7 ms·
Probably not a good person to piss off. Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox should
by leesalminen 9y ago
Probably not a good person to piss off.
Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox shouldn’t tell users it’s insecure. Within hours his database was pwned.
- nkkollaw 9y agoAnd it's so easy for anyone nowadays to get SSL with Let's Encrypt... I remember a few years ago when there was no way you could do it for side projects because certs were 100/yr., now they're free.
- megy 9y agoIt is not easy if you are on a shared domain and it is not supported by your host. Please don't run around saying it is easy for everyone.
- peterkelly 9y agoIf you're on a host that doesn't support HTTPS, you should probably find a different one.
- giancarlostoro 9y agoI have a shared hosting provider that lets me use Let's Encrypt certs on any of my domains through CPanel even. For anyone interested : http://buyshared.net http://buyshared.net I'm only a customer for small niche sites, not associated in any other way, works fine enough for my needs.
- masklinn 9y agoSame with webfaction and I expect pretty much all non-shit hosts. Only annoyance (at least with webfaction) is that they don't currently support letsencrypt auto-renewal, so you have to remember to update your cert manually every 12 weeks.
- bshacklett 9y agoCloudflare has you covered here. If you don't like them, there are many other options as well. If you have anything more important than a blog that doesn't have https enabled, you need to rethink how you're doing things.
- nanoscopic 9y agoAre you suggesting that Troy Hunt is involved in illegal pentesting ( pwning their db )? I really doubt that. He is an industry professional. The problem is not pissing off Troy Hunt; but more that they are advertising that their website is vulnerable and that they don't care.
- drspacemonkey 9y agoI think it was more that Troy Hunt is incredibly high-profile in the security arena. If he blogs that your site security sucks, some of his readers will prove it.
- swsieber 9y agoI took as more of a "if troy is pissed at someone, then everyone knows the person he's pissed at is hackable" statement.
- skeletonjelly 9y ago> He is an industry professional. He gives talks. His background is webdev and he markets himself well
- skeletonjelly 9y agoFlagged hey? I'm serious, look at his LinkedIn if you don't believe me. His professional title is PluralSight author which he put on his senate inquiry docs. His CV for that was his LinkedIn page
- sundvor 9y agoThe funny thing is, checking their web site they still haven't managed to secure their landing page. You'd think they'd get the message when everyone's just laughing at them...
- EADGBE 9y agoTo play devil's advocate: everyone = Hacker News Mostly likely not their customers; whom they have a vested interest in keeping money with.
- sundvor 9y agoTrue. My care factor is probably very different to most non techies, by assumption. Then again, there's probably a bunch of things I do that would annoy(?) {them} greatly - that I'm not even aware of.
- tc313 9y agoHere's the story: https://arstechnica.com/information-technology/2017/03/firefox-gets-complaint-for-labeling-unencrypted-login-page-insecure/ https://arstechnica.com/information-technology/2017/03/firef...
- CoryG89 9y agoIsn't (not) needing HTTPs kind of unrelated to your database being pwned though?
- toomanybeersies 9y agoThe person who owned the website said this: > We have our own security system, and it has never been breached in more than 15 years. Which leads me to believe that their system was built by scratch, in PHP, 15 years ago, and hasn't been updated since.
- SAI_Peregrinus 9y agoAnd that they have no monitoring to detect breaches.
- gerdesj 9y agoNo Troy and co do not work like that - per se. What is most likely is that someone noticed the public discussion and took advantage. I see where you are coming from but the fix was easy and wasting time whining about being called out on rubbish practice was the wrong response. Besides, if the DB was pwned, it is unlikely that http -> https would have any real bearing anyway. There was probably a XSS exploit or whatever.
- mulmen 9y agoI think in this case it's some kind of a broken window theory. If you don't think HTTPS is important you're probably not worried about SQL injection either.
- davchana 9y agoIt was some big oil company, blaming Mozilla for the NotSecure tag near input boxes.