6 ms·
Worthless security claims
- raverbashing 13y agoWhy are these people wasting money on 'norton secured' and can't be bothered to pay for an SSL certificate?? (That is, considering they're paying for the Norton thing and not hotlinking the images from Symantec)
- zimbatm 13y agoJust an idea: what of both options improves the conversion rate the most ?
- henrikschroder 13y agoYou usually get logos of this type "for free!" when you purchase an SSL certificate, and the SSL providers highlight it as some sort of competitive advantage. It's completely ridiculous. We put a padlock image on our payment pages even though it does absolutely nothing for security, but it might help the conversion rate, so there it is.
- troyhunt 13y agoBecause rightly or wrongly, there's evidence that it increases consumer confidence and results in more purchases / subscribers / customer love. It's an empty promise, but people buy it anyway.
- bluedino 13y agoIt's like a BBB sticker for your office door.
- lucb1e 13y agoI think HackerNews should have a Verified Secure logo just for the irony. Too bad it probably gets someone in legal trouble... Edit: I don't mean HN should buy an SSL cert from whomever, you can just copy the image.
- zokier 13y agoWhat next, you'll tell me that software having fancypants 5-star awards from some random shareware-download site might not actually be all that great. I'm shocked I tell you, shocked!
- deleted 13y ago[deleted]
- coldcode 13y agoHell in one of our apps we just put the damned logo as an image with nothing behind it. Does anyone notice? No. It's a totally bogus feature. You may as well claim "free sex for purchases".
- mattmanser 13y agoRe: telegraphcottages.co.uk How is that a security hole? It's actually .Net having a bad default configuration for ASP.Net MVC, a lot of us made this same mistake when doing our first MVC projects. It's not actually exposing anything dangerous (in fact it's hiding the actual error like it should do). The actual error will be something like this: http://stackoverflow.com/questions/5967103/a-potentially-dangerous-request-path-value-was-detected-from-the-client http://stackoverflow.com/questions/5967103/a-potentially-dan... It's .Net disallowing at the root level and if you don't know about it, you can't code for it. Or am I missing something? Given it's Troy Hunt who's usually quite knowledgeable about this stuff, I'm confused?
- kolektiv 13y agoWell, yes .NET (IIS, specifically) does have a poor default (or rather, the default *.config files created by things like VS have poor defaults). However, hiding the error isn't really enough. Yes, it doesn't expose very many things. But it has exposed, of course, that you're running IIS. And the site is .NET in some form. Those might not seem a big deal, but you've just provided quite a lot of hints about what the attack surface looks like. Most vulnerability scans will flag up "leakage" of data. IIS also does annoying things by default like "powered by IIS" type HTTP headers (it's not alone in that of course). You'll usually be warned to switch that off because you don't want to make attacks easier than they otherwise would be. Internal error form leakage is just another example.
- Dylan16807 13y agoIt's harder than that to hide what server you're using. And keeping such a secret is barely worth it. You can test for characteristics or exploits of all the common servers easily. And it's pretty hard to hide all implementation details. At a glance through the source I can see it's using .axd files and microsoft webforms ajax with a specific version.
- mattmanser 13y agoIIS still defaults to adding 'served by ASP.Net' as a 'x-powered-by'. Something I again often forget to remove. And certain versions of MVC you have to jump through hoops to remove their x-aspnetmvc-version. And on top of that you can often tell by just looking at which js files have been included. Is it using MS js files? Yes, then it's 99% IIS with ASP.Net. So that's not what I, or I would think any reasonable developer, would considered even a vague security concern as an experienced developer with exposure to a few different frameworks can often tell the platform, and thus the probable server, by just looking at the HTML. If it were a serious security concern MS would have patched the header by now! Instead they've added even more with MVC. So are there any other reasons? Or is Troy just wrong in this instance?
- tptacek 13y agoUnfortunately, these logos probably work.
- gav 13y agoThey do work, sometimes the results can be significant. McAfee does an A/B test as part of the sales process. http://www.mcafee.com/us/mcafeesecure/resources/results.html http://www.mcafee.com/us/mcafeesecure/resources/results.html Everything I've seen points to these logos having a noticeable impact, consumers do look for them. It's an important thing to learn for tech people: you are not your customer.
- alekseyk 13y agoMost of his examples are using copy and paste of the logo and none of the companies claim that there are 'secure' by using that logo. It's more of a conversion/marketing tactic as it's well known that showing such badge on your checkout page increases revenue.
- danielweber 13y agoA bunch of images are broken for me on this page; what javascript is needed to view them?
- f- 13y agoI put these together a while ago, feel free to self-certify yourself: http://lcamtuf.blogspot.com/2012/06/this-page-is-now-certified.html http://lcamtuf.blogspot.com/2012/06/this-page-is-now-certifi...
- cantankerous 13y agoI've noticed that a lot of these logos make claims about fraud protection/insurance with respect to the security certificates they provide (presumably the certificates, at least this is especially the case when you buy an SSL cert from a vendor). Isn't that coverage, in fact, usually limited to the scope provided by the vendor? That is to say, you're covered if something bad happens on their (the certificate provider's) end. If somebody manages to break the encryption outright (practically impossible) or the certificate authority is compromised, revealing your info (more likely, but still not common, and they hopefully have a disaster plan to mitigate this). What's most likely is that the website you're dealing with that has the logo presents the biggest security risk to you, the customer, on its own. This website, I'm guessing and please somebody if you can elaborate on this, probably isn't covered under these 100k+ policies, yes?
- B-Con 13y agoWhat to customers think these seals mean? I think they're just being used to give the site a feeling of credibility. > 2) 65% of consumers agree that a website displaying the Norton Secured Seal is safe to browse and won’t give them a virus. > 3) 55% of consumers agree that a website displaying the Norton Secured Seal means that the website protects their online privacy. In other words, customers primarily think that the seal means the website is legit and unlikely to intentionally mess up their computer. When browsing an online store you don't know, that kind of assurance is fairly valuable. But of course, nothing prevents an illegitimate site from putting those logos up, too.
- derefr 13y agoOddly, I've never thought about these seals in the context of e-commerce -- the only time I really see them is on sites like Download.com.
- moxie 13y agoI always assumed that the worth of these logos (along with the phrase "military grade encryption" and people who advertise "256bit AES") was that they enabled us to easily identify the projects that we didn't want to trust with our data.
- harshreality 13y agoIt's not about security; it's about conversion rates and customer comfort level. Blame the customers or the web browsers, not the websites.
- shitlord 13y agoWhat's wrong with "256bit AES"? I'm not well-versed in this stuff.
- JanneVee 13y agoIt refers to a blogpost from 2009 on the Matasano blog. I found a copy of it here (my apologies to tptacek I can't find it at matasano.com). http://www.cs.berkeley.edu/~daw/teaching/cs261-f12/misc/if.html http://www.cs.berkeley.edu/~daw/teaching/cs261-f12/misc/if.h... The gist of it is that just having "256bit AES" tells nothing if it is properly implemented with a robust block mode, proper key generation and if it is signed.
- charliepark 13y agoWait. So standard HN mod practice is to change the HN link text to reflect the original article's title, right? That's been my understanding (though I've usually disagreed with it). So, here, the OP submits a post using the article's original title ("Why I am the world’s greatest lover (and other worthless security claims)"), and you then change the text of the HN link to the article's boring sub-head? Mods, why do you treat the HN readership like children?
- teraflop 13y agoYou should probably just send feedback like this to pg. There's no evidence that the mods read or respond to complaints in the comments, so all it's doing is cluttering up the discussion.
- charliepark 13y agoGood call. Will do.
- teuobk 13y agoCustomers do notice the logos. I know from first-hand experience. I've been selling my photo-deblurring product on the web for about a year now. I've always processed payments through Stripe, and I've always served the entire web site using SSL. The green padlock is in the address bar. And yet, back in the early days, I got questions from potential customers several times a month asking if my purchase form was secure. My solution? I added the text "Payments processed securely" and a generic padlock icon near the credit card info part of the purchase form. In the eight months since then, I haven't had a single person ask me whether or not my site was "secure." Silly, but effective.
- david_shaw 13y agoMy company performs security assessments for businesses, and man do I hate the perception that having a security company's logo or "certification" is the correct way to "prove security." While, unlike most of the badges you see on sites, we do not perform recurring or daily scans, we still field requests for this type of seal all the time. It's our policy to refuse them outright. Our reasoning for this is twofold: primarily, it provides a false sense of security. As the article rightly points out, having a badge on your site does not make you secure. Sure, maybe it'll find some "low-hanging fruit" that you can fix, but it's not going to address major security concerns. The second reason is to protect our own reputation. Security scans, at best, provide a snapshot in time--even if it's a recurring snapshot. Security is a process, not a state; these seals and logos do everything to lull people into forgetting that.
- bifrost 13y agoI remember when I first saw these sorts of things becoming commonplace and I wondered "who believes this stuff?". Well apparently everyone because instead of going away they've exploded. There are hundreds of companies that have these sorts of seals and they guarantee almost nothing. The best outcome for most of them is that they've reviewed your business practices and documentation and you conform with some sort of sanity check. Thats kinda what the ISO certifications are about, and a fair amount of what PCI/etc were about. For the most part though, the PCI certification was arbitrary at best, but required if you wanted to process credit cards/etc. There are still plenty of places that pass PCI style audits, but you'd never want to have your credit card number pass through. The "scan" business is also interesting because it also doesn't really prove much, other than you might have a firewall or some sort of packet filter. Which is good, but not really great, but better than zero :)
- rogerbinns 13y agoWhen I was working on WAN optimization I had a development prototype that did a man in the middle attack on SSL connections and resigned the connection with a locally generated certificate (also added to the browser). My bank also had these logos, and despite me having a mitm attack going on, those logos stayed up. I failed to find a single scenario under which they went away!