger of MITM. I could see that XSS could be done on some sites with ads, and that would be worsened by lack of HTTP.

Is it as simple as "Don't use wifi. Use adblock. HTTP/HTTPS then no longer matters." ?

logingone• 9 years ago

Natwest is RBS - there is no point interacting with them - useless. Same with many UK household names, once they reach a certain size you are not a person and what's in your head is of no interest to anyone.

dazc3• 9 years ago

This can, sometimes, work in you favour though since it is possible to get a county court judgement against these organisations for trivial reasons because the original claim isn't responded to.

JepZ3• 9 years ago

Well, the bank seems to be stuck in the past...

10 years ago it was best practice for ecommerce shops to serve non sensitive pages (pages without forms or user data) without HTTPS to reduce the server load (HTTPS connections are a little more expensive than HTTP).

Nowadays, even the economical driven ecommerce shops got it that is better to just serve everything via HTTPS. It is very sad to see a bank (which should really know better) arguing that way.

dazc3• 9 years ago

In the UK there are major ecommerce sites still on HTTP.

mprev• 9 years ago

Major sites, really?

4rt• 9 years ago

About 8 years ago Natwest had a policy of having a "browser whitelist" which was rarely updated. Each time a security update for chrome or firefox came out it would be 2 weeks before online banking was accessible, and using any pre-release versions were out of the question.

I complained and a member of the dev team phoned me up and after a long discussion about why this was madness he told me that it was better to use older browsers for important things such as online banking (like IE6 which was in their whitelist) because they're tried and tested.

adenta• 9 years ago

When I worked for Chase on their main app, the policy for support was the current version of the browser, minus one.

foobarbazetc3• 9 years ago

To be fair Chase seems (on the surface) to have the best site/app/whatever of the major US banks.

The app is pretty great.

TallGuyShort2• 9 years ago

Reminiscent of Amex's password policy (at least what it was a few years ago): can't use punctuation in your password, because those keys are less frequently used, and using them frequently in passwords will cause visible wear on the keys, indicating to an attacker with physical access to your keyboard which punctuation characters are in your password. Trying so hard, but failing so badly.

toomanybeersies7• 9 years ago

"we require passwords to be a maximum of 8 characters, because if they were longer, people would forget them, and would have to write them down"

I'm sure that has been said by some manager somewhere.

seanalltogether• 9 years ago

For some dumb reason the Bank of America website is ok with firefox on windows, but throws up a big red error message when you try to use firefox on mac.

https://www.bankofamerica.com/information/supported-browsers...

flyinghamster• 9 years ago

Oh, God yes - the same on Linux. I'm thinking that what I ought to do is go down to my local BoA branch and discuss (and demonstrate!) this to their branch manager. I can't help but feel I'd just get a brush-off if I tried to deal with this online or over the phone.

philipwhiuk2• 9 years ago

I'm so glad I bank with Nationwide who seem to do this right.

exabrial3• 9 years ago

It's 2017, and my social media account is protected by a tamper-proof phish-resistant embedded-encryption U2F microcontroller dongle, in addition to a password of virtually unlimited length and charset. Meanwhile, my bank has a max password length of 12 and I can only use an alphabet of roughly 64 characters.

The future is here folks. And it sucks.

morinted• 9 years ago

BMO in Canada forces 6 digits or alphanumerics as your account password. No more, no less.

What's worse, because it can be entered on the phone, aAbBcC are all == 1. So it's really just 6 digits.

toomanybeersies7• 9 years ago

Somewhere, in the background, there's a poor old unix mainframe running Cobol, unaware that the world around it has changed, and that it should put to pasture, where it can live out the rest of its days in peace.

lionelione432• 9 years ago

To be fair though, at least they offer the guarantee that if your online banking is hacked they will reimburse 100%. Though not sure how truthful it is having never needed it.

https://i.imgur.com/O2eOwLw.jpg

Edit:

"You may be liable for all losses from unauthorized use of your Account if you:

contributed to its unauthorized use; used a PIN combination selected from your name, telephone number, date of birth, address, or Social Insurance Number; did not use reasonable care to safeguard your Secret ID Code; did not keep your Secret ID Code separate from your Card; did not comply with your reporting obligations in Section 11 of this Agreement unless there were exceptional circumstances for your failure to do so; or shared a mobile device that you registered with us for Electronic Banking Services. In those cases, your liability may exceed the funds in an Account, your credit limit or any daily transaction limits. In other words, your liability will not be limited by your Account balance, your credit limit or any daily transaction limits. You must cooperate and assist in any investigation that we initiate into the unauthorized use you reported, which is a precondition to being reimbursed for any losses. This cooperation may include filing a report with law enforcement authorities."

Overall seems fair enough protection.

astura6• 9 years ago

I signed up for a US BMO account for the sign up bonus... Man is that bank's website bad. The version of jQuery they are using is from 2008 (1.3xx IIRC) and they give you a pop-up if you try to right click saying "right-click has been disabled for security purposes."

teddyfrozevelt• 9 years ago

It just took my terrible python program 9 seconds to guess 999999.

MiddleEndian• 9 years ago

Guess what! If your financial service restricts your password to letters and numbers, it's most likely because they want you to be able to enter your password on the phone.

So the passwords 'abc' 'ABC' and '222' are treated as equivalent. Try it out for fun!

sunsetMurk• 9 years ago

that's disgusting :-/

ktta• 9 years ago

What banks do this? AFAIK, Wells Fargo doesn't care about case-sensitivity but that's it.

ozim2• 9 years ago

I don't want to enter my password on the phone, I have fingerprint or pin in mobile banking app.

chrisshroba• 9 years ago

Source?

exabrial3• 9 years ago

/that noise when your head hits the desk

jjeaff2• 9 years ago

My bank only recently upgraded max password length from 8 to 12. Oh, and no special characters please.

mathw2• 9 years ago

By "special character", do they mean punctuation? Or the null byte?

piinbinary• 9 years ago

I know of at least one bank that requires your password to have exactly one digit. Not one or more, exactly one.

artursapek• 9 years ago

http://password-shaming.tumblr.com/

yosamino• 9 years ago

my bank has a max password length of 12

Look at Mr. PrivateBanking over there, my one is 5. Amount in words : Five.

And that is after they updated all their software and moved to a new datacenter and everything recently.

Granted I have a hardware dongle to authenticate any transactions, but to gain access to all my information, five characters is all the protection they wish to offer...

aembleton• 9 years ago

Why are you still with them?

astura6• 9 years ago

Your bank password is probably not even case sensitive: http://www.zdnet.com/article/surprise-online-bank-passwords-...

Offenders: Wells Fargo, Chase, American Express, Fidelity, ....

josefresco• 9 years ago

"The future is already here — it's just not very evenly distributed." - William Gibson

Macha• 9 years ago

I played Eve online for a while.

My corp (guild for non-Eve players) had a better and more secure login & SSO system than either my bank or my employer. My employer has replaced their SSO system by now, but my bank is still in the 90s.

palencharizard• 9 years ago

it-doesnt-matter-because-that-isnt-the-point.com

yjftsjthsd-h4• 9 years ago

What is the point?

SAI_Peregrinus2• 9 years ago

An insecure page can be MITMed. The landing page is insecure. The links from the landing page to the login page can be redirected by an attacker to go to the attacker's login page. Links on HTTP pages cannot be trusted. NOTHING on HTTP pages can be trusted.

syncsynchalt4• 9 years ago

Buying every domain name that could possibly be confused with yours would be unnecessary in this context if you fixed the issue of an attacker being able to redirect to another name.

(Banks should also protect against easily phishable domain names but that's a also losing game, and in that case the technical solution is not as simple or complete).

toomanybeersies7• 9 years ago

A bit side topic:

It seems that every time Troy interacts with a company on Twitter, they never seem to click on to who he is, until it's probably too late and they look like fools.

It's just so amusing to see companies trying to condescend to Troy, when he's one of the most visible authorities on web security on the planet (not necessarily the most authoritative, but the most well known).

I occasionally get this when people try talking to me about computer science topics, when they don't realise that it's what I do for a living. I've probably done the same myself when talking to Doctors and other domain experts, I'm sure.

wruza• 9 years ago

Authority is a bad thing here, since the person who spoke to him is in a shadow of his own tech team authority. Don’t get me wrong, but if there is an objective security/xyz problem, then it doesn’t matter who’s reporting it and what does he make for a living.

madaxe_again2• 9 years ago

This being NatWest the penny probably still hasn’t dropped, and they’re probably trying to get him arrested for “hacking our internet”. I doubt they’ll actually implement a change. The general approach in the UK has been to not blame banks at all for poor security, and to punish anyone who finds a security issue severely.

ZoFreX2• 9 years ago

NatWest are particularly terrible. Last time I checked, in-branch they were still using Internet Explorer to visit an http (not https) site on their intranet to launch via Java Web Start a thin client to log in to their (I assume) mainframe to actually do things.

There's a number of places in that chain of events that something could go nastily wrong, despite them owning every part of that chain.

volgo• 9 years ago

I've never heard of him, and probably so haven't a lot of people on Twitter. I don't see why we should give him authority

OliverJones2• 9 years ago

A tweet from Troy Hunt is like a telelphone call from Brian Krebs: a sign your day is not going to get better, if you're a company infosec person.

syncsynchalt4• 9 years ago

Could be worse; could be @taviso.

wyldfire• 9 years ago

Alarmingly though, nw0lb.com is still available as is nuu0lb.com and it-doesnt-matter-because-that-isnt-the-point.com.

I can just imagine NatWest: "Oh, is that the problem? Ah, ok, well, let's just go get that domain then. Sorted!"

sandov• 9 years ago

It would be acceptable for your local Chinese food restaurant to serve their landing page without https. But a bank? of all things? A FUCKING BANK?.

jacinabox• 9 years ago

I followed out this logic, and concluded that all pages on a site have to be encrypted, because someone may try to navigate to the login page from any page on the site. If the attacker can intercept one page they can lead the user to their own site (possibly even HTTPS, but with the wrong certificate). In a perfect worlds users would always check which certificate they're trusting (and have a plausible way to check who it belongs to) but that is not the real world.

syncsynchalt4• 9 years ago

Agreed, every page should be encrypted.

And the user shouldn't need to check the certs - if the CAs are trusted (yes there are problems there) then the domain name is enough.

kuon• 9 years ago

I think the main point is to explain this kind of issue to non tech people.

A bit of programming, but most importantly, general concepts required to understand this kind of issue should be common knowledge.

For me it falls in the same category as the people putting an IP camera to watch their son sleep and broadcasting it to the whole internet. This kind of issue should be understood by them.

In this case, if the "banking manager" was aware of how security works, the issue would not have presented itself in the first place.

thorin1• 9 years ago

Scotiabank, one of the biggest banks in Canada, has the same issue:

http://www.scotiabank.com/ca/en/0,,2,00.html

Didn't find any contact to report it. Is Twitter really the right place?

antoineMoPa• 9 years ago

The fact that there is no HTTPs on a brand's landing page is no reason to annoy PR dudes on twitter though.

I think the attitude here is kind of douche.

jimnotgym• 9 years ago

I wonder how GDPR would change this attitude? If Natwest were to lose some data after May 18 and it was possible to show that they were warned about the problem by a reputable professional, then they are more likely to get fined, one would presume. Maybe this legal liability is what $bigcorp needs

arthurfm• 9 years ago

Monzo [1], Starling [2], Atom [3] and Tandem [4] all manage to have HTTPS landing pages. If they can, there isn't any excuse for the more established banks not to as well. Hopefully their mobile apps use HTTPS for everything too?

Apparently 35% of all UK banks have insecure landing pages. [5][6]

[1] https://monzo.com

[2] https://www.starlingbank.com

[3] https://www.atombank.co.uk

[4] https://www.tandem.co.uk

[5] http://blog.softwareverify.com/list-of-uk-banks-that-are-sec...

[6] https://twitter.com/softwareverify/status/940961044633149440

ZoFreX2• 9 years ago

Hopefully their mobile apps use HTTPS for everything too?

Well, HSBC's didn't: https://threatpost.com/banking-apps-found-vulnerable-to-mitm...

stevefan1999• 9 years ago

Yes, not only your landing page should be getting HTTPS; instead all websites should have had HTTPS already, this will gave the users/customers a sign of safety and trust.

bArray• 9 years ago

Anyone want to hear a joke? Go to the financial ombudsman homepage [1]...

Bare in mind, on their complaints page you can download a complaints Word document, fully capable of having embedded VB script [2].

Also, it took them _months_ to sort out an issue where they would only check for 3 numbers (pin) and 3 letters (password), always asking for the first, second and third characters.

Also-also, I remember a while back not being able to access my card (for about a day) because a single engineer accidentally corrupted their main database.

[1] http://financial-ombudsman.org.uk

[2] http://financial-ombudsman.org.uk/consumer/complaints.htm

harel• 9 years ago

Not defending the practice of not securing your landing page in 2017, but for balance I must say that NatWest has probably the best banking mobile app I've ever used.

MarkMc2• 9 years ago

NatWest is also guilty of storing passwords in plain text: their login page says 'enter the 5th, 8th and 12th character of your password'

allyant• 9 years ago

To be fair we can't be 100% sure of that. It is possible they simply hash all the combinations they are going to show you. Could also be stored in an HSM making it a bit more secure.

dan1234• 9 years ago

Who's to say they haven't just hashed each individual character of the password?

MarkMc2• 9 years ago

Does that offer any real protection? I could try each possible character until I find the hash.

wlll4• 9 years ago

If you're storing individually hashed characters:

a: 0CC175B9C0F1B6A831C399E269772661

b: 92EB5FFEE6AE2FEC3AD71C777531578F

c: 4A8A08F09D37B73795649038408B5F33

etc.

then this is basically the same as storing the plaintext characters because as long as you know the hashing algorithm you can generate a pretty small map of hash -> original character and convert back.

erikb• 9 years ago

I thought we are on "all pages should be HTTPS" since 2010 or something?

syncsynchalt4• 9 years ago

It looks like some markets have gotten the message more quickly than others.

jwilk• 9 years ago

Note that https://personal.natwest.com/ has a valid certificate, but it redirects back to HTTP. :-(

AngeloAnolin• 9 years ago

What's concerning here is that they could have easily bought a certificate and configured it to their site.

Instead what they did as preventive measure is to buy the domain name that Troy mentioned as one of the possible vector to spoof their site.

Hate to say this, but whoever made that decision as a course of resolution should be axed.

wlll4• 9 years ago

Fun story, my once CC provider (the now defunct "Egg") for a period responded with three A records for their main site (egg.com or something).

This is fine, except one of these A records was a 192.168.x.x address so their site didn't work intermittently.

I called them to report it and they refused to listen. Claimed the site was worked as intended from their office and they wouldn't escalate.

a_c2• 9 years ago

There need to be a public directory for these websites. Something similar to https://haveibeenpwned.com/. Something like is-this-site-stupid.com.

Ridiculous password policy, http home page, virtual keyboard for password, loading javascript from http and what not..

ancarda• 9 years ago

Perhaps something like https://securethe.news/sites/ but for every website, not just news sites?

a_c2• 9 years ago

Thanks for the link! Yes, would love to have one for every website. And visitor can input a website for "stupidness"

HTTPS on Your Landing Page Is Important

Related Stories