Public Shaming of Companies for Bad Security

Nobody • September 18, 2018 5:14 PM

Can anyone pls explain to me why it is a good idea to enable blanket https? Why does, e.g. bankofamerica.com needs to be https? I understand about login pages and such…

Given that most of the discussed blog deals with bad ™ companies who don’t have https, I’d say it’s silly.

Somebody • September 18, 2018 10:12 PM

@Nobody

If you’re looking for a comprehensive list of the why’s… Troy himself has several blog posts about that, each with full lists…

Here are a couple important ones off the top of my head:

1. Without HTTPS everywhere, non-easily-detectable man-in-the-middle attacks are easy for evil countries, for evil internet companies, and for general evildoers who have hacked into internet infrastructure. Have a look at https://citizenlab.ca/2015/04/chinas-great-cannon/ for an example of this actually being used as a “weapon” to attack GitHub and take it offline for everyone! The best solution to prevent this from getting a lot worse and much more common, is to use HTTPS on every page of every public site, worldwide, with no exceptions.

2. HTTPS protects privacy better than HTTP… even for static content that doesn’t have a login. Non-encrypted communication lets ISP’s and governments build a mass database of every single word every single person reads online, whereas when it’s encrypted they can only build a mass list of servers everyone connects to (which is a lot less information, since it’s not at the individual page and content level any longer). Even letting the browser headers go by unencrypted lets everyone be fingerprinted to a high degree of accuracy. So we need HTTPS everywhere.

3. HTTPS (version 2) is actually faster than HTTP now, due to several technology improvements over the past few years… Who doesn’t want websites to load faster?

4. HTTPS used to be expensive and difficult. It’s no longer expensive, it’s totally free. We’re working on making it less difficult to implement (it’s much easier for website maintainers to set up than it used to be, but there’s still some ways to go to make it as easy as HTTP for everyone)

5. For all the above reasons (and maybe some more I forgot), browsers have been deprecating HTTP, and even have begun actively flagging it as “insecure” to warn people that it’s dangerous… If you don’t want the connection to your site to be flagged to your website visitors as “insecure” then use a more secure protocol, like HTTPS 😉

Somebody • September 18, 2018 11:41 PM

@Nobody

You said, “most of the discussed blog deals with bad ™ companies who don’t have https”

Here’s a list of what was covered in the blog post:

1. Tesco claiming they’re “storing passwords in a secure way” when they’re able to put them in plaintext “into a password reminder email”
2. British Gas claiming they’d “lose [their] security certificate” if they allowed people to paste in passwords from password managers…
3. Betfair claiming that it’s great security to allow anyone anywhere in the world to reset anyone else’s password, merely by knowing their email and date of birth… when pointed out that these are both commonly shared pieces of information, the company then claimed it’s a breach of terms to share them… It’s so ridiculous for a company to claim to ban everyone from ever celebrating birthdays or ever emailing anyone ever again (you know, for “security” reasons), that Troy orated for a while on this… and how later on he was actually thanked by a guy in Betfair security for sparking the public shaming that finally got through to management.
4. Some other unnamed bank who also could not get things fixed until they were publicly shamed.

5. NatWest‘s home page is insecure. Which means it can be attacked, and changed (man-in-the-middle), to change the login link…. (which of course the login page is secure, but if you can’t trust the link to it, how can you know you went to the right place when navigating there, maybe you went to a phishing site login instead…) This is the whole HTTP vs HTTPS debate, which Troy discourses on for some time.

6. Santander UK claiming nobody should use password managers for “security reasons”…

7. Someone claiming it’s wrong to shame companies (like Santander), because all it accomplishes is harassing some “poor clueless customer service rep”…

8. Others making the same claim when T-Mobile Austria defended storing passwords in plain text (and they claimed their security is “amazingly good”)… Troy then sermonizes for quite a while how these social media accounts are the public face representing the company, and how they should act…

9. Medibank also disallows pasting passwords from password managers… but fairly quickly fixes it (as an example of good response from customer service)

10. TV Licensing site not using HTTPS even when collecting sensitive data from millions of customers! They claim it’s “safe… despite messages from some browsers” saying it’s not.

11. Two people shaming the shaming of TV Licensing again… but it works anyway, the site is fixed.

12. Someone saying they are “fed up [with] social media managers/comms teams taking control and making erroneous statements”… Take responsibility for what you do, and fix it, is the conclusion!

Any way you slice it, whether by number of incidents named, or by number of companies mentioned, or by number of social media posts shown, or by literal space taken, HTTPS doesn’t look like the majority of it to me… (just #5 and #10 in my list)

Somebody • September 20, 2018 12:44 AM

@Hmm

With regards to HTTPS being “faster” now than HTTP….

Right.. I wasn’t very specific or explanatory about this… Here, let me explain in more detail. First, see this:

https://http2.github.io/faq/#does-http2-require-encryption

The important bit is the last part of the answer, where it says:

However, some implementations have stated that they will only support HTTP/2 when it is used over an encrypted connection, and currently no browser supports HTTP/2 unencrypted.

Thus, even though the standards bodies could not get the consensus to make HTTP/2 require encryption, the browser makers did an end-run around that… Since no browser in existence now supports HTTP/2 without it being encrypted, effectively all encryption now that uses the newer protocol (which is a lot of it by now) is way faster than old fashioned non-encrypted web traffic. Thus, the net result is effectively, all newer HTTPS in use (with any reasonably recent browser and server using the new HTTP/2 protocol) is much faster than HTTP.

So, therefore, use HTTPS. It’s now faster than HTTP. (this statement is true in all practical terms, due to the way real modern web browsers actually work, not due to what’s technically possible in a lab)

Nobody • September 21, 2018 6:34 AM

@Somebody:
3. HTTPS (version 2) is actually faster than HTTP now, due to several technology improvements over the past few years… Who doesn’t want websites to load faster?

Ok, so my lynx works faster over dialup than firefox over 10Gbps fiber optic wire. Therefore, dialup is faster than fiberoptic!

Nobody • September 21, 2018 7:42 AM

@Somebody:
2. British Gas claiming they’d “lose [their] security certificate” if they allowed people to paste in passwords from password managers…

I agree with them. Do you really trust your clipboard? Of course, if ppl could be trusted to use dedicated keyboards thaf come with passwd managers, e.g. keepass2android. FWIW, it’s not their fault, but a deficiency in Web browsers. In principle, users should be able to control how they enter information.

I’d say, Troy Hunt should learn that there exist many wonderful browsers beyond FF and Chrome.

Nobody • September 21, 2018 7:46 AM

@Jesse Thompson:
It’s why I shred a majority of documents that I dispose of whether or not they have sensitive data on them: whoever’s going to piece together sensitive documents will have a harder time with a lot of red-herring pieces thrown into the mix.

Would you keep doing it if you needed to pay 10 cents per document? Or if the electricity suddenly became more expensive, so you’d have to pay more for operating your shredder?

Https incurs concrete costs in terms of electric bill, as well as bandwidth. This is the same reason why I’d be against blanket usage of pgp signed email…