Web security is too hard
A security expert meticulously details how a new Cloudflare product launch appeared to be a sophisticated phishing attack, only to discover it was entirely legitimate. This roller-coaster of suspicion and revelation highlights the extreme difficulty of web security in an age where even trusted companies make design choices indistinguishable from scams. The discussion on HN reflects both frustration with corporate security practices and a shared 'I thought it was a phish too' sentiment.
The Lowdown
The author, a seasoned security professional, recounts a bewildering experience with a new Cloudflare product, 'Wallet'. Prompted by a tweet, they attempted to claim a handle, but the process immediately raised red flags. What followed was a detailed breakdown of seemingly obvious phishing indicators that ultimately proved to be legitimate features of a real product.
- The sign-up process directed the user to
cloudflare.pay, a domain separate from the trustedcloudflare.comand under a TLD (.pay) accessible to anyone, not just financial institutions like.bank. - The OAuth consent screen was generic, lacking specific branding, and featured a suspicious green checkmark that appeared to be part of the app's name, mimicking common phishing tactics.
- Attempts to verify the product through Cloudflare's own dashboard, documentation, and even their AI chatbot yielded no results; the chatbot explicitly stated no such product existed and advised treating claims of a 'Cloudflare Wallet' as phishing.
- After meticulously documenting these suspicious elements and attempting to report the 'phish,' the author was surprised to learn that Cloudflare Wallet was, in fact, a legitimate new offering.
The experience underscores the immense challenge of web security, not only for average users but also for experts, when legitimate services fail to adhere to best practices. The author urges web developers to host apps on trusted domains, provide clear security UI, and facilitate easy scam reporting, while advising users to exercise caution and 'wait' when in doubt.
The Gossip
Cloudflare's Questionable Choices
Many commenters expressed frustration with Cloudflare, arguing their marketing and engineering decisions were either incompetent or actively contributed to a confusing and insecure user experience. The use of a `.pay` TLD instead of a subdomain was a particular point of contention, with some suggesting it might be due to arduous internal domain provisioning processes or even a deliberate move to bypass bug bounty programs. Others pointed out that companies often use separate domains for marketing to protect their primary domain's reputation, even if it looks suspicious.
AI Chatbot's Abysmal Answers
A significant portion of the discussion centered on the Cloudflare AI chatbot's failure to recognize its own company's product, advising the author to treat it as a phishing attempt. Commenters debated the utility of such chatbots, with some suggesting they are merely for investor signaling or to reduce customer support costs by creating 'positive friction'. Others countered that human support, if properly trained and motivated, would likely have been more effective and less prone to misinformation.
Universal Identity Uncertainty
Numerous users empathized with the author's experience, confessing they too would have immediately suspected a phishing scam. The broader issue of online identity verification was a recurring theme, with commenters highlighting how difficult it is to discern legitimate entities from malicious ones across various platforms and services. Examples of other reputable companies (like GitHub or banks) using confusing third-party domains for legitimate communications were cited, reinforcing the idea that this 'phishy' anti-pattern is widespread and makes web security 'too hard' for everyone.