Hacker News Reader

Comment by tyingq | Hacker News Reader

Probably because they wanted to farm it out to some agency with zero dependencies on their known-incompetent internal IT team?

You're right of course, but I'm betting that was the motivation.

View on HN

They could always farm out the new site and point a subdomain to it.

Something like https://breach.equifax.com

That would require ssl certs to be shared to the agency.

Agreeing with everyone though, it's a wrong reason, but I can fathom why someone would do it.

No, the outside agency can obtain a new cert for just that subdomain. They can even use letsencrypt! (Although they really should use EV for this type of site.)

You'd think even the world's most incompetent IT team could manage to point a subdomain at a remote server, but apparently not.

Not without sending every user's equifax.com cookies to that outside agency's servers.

Hmm, point. Of course, there are tons of ways to get around that problem.

Can you share the best?

The first one that comes to mind would be to invalidate all existing cookies so that the ones accessible to the other server aren't useful. I wouldn't call that the "best" since invalidating cookies can be annoying for users, but I'm sure there are other ways.

If a user has a cookie for example.com (your domain) and type in vendor.example.com in the web browser how would you invalidate these cookies before they are sent to the vendor? Or even after they are sent? I struggle a bit with seeing how this could be done in a secure manner.

I have contracted places where that would be a very formal request with tons of meetings and approval flows across purchasing, it security, website ops, the design/branding team, etc. Weeks of lead time required.

Basically, the request signals all the little fiefdoms that it's their chance to weigh in.

Never underestimate how incompetent people can be. When I was waiting for my South African Visa application to go through, I had to check the status at a scammy-looking url. The form would reload if you pressed enter and pressing tab after the ID field would set the focus to the logo above it instead to the password field below.

My guess was that they wanted to reduce the chance of news leaking before they announced it. If they're like other large companies I've seen from the inside, changes to the main website involve lots of meetings and lots of people/stakeholders.

Reply on news.ycombinator.com