Hacker News Reader

Comment by hdhzy | Hacker News Reader

Yes, exactly. The @ trick is being removed from browsers because what the author refers to as interesting trick has been used for phishing and other scams.

View on HN

Since when is destroying web standards acceptable? There are so many internet and intranet pages from 1994+.

In the name of security the change way too many moving parts lately to push their hidden agenda.

Using HTTP in local LAN is fine. Using HTTP for non login-pages is fine. Using "basic authentification" (user:pwd@IP) is fine for certain use cases. Stop breaking things.

I am not using a Firefox anymore, they went insane lately, they don't bother about their community anymore. I am worried about Chrome too, TLS only for HTTP/2 is the wrong signal. So many times I couldn't open a HTTPS sites because the browser thinks the cert is broken - it was just a trivial page were I just want to read some text (not input anything) - just some me the page - something that wouldn't be a problem with HTTP.

If Firefox, Chrome or whoever want to destroy access to 1994-2017 websites, go to hell. Name your forked off thing TheMicrosoftNetwork (or what not) and see it tank rather quickly.

Keep in mind they're not breaking HTTP basic auth, they're just just removing the ability to specify credentials in the URL because its legitimate use is extremely rare but its use in phishing is common.

What's exactly being removed?

You used to be able to put HTTP basic authentication into the URL in the format http://username:password@hostname-or-ip.example.com/ - modern browsers are removing support for the "username:passord@" part because people would put a legit domain in the username:password@ part to fool users. (i.e., http://cnn.com:article123456@fakenews.example.com/ which would actually take you to fakenews.example.com while sending a username of "cnn.com" and a password of "article123456")

what? O.o I use this in Keepass to store quick-login links for some that still require http basic auth (though, haven't tested these for a while). Do you have any link on the deprecation?

https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentica...

> In Firefox, it is checked if the site actually requires authentication and if not, Firefox will warn the user with a prompt "You are about to log in to the site “www.example.com” with the username “username”, but the website does not require authentication. This may be an attempt to trick you.".

Huh, that's just security theater. The phisher could set up a website that does require authentication, thereby avoiding the warning.

The sensible thing to do would be to display the warning if the username contains unescaped dots. (I.e., http://cnn.com:article123456@fakenews.example.com/ would provoke warnings, but http://cnn%2Ecom:article123456@fakenews.example.com/ would not.)

Thinking about this, I think you're right that this is perhaps less useful than billed. If anything though, I'd rather have both warnings.

Strange, it still works for me on Chrome on a http site.

I just tried this on Chrome 60.0.3112.90. Both Firefox and Safari throw phishing warnings with these URLs.

http://news.ycombinator.com@1572395042 Chrome takes me to 93.184.216.34 no warning

Then I tried http://security.wellsfargo.com@customerLoginv=ar3351RandomDa...

Which stretches way past my laptops viewable URL bar... and it takes me right to badsite.null (or a valid site like example.com). If you need HTTPs you can redirect on badsite.null's web server. Very wild.

Reply on news.ycombinator.com