News for hackers. Stuff that matters.

A comment on Don't Take Security Advice from SEO Experts or Psychics. Parent comment

Re:Don't Take Security Advice from SEO Experts or Psychics by overcast on Thursday August 10, 2017 @09:18AM (#14979306)
The redirection of https to http on neilpatel.com is amazing. That's something I've never seen in my life.
[ Parent | on HN ]
Re:Don't Take Security Advice from SEO Experts or Psychics by heinrich5991 on Thursday August 10, 2017 @09:47AM (#14979573)
Really? Another popular example is https://store.steampowered.com/.
[ Parent | on HN ]
Re:Don't Take Security Advice from SEO Experts or Psychics by mschuster91 on Thursday August 10, 2017 @10:28AM (#14980011)
Lol they're HTTPS on the login form but plain HTTP immediately after... what a joke? That invites people to do cred fishing on bigger LAN parties or conferences...
[ Parent | on HN ]
Re:Don't Take Security Advice from SEO Experts or Psychics by seanwilson on Thursday August 10, 2017 @11:57AM (#14980956)
Yeah...you could just replace the HTTP landing page with your own containing your own login form.
[ Parent | on HN ]
Re:Don't Take Security Advice from SEO Experts or Psychics by ceejayoz on Thursday August 10, 2017 @09:58AM (#14979686)
Holy crap, I've never noticed that.

They 2FA me on every login and then do that?!

[ Parent | on HN ]
Re:Don't Take Security Advice from SEO Experts or Psychics by overcast on Thursday August 10, 2017 @10:03AM (#14979750)
I've always used the app :/ that's disappointing.
[ Parent | on HN ]
Re:Don't Take Security Advice from SEO Experts or Psychics by StavrosK on Thursday August 10, 2017 @10:29AM (#14980020)
It took me a minute of browsing around the site and then coming back here to ask, before I realized that you're saying they're redirecting httpS to PLAIN http. Wow.
[ Parent | on HN ]
Re:Don't Take Security Advice from SEO Experts or Psychics by Sleeep on Thursday August 10, 2017 @03:12PM (#14983067)
I've actually seen it a few times myself but I don't have any examples offhand. My company's filter is lazy so it doesn't filter https traffic. Sometimes if I get a blocked site that's http I try the URL with https instead. Once in a while I get a redirect to http.
[ Parent | on HN ]