News for hackers. Stuff that matters.
Re:HTTPS on Your Landing Page Is Important by iaw on Wednesday December 13, 2017 @07:07PM (#15918889)
Citi has some really bad security practices, when I talked with them about it they mentioned some future changes they were planning that were even worse.
Re:HTTPS on Your Landing Page Is Important by nerdponx on Wednesday December 13, 2017 @07:19PM (#15918957)
What is the business reasoning behind this kind of domain name silliness?
Re:HTTPS on Your Landing Page Is Important by johnsoft on Wednesday December 13, 2017 @07:29PM (#15918996)
I assume one team is responsible for the home page, and another team is responsible for the banking portal, and they can't be bothered to coordinate with each other.
Re:HTTPS on Your Landing Page Is Important by gerdesj on Wednesday December 13, 2017 @08:00PM (#15919141)
I agree. There is no technical reason behind this sort of bollocks.

One day S&M will catch up and have a fit at the fragmented "front face" - quite right too. To be honest the board should also give a shit about their org's outward appearance.

Bit of a fail all 'round, really.

Re:HTTPS on Your Landing Page Is Important by OliverJones on Wednesday December 13, 2017 @08:54PM (#15919394)
True true true. I know of some banks where invest.examplebank.com and bank.examplebank.com are controlled by mutually distrustful organizations. They really should put their stuff into the public suffix list at https://publicsuffix.org/, because, session cookies. But that would assume they knew something about what they were doing.
Re:HTTPS on Your Landing Page Is Important by chc on Wednesday December 13, 2017 @10:11PM (#15919658)
How in the world is listing your corporate domain as a public suffix the most appropriate solution to two of the company's teams not working together?
Re:HTTPS on Your Landing Page Is Important by callalex on Wednesday December 13, 2017 @11:34PM (#15919972)
Are you talking about Schwab? I don’t see why you need to hide this bank’s identity.
Re:HTTPS on Your Landing Page Is Important by nerdponx on Thursday December 14, 2017 @07:45AM (#15921820)
This makes sense but it seems to be bigger than that. For example, most companies with a major internet presence have a CDN on a totally separate domain, like "twimg.com", "chasecdn.com", etc. there must be a good technical reason for this, because everybody does it.

Or is that an unrelated thing?

Re:HTTPS on Your Landing Page Is Important by Klathmon on Thursday December 14, 2017 @08:39AM (#15922127)
That's an unrelated thing.

By having CDN assets on a separate domain, you not only easily avoid accidentally sending any cookies along to the other domains (so if your CDN gets owned at least they aren't getting user credentials or session cookies), but it's also a small performance optimization as there are less things sent in the headers.

The important distinction is that the user should never ENTER any information onto those domains directly. They should be for displaying static resources only, so there is no need to "build trust" for them.

Re:HTTPS on Your Landing Page Is Important by astura on Thursday December 14, 2017 @07:30AM (#15921740)
Citi just had a terrible IT team. Their website is always broken and their back end computer systems, until recently, were filled with reward loopholes.