Hacker News Reader

Comment by matteotom | Hacker News Reader

This gives me yet another good reason to keep BECU[1] as my only bank for any non-trivial amount of money... it can be a pain if I need an ATM, but I can at least trust that they will generally be on my side.

[1] https://becu.org

View on HN

I know from living in Seattle that they're a reputable credit union, but the fact that their home page gives me a certificate error is a bad pattern that trains users to ignore scary red messages. (The problem is that the cert is for www.becu.org , not becu.org .)

I think its because they never intended to be linked to without the www.

That's not really an excuse. This is a pretty trivial thing to fix (update the cert, or force a redirect).

They do force a redirect on http://becu.org/, but they can't really force a redirect on https://becu.org/, because you would need to accept the mismatched name before you could get the redirect.

Although, I'm surprised they don't have an alternate name, most of the CA's I've worked with recently automatically add the naked domain as an alternate name when you order a cert with www

Why do you believe BECU would be any better?

Presumably because BECU doesn't have a presence in Massachusetts and it would be harder for Mass. to get a levy on an out of state bank account? Op's tax lawyer in the article stated that "Chase Manhattan is not supposed to freeze an out-of-state account like this, and MA knows it. But MA does this because they know they can get away with it."

A fix for the certificate error, https://www.becu.org

Psst - the https link gives a cert error!

Just add www https://www.becu.org/

Reply on news.ycombinator.com