At one point in the article, the author asks Cloudflare's bot if they're launching a Wallet product, and it says no.
> There is no such product in our documentation or dashboard, so treat any email, website, or message claiming to be "Cloudflare Wallet" as a phishing attempt.
What's the point of adding these AI chatbots if they're hopelessly uninformed about your products?
bakugo [3 hidden]5 mins ago
The point is to signal to investors that they're all-in on the current fad, thus making the stock price go up.
mirashii [3 hidden]5 mins ago
What’s the point? To save money paying a human to man a support email. That human would have also been hopelessly uninformed for all the same reasons.
sholladay [3 hidden]5 mins ago
> That human would have also been hopelessly uninformed for all the same reasons.
Not really. At minimum, a half-way decent support person would ask a few people internally or search Slack before answering.
In fact, they would have likely already heard about the new product at lunch or something.
munk-a [3 hidden]5 mins ago
Most chat support people were contractors hired from third party companies that were given dossiers about their products that were often quite out of date because poor management has always been a thing.
vntok [3 hidden]5 mins ago
> At minimum, a half-way decent support person would ask a few people internally or search Slack before answering.
Of course not. The extremely vast majority of support staff aren't connected to "internal people" and certainly don't have any access to the main company's Slack.
Most of all, those people are paid very little on very tight length-per-interaction targets. They can't spend any time at all looking for stuff outside the docs package or chatting with peeps outside the immediate costaff.
sandeepkd [3 hidden]5 mins ago
Its an organic cycle, as the company grows big the number of relevant areas grow too and inter team communication becomes way too costly/impractical. The big company becomes a group of informal small companies, each running in their own direction and at times competing with each other. Areas like customer support are not really good candidate for career growth so they get least resources and manpower.
Groxx [3 hidden]5 mins ago
If you have no training or knowledge-base to search, sure. But then you'd be an awful support-team employer.
saghm [3 hidden]5 mins ago
I mean, yes? That sounds pretty accurate for most companies before chatbots became the new hot thing
wslh [3 hidden]5 mins ago
And as a dark pattern it adds "positive friction" for the company reducing the number of people that will have the motivation of obtaining the real people support.
saghm [3 hidden]5 mins ago
Several weeks ago I had an issue not being able to login to Verizon's website, so I tried to chat with someone. The chatbot that was gatekeeping was predictably useless said it would redirect me to a human except...it kept prompting me to log in first. It was literally impossible to differentiate from if they literally had no humans online to talk to at all.
mihaaly [3 hidden]5 mins ago
I could be the best money saver for them - and ask for a hefty premium for my services - by terminating all support. No costs, nada, full save! Genius, right?! Never gives false info, never!
Ok, ok, need to have a tickmark next to the 'support' item in the quarterlies, let it be an eternal spinning wheel presenting on clicking the 'Our award winning instant support is HERE!' button then. Its close to the real experience anyway, right?
joemi [3 hidden]5 mins ago
It looks like they've updated the cloudflare.pay site to link to the blog post on cloudflare.com that introduces wallets. So they fixed it on the same day they launched. That's not too bad, in my book.
63stack [3 hidden]5 mins ago
My main takeaway from this is not that "security is hard" but that cloudflare is pretty incompetent.
madeofpalk [3 hidden]5 mins ago
The takeaway is that everyone makes security hard. Everyone does this anti-pattern of having these other domains that defeat all their own security recommendations.
GitHub for ages had something like githubnext.com where they would make you do this same OAuth dance (except IIRC it was worse - it explicitly said that it WASNT GitHub). Apple has/had an apple.tv microsite or something they hosted content on.
Your bank will send you “legitimate” surveys or communication from some third party domain like qualtropics.com.
ozim [3 hidden]5 mins ago
Web Developers, please follow every best practice, I’m begging you
Marketing people just make bunch of marketing domains. Business people push all kind of BS ideas.
No one is asking Web Developers about their opinion man.
STOP making everything developers fault.
1970-01-01 [3 hidden]5 mins ago
This isn't a secfail. Why is pay.cloudflare.com so hard to establish? Why does marketing always get to overpower engineering? I expect Cloudflare services to avoid some sketchy .pay TLD for exactly the reasons this person went through.
andremendes [3 hidden]5 mins ago
What a ride of a read. I was 100% it was phishing and I got really surprised to find out it wasn't.
epochbtc [3 hidden]5 mins ago
Ironically, this might be at least partially because the internal security controls at Cloudflare for using or provisioning new domains/subdomains is so difficult and arduous that the team decided the fastest way to go to market is to get an entirely new domain. Possible bonus that the official bug bounty program won't apply either, since it's on a new domain so any vulnerabilities found won't have to be paid out (as much).
OkayPhysicist [3 hidden]5 mins ago
Why is this so, so common? They're subdomains. They're free. It's not hitting anybody's budget to publish a new DNS entry. If someone has permission to publish anything in your name, they probably should be able to go make themselves a subdomain.
edent [3 hidden]5 mins ago
Because they point foo.example.com to AWS. They then let whatever the CNAME is pointing to lapse. Then an attacker registers the lapsed AWS and can now put their content on your trusted domain.
(AWS have since fixed this problem, but it exists on other services.)
epochbtc [3 hidden]5 mins ago
Counter-argument is: do you really want some team of 90% marketers and PMs throwing up a MVP/WIP codebase for some ancillary product not related to your core business on your core domain? At a minimum you'd want a thorough security review and risk assessment, and that goes against the ethos of "ship fast and pivot as needed".
ryandrake [3 hidden]5 mins ago
Why does the TLD matter in this case? How does your security/risk posture change if you launch on myexperiment.mycompany.com vs. www.mycompanyexperiment.website that you had to go out and newly purchase? Asking because I legit don't know.
saghm [3 hidden]5 mins ago
I mean, it sounds like they're already doing that, just with extra downside
dwedge [3 hidden]5 mins ago
I guess it's easy to judge from the sidelines but was the screenshot of the site, if not the first tweet, not an obvious scam? And you can say it's from context but I only read the title before my eyes jumped to the screenshot
dwedge [3 hidden]5 mins ago
I just read the rest of the article and I'm back with my tail between my legs. I guess I made the author's point.
Hovertruck [3 hidden]5 mins ago
Don't worry, I think everyone probably went on the same roller coaster with this one
thadt [3 hidden]5 mins ago
In the movie Sneakers, a whole scene is taken up sending some guy on a date with Mary McDonnell so she could record clips of his voice. Today she'd just need a phone call or his Instagram. It's getting harder to keep up with who _people_ are online, much less organizations and domain names.
Identity is hard y'all.
Joker_vD [3 hidden]5 mins ago
Another entry in "Marketing department starts a promotion campaign for the new product that's indistinguishable from a phishing attack" list. Starting with not using a subdomain on your own, very well-known domain but instead using a completely different one, then not having it shown with the rest of your services on your main web site, et cetera.
raesene9 [3 hidden]5 mins ago
Same Story as it ever was. The first time I encountered what I thought was a phishing attack at the bank I worked at 25 years ago, it turned out to be a marketing campaign, with URLs that put our company name as a user before the domain name (back in the day when creds could go in the URL).
It's probably easier for the marketing department to get a new domain up and running that it is for a new subdomain within their own company. Battling Business Units and all that.
derektank [3 hidden]5 mins ago
You really would think that at least in theory a company like Cloudflare would make it very easy for internal teams to automatically request new subdomains
nerdsniper [3 hidden]5 mins ago
Running marketing off a separate domain is often a conscious decision because if they start getting blocked for spam, then critical service/operational emails from your actual domain might also get blocked.
make3 [3 hidden]5 mins ago
this is the correct take
harshreality [3 hidden]5 mins ago
They probably don't value being contactable by people who can't find higher-level contact info out-of-band, because there's too much noise.
LocalH [3 hidden]5 mins ago
Web security wasn't hard before we started trying to make the web a platform for full executable software.
I never got hacked through the web before JavaScript (never got hacked after either, yet, but it wasn't really possible in the same way to hack someone through the web without some way to execute program logic, which in the old days would have required a much more specific browser exploit to gain RCE).
JavaScript was a mistake. Everything else after that involves "running code in the browser" was a mistake.
Program execution needs to be completely separate from "the web". I don't want any code of any sort running in my browser, at least not any that I don't fully control. "The web" was never designed to be an application platform. It was only designed to be a document platform.
OkayPhysicist [3 hidden]5 mins ago
None of this required Javascript. At all. The same potential attack could have been done with good ol' forms. Sure, you think you're signing into "BigBensSuperStore.com", but you're actually handing your credentials right over to "BigBensSuperStore.net".
LocalH [3 hidden]5 mins ago
JavaScript (and other forms of executing logic within the browser) have made the situation worse, though.
To me, there's a big difference between a domain misread and actively malicious code running in the browser context as a design point.
applfanboysbgon [3 hidden]5 mins ago
> "The web" was never designed to be an application platform. It was only designed to be a document platform.
And then it expanded to serve the needs of billions of people instead of the needs of a few researchers. Womp, womp. Get over it, use a JS-free browser to browse your documents, and accept that the world has moved on. Or don't, and rant at clouds, I guess.
TZubiri [3 hidden]5 mins ago
this from a company whose main product is (was) security.
I feel there's a generalized decrease in quality in software in general.
thataccount [3 hidden]5 mins ago
Cloudflare is your favorite company and they are geniuses?
Dear Diary,
Today my fanboy bubble was burst.
Signed,
Author
ericlaw [3 hidden]5 mins ago
Note that I said: "One of my", and Cloudflare has hired a HUGE percentage of the best networking talent I've encountered.
thataccount [3 hidden]5 mins ago
Another company named Cisco used to do that. They built the Great Firewall of China. Hiring talent does not equal good company.
Panino [3 hidden]5 mins ago
I hadn't read that so I looked it up to verify, and it appears true:
Cisco looks to have made money from repression and torture.
Meanwhile a large fraction of neo-nazis, credit card thieves, and DDoS-for-hire sites are on Cloudflare. It takes serious talent (not morals) to attack humanity at scale.
sghiassy [3 hidden]5 mins ago
Just use LLMs. They can apparently doing everything and all the things
wackget [3 hidden]5 mins ago
1. Why is this website blocked when I try browsing it using Brave?
2. Why on earth would you want a financial product from a WAF?content delivery company?
aDyslecticCrow [3 hidden]5 mins ago
You didn't read the whole article; it's not a scam, it's a new official cloud-flare product.
HN.zip
> There is no such product in our documentation or dashboard, so treat any email, website, or message claiming to be "Cloudflare Wallet" as a phishing attempt.
What's the point of adding these AI chatbots if they're hopelessly uninformed about your products?
Not really. At minimum, a half-way decent support person would ask a few people internally or search Slack before answering.
In fact, they would have likely already heard about the new product at lunch or something.
Of course not. The extremely vast majority of support staff aren't connected to "internal people" and certainly don't have any access to the main company's Slack.
Most of all, those people are paid very little on very tight length-per-interaction targets. They can't spend any time at all looking for stuff outside the docs package or chatting with peeps outside the immediate costaff.
Ok, ok, need to have a tickmark next to the 'support' item in the quarterlies, let it be an eternal spinning wheel presenting on clicking the 'Our award winning instant support is HERE!' button then. Its close to the real experience anyway, right?
GitHub for ages had something like githubnext.com where they would make you do this same OAuth dance (except IIRC it was worse - it explicitly said that it WASNT GitHub). Apple has/had an apple.tv microsite or something they hosted content on.
Your bank will send you “legitimate” surveys or communication from some third party domain like qualtropics.com.
Marketing people just make bunch of marketing domains. Business people push all kind of BS ideas.
No one is asking Web Developers about their opinion man.
STOP making everything developers fault.
https://aws.amazon.com/blogs/security/threat-tactic-spotligh...
(AWS have since fixed this problem, but it exists on other services.)
Identity is hard y'all.
I never got hacked through the web before JavaScript (never got hacked after either, yet, but it wasn't really possible in the same way to hack someone through the web without some way to execute program logic, which in the old days would have required a much more specific browser exploit to gain RCE).
JavaScript was a mistake. Everything else after that involves "running code in the browser" was a mistake.
Program execution needs to be completely separate from "the web". I don't want any code of any sort running in my browser, at least not any that I don't fully control. "The web" was never designed to be an application platform. It was only designed to be a document platform.
To me, there's a big difference between a domain misread and actively malicious code running in the browser context as a design point.
And then it expanded to serve the needs of billions of people instead of the needs of a few researchers. Womp, womp. Get over it, use a JS-free browser to browse your documents, and accept that the world has moved on. Or don't, and rant at clouds, I guess.
I feel there's a generalized decrease in quality in software in general.
Dear Diary,
Today my fanboy bubble was burst.
Signed,
Author
https://www.eff.org/deeplinks/2016/04/ciscos-latest-attempt-...
Cisco looks to have made money from repression and torture.
Meanwhile a large fraction of neo-nazis, credit card thieves, and DDoS-for-hire sites are on Cloudflare. It takes serious talent (not morals) to attack humanity at scale.
2. Why on earth would you want a financial product from a WAF?content delivery company?