Hacker News Reader

Comment by Matt3o12_ | Hacker News Reader

Why would they send you to a http at all if they already have https. This just seems like complete incompetence. It’s not like they have an excuse like their ad networks don’t work with https.

View on HN

I know of companies with typos in their links that they email. These typos lead to scam sites. I've contacted them and they haven't yet fixed it. There needs to be a serious re-evaluation of the costs associated with failing such basic security measures like using https and just making sure you send people the correct link. Right now it isn't even a slap on the wrist.

Sure, but you can configure a webserver to always redirect to the https version of a site.

If the site supports HTTPS, they should just preload HSTS to avoid future problems with HTTP.

Someone in marketing probably didn't know that it mattered. Same with the head person who approved the email.

But don't worry, they'll have an engineer approve it next time as well!

But there are protections against this, such as HSTS. I would expect someone with as much sensitive information as Equifax to have HSTS + HPKP pinned into the major browsers. Their server should never even receive an HTTP request. It's just unrivaled incompetence.

HSTS doesn't help if it's your first visit to the site. To work around that they'd need to get into a preload list.

Which is easy if you set preload header.

This. The technology (HSTS, HPKP, Subresource Integrity, upgrade-insecure-requests) is there; sites that need it just don't seem to use it.

Normally, people in marketing don’t write URLs by hand. They copy them and check that they look nice or have a generator make them for them.

So, how did they copy an http url instead of https because they website should have redirected them to https before processing the request (and I just hope that their internal network isn’t compromised).

Probably because security is handled by the IT department, and email communication is handled by the much less tech-savvy Communications department.

Reply on news.ycombinator.com