Hacker News Reader

Comment by cm2187 | Hacker News Reader

Another lesson is to always host the login section on a sub domain of the company which website you visit. A prime example not to follow is Citibank in Europe. My account is with citibank.co.uk, but when I login to my account I get redirected to online.citi.eu. How do I know that citi.eu belongs to Citibank? I have no relationship with citi.eu, that’s not the website I visited. How do I know I can trust it?

Microsoft is another major offender. When logging in, I get redirected 20 times between various domains, none of which in microsoft.com

View on HN

Microsoft's sign in is a real mess, I think in part due to having to make your hotmail login that you made 15 years ago still work, along with the dozens of other services that MS has acquired or integrated.

I've had a real shitter of a time trying to login before, with redirect loops, or getting automatically signed out as soon as I sign in. Or accounts being a "games for Windows" account, but not an MS account, or an Xbox live account, so some other account. Often I've just found it easier to give up and make a new account.

I hear you.

I was pulling my hair out the other day trying to find my Microsoft credentials in LastPass. I was searching for "microsoft", "office", "outlook" etc. until I finally found them under "live.com".

I also have an @live.com email. I think "live" was one of Microsoft's many failed services rebrands. Remember windows live messenger, windows live photo gallery? Lol

And before that, the grandiose ".Net passport"

Microsoft's account system has had at least five different names; it's just "Microsoft account" right now, but it'll likely be called something different in a year or two the next time Microsoft does one of their gigantic "rebrand all the things" purges.

A ridiculous number of times that I've tried to go to xbox.com while previously signed in, the site redirects me around a bit before dropping me onto a blank page. Ugh.

Microsoft login is still the very old Hotmail login dating back to 1996 or so. The Hotmail mail and account system got rebranded several times like MSN, Live, Outlook, Microsoft ID, etc.

Well, a login system is a very central part, and other websites suck too, like Amazon still uses the old account login page since 1996 too. But Microsoft redirects way too often, it is worse.

Speaking of Microsoft's signin, I can no longer access my decade-old-held Skype since their SSO integration. I've tried over and over and over and tried every route possible. It is some edge case where the email was previously a microsoft account and the password cannot be reset. I'm not the only one with the issue. Shocking something like this doesnt get resolved for years on.

I have a similar Skype issue. I have ancient Skype accounts with usernames, and my email address linked, but now use a Microsoft account for Skype with that same email address. Nobody can find and add my current account - whenever they search for my email address, all of my old usernames appear. I always have to add other users instead.

Very frustrating - fortunately I don't use Skype regularly but it's always an exercise when somebody asks for my username.

Authentication in Skype is awful. At one point, for reasons beyond me, I ended up having two accounts:

* One account required me to log in with a username, and was associated with my main email address. * The other account required me to log in with my main email address.

In a way, they were both related to the same email, but different accounts. This shouldn't even have been possible, but it seems that one was an old MS account, and the other was an old Skype account. My roster ended up being split half and half between the two.

I managed to merge my Skype and Xbox Live accounts, and couldn't get them separated again.

The steps I found to unlink within the XBox UI didn't work, futher research now leads me to the following discussion which I am about to try: https://answers.microsoft.com/en-us/outlook_com/forum/oemail...

Edit: it looks like this was possible in the past (basically deleting the Skype account?), but not anymore.

I had this problem, too. I fixed it by deleting my non-Skype account & waiting about 60 days.[1] Changing the email of the non-Skype account might have worked, too, but I didn't need two accounts & didn't mind waiting.

[1] https://support.microsoft.com/en-us/help/12412/microsoft-acc...

I wanted to sign up for Office 365 a while ago. First thing that bothered me was the password limit of min 8 and max 16 characters (plus all the capital, special character, etc sacrifices you have to make). Second, after I signed up, you get a recommendation to switch off automatic password expiry! What the hell MS?

Microsoft's login experience has been generally broken for years. Multiple redirects through different domains. Heck it uses Javascript redirects. In 2017. So your back button won't work. And it has a habit of just not working. I went to visit a public page on docs.microsoft.com and wound up dead on a white page on login.live.com because it decided I needed to be redirected to login. Just to view a docs page.

What is the alternative to javascript redirecting when you can't do it as the http response?

It spits out an HTML page with no body that solely does a Javascript redirect. Put it in the http response.

I don't know if this is still the case, but you couldn't login if you had 3rd party cookies disabled. Somewhere in the authentication phase, it would silently fail. No error message like incorrect username/password. You'd get kicked back to the login screen as if you just got there. It was a hassle trying to find exactly which cookies were necessary.

It is even worse if you work for a large company with Office 365 that uses your organizations domain for authentication. I think there are about 6 redirects to get logged in. Even worse than that, they made us create a "personal" account with the exact same username for accessing MSDN because it wasn't compatible with our SSO at the time. So every time I log in, I have to type in my username, wait for the redirect, then choose personal account, wait for redirect, etc...

My citibank credit card redirects me to "cardservicesdirect.com.au" -- which reads like a phishing site if I've ever seen one.

I confirmed over the phone with their support that was indeed the correct site before typing anything into it.

But did you call the support phone number shown on the dodgy domain?

T-Mobile called me back one time instead of me waiting on hold. This was after I went through the song and dance of giving the automated system my details. The first thing this representative wanted to do was, again, confirm I am who I said I was.

I said think about what you're asking for a second. Should I answer your questions? Couldn't get them to understand. Wound up hanging up and calling again and waiting on hold.

Ha, same thing happened to me with Vodafone. Some guy called having some nice upgrade to my account. For some reason, to check something, he said, I need your online password. I said, wait, you call _me_ and want my password too? If I call you, tell I am from your bank and I need your PIN, would give it? Well no, came the reply. Then...

Obviously I terminated the conversation.

I hate it when someone calls me and asks me who I am. You called, you tell me who you want to talk to.

My bank actually gets this right. They very, very rarely call me, but when they do it's

"Hello, am I talking to Nick Lamb?" "Yes, this is me" "OK, I'm calling from Example Bank and our confirmatory password is Melons" [not the actual bank or password] "Thanks, that checks out, what can I do for you?"

This happened because I had one of those conversations you're talking about, and they were like "Aha! We have something we can do for those situations, call us and set a password we can use" so I hung up and sure enough they've used that password ever since. I like it.

It's not a _good_ password, but hey, how many times does anyone try the wrong one? Literally never. So it's good enough.

This reminds me of something my local credit union used to do. They had something where you picked an image during signup that they would always show you during subsequent sign-ons so that you knew you were actually signing into their site.

This seems pointless because an attacker could just proxy the login back to your bank. Well, not pointless -- it raises the bar attackers have to pass -- but not a real solution. Or am I missing something?

My previous mortgage company was a subsidiary of CENLAR. So the corporate branding of the monthly bill listed x&y.com, the actual owner of the company was cenlar.com, and the mortage was paid at loanadministration.com, which until recently had minimal branding even tying it back to cenlar, let alone the company I ostensibly have the direct relationship with.

One of the worst I've seen is Franklin Templeton. They sent out snail mail telling everyone to go to a URL like "accountservices.biz" and reenter private information like your social security number in order to update your account records.

The site itself is branded just like Templeton's own site. From what I could gather, it is actually their site but even the whois is something non descript. Quite ridiculous. And of course they don't have any way whatsoever that I could find to report things like vulnerabilities or phishing attempts.

That would be a fascinating way to do a scam. Send snail mail to people directing them to a site that looks like a major company, ask them to enter in their PII and boom, there you go. Of course now you've committed untold amounts of federal crime by using the postal system and you'd definitely get sent to federal PMITA prison if you got caught. But I could definitely see this working on older people who, bless their little hearts, just don't know any better.

Citi has some really bad security practices, when I talked with them about it they mentioned some future changes they were planning that were even worse.

What is the business reasoning behind this kind of domain name silliness?

I assume one team is responsible for the home page, and another team is responsible for the banking portal, and they can't be bothered to coordinate with each other.

I agree. There is no technical reason behind this sort of bollocks.

One day S&M will catch up and have a fit at the fragmented "front face" - quite right too. To be honest the board should also give a shit about their org's outward appearance.

Bit of a fail all 'round, really.

True true true. I know of some banks where invest.examplebank.com and bank.examplebank.com are controlled by mutually distrustful organizations. They really should put their stuff into the public suffix list at https://publicsuffix.org/, because, session cookies. But that would assume they knew something about what they were doing.

How in the world is listing your corporate domain as a public suffix the most appropriate solution to two of the company's teams not working together?

Are you talking about Schwab? I don’t see why you need to hide this bank’s identity.

This makes sense but it seems to be bigger than that. For example, most companies with a major internet presence have a CDN on a totally separate domain, like "twimg.com", "chasecdn.com", etc. there must be a good technical reason for this, because everybody does it.

Or is that an unrelated thing?

That's an unrelated thing.

By having CDN assets on a separate domain, you not only easily avoid accidentally sending any cookies along to the other domains (so if your CDN gets owned at least they aren't getting user credentials or session cookies), but it's also a small performance optimization as there are less things sent in the headers.

The important distinction is that the user should never ENTER any information onto those domains directly. They should be for displaying static resources only, so there is no need to "build trust" for them.

Citi just had a terrible IT team. Their website is always broken and their back end computer systems, until recently, were filled with reward loopholes.

I was looking up details of the new Microsoft Surface recently, so hit the top link in a google search which was (supposedly) on Microsoft.com

It wouldn’t load because Facebook.com was blocked and apparently they were doing a full redirect via fb. Crazy.

This may in fact be because Google lets advertisers set a totally different URL than the one that they actually direct you to, so that advertisers can implement various tracking schemes.

This is also exploited by malicious actors to occasionally buy out fake ads for amazon.com or bestbuy.com (or even, hilariously, youtube.com) which actually direct you to support scam websites claiming your computer is infected.

Google seems to have no desire to correct this by making their advertisements show you the actual URL are you going to be directed to.

Verify that any link you click on is not an ad. Always look for the first native result. The policies permitted around ads make them simply a security risk to click on.

You didn't click on a search result, you clicked on an advertisement.

A good reason to use at the very least adblock.

And to avoid Microsoft edge. Why do I have to open Windows store for an add-on to my browser? Why can't I do it from the browser like in Mozilla Firefox or in Google Chrome?

I quite like Edge tbh. It's my main browser. Nearly a year now.

That is typical for organizations, where a DNS change takes weeks or months or isn't even possible, because of different legal entities. "Lets just register our own domain. Its faster...."

Having a bank as a current client, I am often joking about what would happen if Jeff Bezos takes control for a month. And when I am angry, I ask what would happen if Amazon or Google start selling credits or insurances, tomorrow.

Ugh, MS just seem to get worse too, "Try our new login experience, it logs you out every 15 minutes, so much fun!".

Reply on news.ycombinator.com