4 ms·
This is a very disappointing trend in security. Publicly shaming sites into action is not a benefit that outweighs making it easier for attackers. It's ridiculo
by ebbv 12y ago
This is a very disappointing trend in security. Publicly shaming sites into action is not a benefit that outweighs making it easier for attackers. It's ridiculous to argue that it is.
- joshka 12y agoI disagree with this perspective entirely. There are many more users of these sites than operators. Assume that a site is no longer secure, therefore operating any of these sites and claiming secure comms is fraudulent. This fraud is obviously unintentional of course, but the greater damage is to the user, not the site. Secondly, it saves attackers a trivial amount of time. If they're able to exploit this problem, scanning for its existence is orders of magnitude easier.
- mc32 12y agoDo you know if they are only scanning or reporting the 'www' sites or are they listing the main site even if it's just a single server misconfigured, or subdomain, etc?
- skuhn 12y agoDetails are sparse, but the text file is literally bare domains and an IP that in my testing is always the A record for domain.blah. I don't think they're even looking at www.domain.blah, let alone actually crawling these sites or otherwise exhausting their domain space.
- mc32 12y agoI suspected as much. It makes this a lot less useful, but, I guess it's more like ringing an alarm than being precise. On the other hand for some sites this might amount to a false alarm if the tested address has no critical service running on it. Mind you they should all be remedied, but some more hurriedly than others.
- skuhn 12y agoI think it's particularly misleading because some sites only run redirector services on domain.blah for the purpose of sending you to www.domain.blah. Yes the problem should still be remedied, but no customer data flows through this service, and the connection would be renegotiated after the redirect on systems that may bear very little resemblance technically.
- moyix 12y agoRunning zmap or masscan is such a low barrier to entry (compared to the expertise required to then factor the key and set up a MitM attack) that it's hard to argue this is really making it that much easier for attackers. Aside from the benefit of pressuring these sites into fixing the problem, it also benefits users, who can now make an informed choice about whether to (say) visit a vulnerable site at a cafe or wait until they get home.
- meesterdude 12y agoI want to disagree with you, but you're right. If there is any reason to call into question the trust or safety of a site I visit, I should know.
- bmm6o 12y agoI would agree with you for a vulnerability like Heartbleed, where the attack was against the site itself. This is an attack against the users of these sites, so users need to know which sites are vulnerable. Also, attackers are far more capable of gathering this data on their own than users are.