10 ms·

And the hits just keep on coming... www.equifaxsecurity2017.com uses an invalid security certificate. The certificate is not trusted because the issuer certif

And the hits just keep on coming... www.equifaxsecurity2017.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported. Error code: SEC_ERROR_UNKNOWN_ISSUER

xrstf 9y ago
The cert is signed by GeoTrust and works perfectly fine on my Chrome on Windows 10. [Edit: Ah, the chain is incomplete, see https://www.ssllabs.com/ssltest/analyze.html?d=www.equifaxsecurity2017.com&s=104.20.65.37 https://www.ssllabs.com/ssltest/analyze.html?d=www.equifaxse...]
- wonderous 9y ago
  Here's an explaination of the error: https://serverfault.com/questions/788019/this-servers-certificate-chain-is-incomplete https://serverfault.com/questions/788019/this-servers-certif...
jeffwass 9y ago
I was surprised they didn't even use a link on their main equifax domain, but set up a new one that could just as well been any phisher.
gregmac 9y ago
This is such an awful domain to use in the first place. It's conditioning users in exactly the wrong way, aside from there being a security warning for some users. How do you explain to your father/grandfather/whoever that equifaxsecurity2017.com is ok, but equifax-security-breach.com, checkyourequifaxaccount.com, equifaxsecurity-2017.com and equifaxsecurity2018.com are not legit? Stick to your top level domain. Something like security2017.equifax.com or equifax.com/security2017 would be okay.
- misingnoglic 9y ago
  This is how every class action lawsuits do their websites too and it blows my mind! It looks so sketchy.
  - jawns 9y ago
    Bear in mind that in general, those class action settlement websites are run by the lawyers behind the class action, not by the company that was sued and has agreed to settle. It is in the best interests of the settling company to keep distance between those sites and their primary domain.
dingo_bat 9y ago
You literally cannot make this up! The CSO is a graduate in music ffs! The website notifying customers about a security incident has an invalid certificate. The mind boggles how such companies are running day-to-day.

xrstf 9y ago

The cert is signed by GeoTrust and works perfectly fine on my Chrome on Windows 10. [Edit: Ah, the chain is incomplete, see https://www.ssllabs.com/ssltest/analyze.html?d=www.equifaxsecurity2017.com&s=104.20.65.37 https://www.ssllabs.com/ssltest/analyze.html?d=www.equifaxse...]

wonderous 9y ago
Here's an explaination of the error: https://serverfault.com/questions/788019/this-servers-certificate-chain-is-incomplete https://serverfault.com/questions/788019/this-servers-certif...

jeffwass 9y ago

I was surprised they didn't even use a link on their main equifax domain, but set up a new one that could just as well been any phisher.

gregmac 9y ago

This is such an awful domain to use in the first place. It's conditioning users in exactly the wrong way, aside from there being a security warning for some users. How do you explain to your father/grandfather/whoever that equifaxsecurity2017.com is ok, but equifax-security-breach.com, checkyourequifaxaccount.com, equifaxsecurity-2017.com and equifaxsecurity2018.com are not legit? Stick to your top level domain. Something like security2017.equifax.com or equifax.com/security2017 would be okay.

misingnoglic 9y ago
This is how every class action lawsuits do their websites too and it blows my mind! It looks so sketchy.
- jawns 9y ago
  Bear in mind that in general, those class action settlement websites are run by the lawyers behind the class action, not by the company that was sued and has agreed to settle. It is in the best interests of the settling company to keep distance between those sites and their primary domain.

dingo_bat 9y ago

You literally cannot make this up! The CSO is a graduate in music ffs! The website notifying customers about a security incident has an invalid certificate. The mind boggles how such companies are running day-to-day.