Forgot your password?
typodupeerror
Security The Almighty Buck

Making Sense of Mismatched Certificates? 322

Posted by timothy
from the continue-anyway dept.
Ropati writes "I bank with capitalone.com. Recently I went to log in to my credit card account, and my browser reported that the site certificate didn't match the web site I was on. [Expletive.] I'm wondering if I am getting a poisoned DNS URL. I have to log in and do my banking, so I accept the mismatched certificate. The banking site is complete, my transactions are listed but that doesn't mean there isn't a man in the middle attack here. I am still curious how much I have exposed my banking assets." Read on for more, and offer advice on how to interpret what sounds like a flaky response from the bank.


Ropati continues "On the Capital One login page, there is a Verisign link on the page to check that the website is suppose to match. So I click on the verification icon and I am rewarded with a link to Verisign. They report that this web site certificate is for onlinebanking.capitalone.com not the servicing.capitalone.com where I log in. Is this the mismatch my browser reported. I know nothing about certificates.

I call Capital One and ask them to fix the problem. If this was a browser issue on my part, then the Verisign link should match. The tech support supervisor, Joe — XRT413, said he couldn't do anything about it and he couldn't escalate the problem to someone who could.

So my questions are: Are the certificates a mismatch or is my browser bellyaching for nothing? Is the certificate mismatch a security hazard? If someone poisoned my local DNS routers would it be obvious in the URL? How would I prevent such a thing? If everything was working correctly, would the certificate alert me to DNS poisoning, or is this just cosmetic security?"
This discussion has been archived. No new comments can be posted.

Making Sense of Mismatched Certificates?

Comments Filter:
  • Not nothing. (Score:5, Informative)

    by mnslinky (1105103) * on Thursday March 19, 2009 @02:55PM (#27260633) Homepage

    This is a misconfiguration on their end. EV certificates, the ones that turn your address bar green and coax turtles into doing happy dances, are really expensive. It's my guess that they've either reused a certificate on another system, or one of their developers made a mistake in how the site and server cluster is configured. It's certainly something to complain about.

    If you're ever in doubt about the validity of the certificate or security of a transaction, however, DON'T DO IT!. This goes for standing at an ATM in a shady neighborhood or doing business online.

    • by Anonymous Coward on Thursday March 19, 2009 @02:59PM (#27260697)

      Dude, post your login details and I'll check it out for you.

      • Re: (Score:3, Insightful)

        by Anonymous Coward

        I don't know why anyone has their money in large banks anymore. Move it to a local credit union and let those large bank fuckers die out. "Too big to fail" my ass. They haven't been paying FDIC for the last 10 years since "it wasn't necessary".

        • Re:Not nothing. (Score:4, Insightful)

          by encoderer (1060616) on Thursday March 19, 2009 @04:19PM (#27261789)

          There's a quadrillion dollars in Derivatives. (That's not a hyperbole).

          Many large banks hold over a trillion dollars in Credit Default Swaps.

          All CDS contracts have a universal default provision.

          As much as it pains us all, these banks really are too big to fail. That needs to be fixed. We simply cannot have corporations that are so essential that we taxpayers must "insure" them. But that's tomorrow's fight. Today we just need to survive.

          • Re:Not nothing. (Score:4, Insightful)

            by Eric in SF (1030856) on Thursday March 19, 2009 @05:17PM (#27262479) Homepage
            Everyone is saying this and it really does make sense. Except. I don't trust the American system to fix this once the "sky is falling" danger is passed. I really don't.
          • Tell me now, why do we need to protect the counterparties in the derivatives contracts? Shouldn't they have been aware of the risk involved? Just look at it this way: Company A offers credit default swaps against securities to protect lenders in case of default. Company B says, "Hey, that sounds great! Small premium for such a policy!" But Company B should considering, "Hey, they only way we'll need this insurance is if there is a catastrophic collapse. But if that happens, Companies C, D, E, ..., Z a
        • Re: (Score:3, Insightful)

          by aynoknman (1071612)

          "Too big to fail" my ass.

          There is still hope. They are rapidly becoming small enough to fail.

        • Re: (Score:3, Interesting)

          I don't know why anyone has their money in large banks anymore. Move it to a local credit union and let those large bank fuckers die out.

          If you check your routing numbers, you might just find that those local credit unions, and other local banks, are clients of the "big banks". My credit union is/was a client of Wamu.

      • by tkw954 (709413) on Thursday March 19, 2009 @03:55PM (#27261481)

        Dude, post your login details and I'll check it out for you.

        My login details are username:tkw954 password:*********

        Hey that's weird. Slashdot must automatically replace your pw with stars.

    • Re:Not nothing. (Score:5, Insightful)

      by badasscat (563442) <`basscadet75' `at' `yahoo.com'> on Thursday March 19, 2009 @03:01PM (#27260721)

      Well, but both certificates were for capitalone.com subdomains. In this case, I wouldn't worry too much about it. I'd complain, but it's more of an annoyance than a security risk.

      I'd worry a lot more if one certificate was for capitalone.com and the other for capone.com or capitolone.com or capital1.com or something like that. Then you've got a problem.

      • Re:Not nothing. (Score:5, Insightful)

        by Chyeld (713439) <chyeld AT gmail DOT com> on Thursday March 19, 2009 @03:09PM (#27260827)

        Bitch, don't excuse. The whole point of this exercise was to allow the customer use the site without putting their info in danger and in a manner that doesn't require having a degree in "teh internets" to get through.

        It should never be the customer's responsibilty to bring a maginfying glass to the certificate and manually verify that these were just subdomain mismatches and not some clever capitalone.com vs capitlone.com spelling that means to look correct to someone just scanning the screen. That is a security risk, whether or not it is currently exposing your info, it's training you to expect that sort of problem and to ignore it the same way people ignore the dialog boxes XP and VISTA pop up on errors.

      • Re:Not nothing. (Score:5, Insightful)

        by SatanicPuppy (611928) * <`Satanicpuppy' `at' `gmail.com'> on Thursday March 19, 2009 @03:09PM (#27260835) Journal

        Yep yep. Buying a new cert for every subdomain is wildly expensive, so these sorts of errors happen reasonably often.

        In a lot of cases the subdomain may be separated from the main domain only for possible load balancing issues, so it's doubly not worth getting a specific cert for a subdomain which may never take off.

        In the end it's a problem because the consumer gets used to accepting bad certs as a matter of course, and that leads to people accepting "capitolone.com" instead of "capitalone.com". Basically the registrars need to be pimp slapped a bit: certificate registration shouldn't cost anywhere near what it does, certificates should be purchasable for whole domains, etc.

        • Re: (Score:3, Funny)

          by alta (1263)

          No no no, at godaddy they're only 29.95!!!! Only the highest quality stuff for the bank!

        • Subdomain certs (Score:3, Insightful)

          by ravenspear (756059)
          certificates should be purchasable for whole domains

          They are. You don't have to buy a new cert for every subdomain. If you have a lot of subdomains to secure the best solution is to get a wildcard certificate.
          • Re:Subdomain certs (Score:5, Informative)

            by kyouteki (835576) <kyouteki@gTIGERmail.com minus cat> on Thursday March 19, 2009 @03:47PM (#27261375) Homepage
            Due to security concerns (just like the OP is expressing,) you can't get a Wildcard EV certificate.
            • Ah, ok. wasn't aware of that.
            • by mhall119 (1035984)

              Better to get a signing certificate, so you can create and sign your own subdomain certificates. Those are expensive, but Capital One should be able to afford one.

              Better yet, screw VeriSign, they should self-sign and give the user a print out of the certificate fingerprint when they open an account, and have the website walk them through downloading, verifying, and installing their certificate when they register for online banking.

              • Re: (Score:3, Informative)

                by XorNand (517466) *
                Maintaining the PKE infrastructure, the technical support staffing costs, plus the likely attrition of customers who "just can't get their online banking to work right" would dwarf any savings that they'd see from not just buying a certificate.
              • mod parent up!!! (Score:3, Interesting)

                by reiisi (1211052)

                Self-signing is the only sensible way to use certificates.

                CAs should only be used in the same way that USians use notary publics. The certificate should be treated like a notary's seal. (And priced the same.)

                But the CAs can't even behave like notaries until they get proper time stamping implemented.

                The standard itself was never debugged, and every purveyor of snake oil fudges whatever part of the standard that gets in the way of their patent formula.

                Sorry to be negative, but it gets kind of fatiguing, watch

        • Basically the registrars need to be pimp slapped a bit: certificate registration shouldn't cost anywhere near what it does, certificates should be purchasable for whole domains, etc.

          Wildcard certificates do exist [digicert.com] and aren't that expensive. We use them and they seem to work fine for most things (with 1 or two non-HTTP-server exceptions)
          • by jargon82 (996613)
            "Wildcard customers should note that industry guidelines prohibit the issuance of wildcard EV Certificates." http://www.networksolutions.com/SSL-certificates/ev.jsp [networksolutions.com], click on FAQ.
          • Re:Not nothing. (Score:5, Informative)

            by GoRK (10018) <johnl@@@blurbco...com> on Thursday March 19, 2009 @04:25PM (#27261867) Homepage Journal

            No CA is (currently) issuing wildcard EV certs. I personally understand the convenience of the wildcard cert, but I do also accept and support the practice of disallowing wildcards in high security applications.

            EV certificates are available with multiple Subject Alternative Names, though so the whole "dropped www." or a couple of virtual shouldn't be a big deal if things are done correctly. Unfortunately they aren't and some sites (paypal) that are using EV SSL certs don't even bother with this simple feature.

            The correct failsafe implementation which will always result in a no-prompt situation is to ensure that you only deploy EV certificates on an IP addresses that have only one DNS name. You then deploy a frontend redirection server on a second IP using a wildcard SSL cert that occupies the alternative dns names for the namespace of the original app. This server will pass cert checks more easily and then redirect to the EV server with its specific dns name which will then show the green bar. Any existing deep links to the application on an incorrect DNS name will be handled correctly and any direct references will work in the future. There are of course implications for securing said redirection proxy, but they aren't really that hard to overcome.

          • 500 per year? We get our wildcard certs from rapidssl for 200 a year.
      • Re:Not nothing. (Score:5, Informative)

        by Anonymous Coward on Thursday March 19, 2009 @03:12PM (#27260865)

        Well, it's good to worry any time there is a mismatch. It can be easy to fake legitimate looking URL's using UNICODE characters and such.

        Consider something that looks like like:
        https://onlinebanking.capitalone.com/login/.tsdk.cn?login

        The whole first part could be the host name: "onlinebanking.capitalone.com/login/" and the domain is actually "tsdk.cn". This would be using the UNICODE symbol for mathematical division that looks like a forward slash. It looks like a capitalone.com domain even though you're going through some scammer site. Marlinspike talked about this exact attack at Blackhat 09.

        • Re:Not nothing. (Score:5, Interesting)

          by Anonymous Coward on Thursday March 19, 2009 @03:55PM (#27261477)

          Also, lets not forget that a while back some children hacked into Comcast's DNS registrar with nothing more than an unsophisticated Social Engineering ploy.

          If the capitalone domain registration ever became compromised, 'hijackeddomain.capitalone.com' would have the same 'root' domain as capitalone.com, but could be pointed at a hackers server in timbuktu.

          Just because the domain is 'capitalone.com' does not necessarily mean that everything set up with a vanity off of it is hosted, owned, or operated by capitalone (or more importantly; that they're not owned and operated by someone who possesses malicious intent, be it a disgruntled capitalone employee or otherwise).

          Last, the aforementioned domain registration social engineering end-around could theoretically be pulled to obtain a legitimate SSL Certificate. Maybe not specifically by targeting Verisign (at least, not as easily as other companies, I'd venture a guess), but any number of the other more generic and less valuable companies like GeoTrust are all plausible to target with this sort of ploy.

        • Re: (Score:3, Interesting)

          Perhaps it would help--for some of us, at least--if browsers indicated how many sections of the domain matched (with the comparison performed from right to left)? After all, the browser won't be fooled by such trickery.

          In the submitter's case:
          Cert: onlinebanking.capitalone.com
          Site: servicing.capitalone.com
          2 sections match, this is probably safe (but proceed cautiously)

          In the parent's case:
          Cert: onlinebanking.capitalone.com
          Site: onlinebanking.capitalone.com/login/.tsdk.cn
          Danger! 0 sections match. This

          • IE 8 does! (Score:3, Informative)

            by wbean (222522)

            It looks to me as though IE 8 does just this. The matched part of the url is in a bolder face than the rest of the address. Cool!

        • Re: (Score:3, Insightful)

          by mrcaseyj (902945)

          This is why I train new users to look for the domain name at the bottom right of the status bar next to the lock in Firefox, because it's too hard to explain to a beginner how to parse an https URL and the browser takes care of all the tricks in extracting the domain name that you're connecting to.

          Well, it's good to worry any time there is a mismatch. It can be easy to fake legitimate looking URL's using UNICODE characters and such.

          Consider something that looks like like:
          https://onlinebanking.capitalone.com [capitalone.com]

      • Re: (Score:3, Interesting)

        by Erioll (229536)

        This will become a greater issue as unicode domain names come into prominence. I believe that right now while Firefox "decodes" any unicode so that the characters look like the underlying hex (or something) so that a non-english character can NOT be confused for a real one.

        For instance in certain fonts lowercase "L" (l) looks EXACTLY like an uppercase "i" (I). In others it doesn't. Now in your example that can't happen, but what about www.travelocity.com or www.traveIocity.com? (I used a capital "i" in t

      • by klubar (591384) on Thursday March 19, 2009 @03:23PM (#27261027) Homepage

        You're end up in some call center and the agent will have no clue what you're talking about -- they will recommend clearing cookies, restarting the browser (and maybe switch to IE). The message will never get up the food chain. The only real way to get the message is to close your account and switch to a bank that takes sucurity seriously.

        • by irotsoma (899537) on Thursday March 19, 2009 @04:03PM (#27261593)

          WARNING: RANT...

          I hate to say it, but I agree that you'll never get anything fixed by a call center. I've worked in call centers and the people who work there generally have no way to speak to anyone who can fix a problem, even in a "tech support" call center. Also, since they either get paid per call, or at least get docked pay if they aren't actively answering incoming calls, then they have no incentive to fix anything. In fact, they have a big disincentive against fixing anything since it will take away from their pay check and they likely hate the company too much to do it on their own time.

          Also, I've been on the other side doing development and it's a similar problem there. It's very easy to make a simple typo or other mistake and never know the difference. No one in the call center ever tells you that the customer is having a problem, so you don't know that something needs to be fixed. So even though it might be a 1 minute fix for you, you'll never know that it needs to be done. There was a bug in this one software that had been there for 3 years, and the workarounds were even in the documentation to train new call center employees. Once a developer finally got it, it took seconds to fix. The customers suffered for 3 years for a few seconds of someone's time. Now I realize you can't fix every bug, all the time, but if the right people don't know about it, then it will never get fixed.

          The real problem, IMHO, is that large companies treat their support/customer service departments like they are a drain on the company rather than a way to increase your reputation, thus outsourcing, low pay, strict rules, etc.

          Because of this I prefer to do business with smaller companies or, even better, in person. If you're a "real person" standing in line at a bank, the teller is more likely to fix a problem than if you're just a number on a screen and a squeaky voice on a phone. But in-person is so inconvenient in this world of constant multitasking.

          • Re: (Score:3, Interesting)

            by Dan667 (564390)
            As a developer I understand that people typically don't report bugs upstream so I generally put metrics and logs into most code so I can look for broken stuff myself. I would say bugs from logs vs people is about 20 to 1 conservatively. Many people will just stop using the tool altogether even if it is painful rather than report the bug. I have also noticed that as the tool matures if you keep working the features/bugs there is some threshold where it works well and then people will start reporting bugs.
          • Re: (Score:3, Interesting)

            by John_Sauter (595980)

            ...I've been on the other side doing development and it's a similar problem there. It's very easy to make a simple typo or other mistake and never know the difference. No one in the call center ever tells you that the customer is having a problem, so you don't know that something needs to be fixed....

            I ran into this problem when I worked for Digital Equipment Corporation, and came up with a solution. I was the one from our software development group who went to Colorado Springs to train the telephone support troops. I developed a rapport with them, and they allowed me read-only access to their call logs for the product. I would pass bug reports to the rest of the development group. In addition, I was able to provide feedback to the support people about incorrect or incomplete responses to customers.

    • Re:Not nothing. (Score:5, Insightful)

      by argiedot (1035754) on Thursday March 19, 2009 @03:09PM (#27260831) Homepage

      If you're ever in doubt about the validity of the certificate or security of a transaction, however, DON'T DO IT!

      Can't agree more. See this example of a MITM attack. [mozilla.org]

    • Re:Not nothing. (Score:5, Insightful)

      by Lord Ender (156273) on Thursday March 19, 2009 @03:10PM (#27260847) Homepage

      Exactly. When you proceed despite an SSL error, you most likely are falling victim to a screw-up on the bank's end, but you are possible falling victim to a MITM attack. There is no way for you to know conclusively.

      That's really the end of the discussion.

      • by Yvanhoe (564877)
        Well, technically the discussion can continue but it must continue at the bank and usually involves torches and pitchforks
    • A corporation will get the certificate issued for their shiny professional 'main' URL, like www.ReallyGreatBank.com, and then their online account management system ends up being a redirect to wherever the hell they felt like putting it. For example, while I don't know if they have certificate issues, Citibank's many 'main' sites for themselves and their acquisitions, take you to www.accountonline.com/yada-yada.

      I guess if we all complained until we were blue in the face, businesses -might- make more of
    • Browser issue (Score:4, Interesting)

      by gr8_phk (621180) on Thursday March 19, 2009 @03:26PM (#27261059)
      Web browsers should not allow access to sites with messed up security. If all browsers errored out, sites like this would be unusable and would get fixed. Putting up a warning that the user learns to ignore is just crying wolf. People learn to ignore such things - so why implement them at all?
      • by jargon82 (996613)
        I think making it that broad would be a mistake. There are a number of network devices that use ssl and have a self-signed cert that would fail under these conditions.
    • In the case of a large bank they really should have things configured properly. However, I've also see this in cases of a certs for things like www.some-small-online-business.com and I really wish Firefox would offer to redirect you to the proper domain for the cert.
  • No (Score:5, Funny)

    by Romancer (19668) <(moc.roodshtaed) (ta) (recnamor)> on Thursday March 19, 2009 @02:56PM (#27260653) Journal

    It's all a scam and we're all laughing at you. While spending your money. Thanks for the good times.

  • Answers (Score:5, Informative)

    by girlintraining (1395911) on Thursday March 19, 2009 @03:02PM (#27260731)

    Hello, IT, have you tried turning it off and back on again?
    Ah... another tech support call. Sure, what's the problem?

    Are the certificates a mismatch or is my browser bellyaching for nothing?

    Yes. And maybe yes too.

    Is the certificate mismatch a security hazard?

    Common sense would suggest it wouldn't be in a big popup dialog labeled "WARNING" if it wasn't.

    If someone poisoned my local DNS routers would it be obvious in the URL?

    No.

    How would I prevent such a thing?

    Stop clicking "Okay" or "Yes" to every security warning you don't understand.

    If everything was working correctly, would the certificate alert me to DNS poisoning, or is this just cosmetic security?

    If the certificate isn't properly signed, a warning like the one you were presented with should throw a dialog box in the web browser.

    • by gr8_phk (621180)
      Good answers except this one:

      If the certificate isn't properly signed, a warning like the one you were presented with should throw a dialog box in the web browser.

      IMO the browser should just block access to the site. Then they have to fix it. Why implement security features that throw up warnings the user is expected to ignore? That's a rhetorical question, please don't try to justify this behaviour.

      • by AK Marc (707885)
        IMO the browser should just block access to the site.

        The problem is that things that are self-signed get dumped into the same buckets as bad ones. So any gear I have that I want to get to with a self-signed certificate, I have to click through all sorts of warnings to get to an HTTPS session, and in your scheme, they'd just lock me out of my networking gear. And you think that makes sense?
      • Some sites have HTTPS for no good reason. A number of mailing list hosts seem to do this, I run into them while googling for stuff. Too often the certs are out of date, since I don't care about security for the page (I'm viewing it, not submitting info) I add the exception.

        Your argument is another "the user is stupid" assumption, those are getting out of hand. If I tell the browser to do something, it should f**king do it.
    • Re: (Score:3, Insightful)

      by owlstead (636356)

      "If the certificate isn't properly signed, a warning like the one you were presented with should throw a dialog box in the web browser."

      *Nothing* from a web site should throw a dialog in a web browser. Dialogs are annoying things that block your entire application. They make it all to easy to create denial of service attacks (just keep throwing dialog boxes). They are also easy to click away by mistake (just hitting enter in an entirely different application seems to do it).

      I love the way FF3 shows you that

  • by THEbwana (42694)

    My browser has no problem with their cert. And Im using a particularly picky browser (firefox 3.07).
    A non-story?

    • by owlstead (636356)

      It seems to have been fixed already.

      I would not worry about the problem when 1) onlinebanking.capitalone.com is working as it should be and 2) when the certificates of onlinebanking.capitalone.com and the misconfigured servicing.capitalone.com match.

      Also, the top level domain is the same, you it seems far fetched that the DNS is configured incorrectly. That is, IF you are using internet from a relatively safe location, otherwise your routing and DNS may be attacked quite easily.

      It's fixed, but that does not

  • by RobertB-DC (622190) * on Thursday March 19, 2009 @03:03PM (#27260755) Homepage Journal

    Seriously, there's a bank on every corner. Unless you have some compelling reason to stay with Capital One, open an account elsewhere. You don't even have to close your Capital One account -- save it as a backup.

    That's what I did when Bank of Texas (aka Bank of Oklahoma) added so-called "security questions". The first time I failed at answering "What was your first pet's favorite food?" (or something similarly stupid), I changed my direct deposit to put $1 a paycheck there, and move the rest to an account at a financial institution with a better understanding of Internet security.

    Speaking of financial institutions, why are you still banking at a for-profit (ha!) institution, anyway? I've got one credit union that doesn't charge an overlimit fee on my credit card, and another that's paying over 4% interest on my checking account. Why can they do that? Because they didn't take stupid risks 10 years ago. I should know -- they wouldn't give me a home loan. The bank that did was first in line for a taxpayer bailout [cbsnews.com].

    • by mnslinky (1105103) *

      Why can they do that? Because they didn't take stupid risks 10 years ago. I should know -- they wouldn't give me a home loan. The bank that did was first in line for a taxpayer bailout.

      It's nice seeing blatant honesty! Very funny. I see you've not had a problem paying your internet and slashdot subscription fees. ;)

      • It's nice seeing blatant honesty! Very funny. I see you've not had a problem paying your internet and slashdot subscription fees. ;)

        Like I tell the kids... the big rocks [appleseeds.org] go in the bucket first.

    • by Hatta (162192)

      That's what I did when Bank of Texas (aka Bank of Oklahoma) added so-called "security questions". The first time I failed at answering "What was your first pet's favorite food?" (or something similarly stupid), I changed my direct deposit to put $1 a paycheck there, and move the rest to an account at a financial institution with a better understanding of Internet security.

      My Credit Union does this too. I just treat it like a second password. I actually sat down with the manager and talked to him about it.

  • A mismatch at the third level of the domain name is probably a configuration screw-up on Capital One's part. It shouldn't be possible for a third party to get a certificate for a capitalone.com subdomain.

    If, however, somebody did get a certificate for onlinebanking.capitalone.com, then Capital One's only defense is to change the subdomain they use and hope that people who've been hit by a DNS poisoning or other man-in-the-middle attack pay attention to the certificate mismatch.

  • by einhverfr (238914) <chris.traversNO@SPAMgmail.com> on Thursday March 19, 2009 @03:05PM (#27260777) Homepage Journal

    The first thing to note is that SSL covers the host-to-host connection and is ignorant of higher-level protocols. There are a couple of things which can cause SSL mismatches:

    1) SSL cert is set up to one hostname that the machine services, but site is on another. The SSL negotiation happens prior to the host headers being processed. This could be solved by browser controls (i.e. do a rDNS lookup on the cert's host and make sure it matches the IP you are connecting to), but this ends up causing other, more serious issues, because different sites on the same server could be controlled by different parties. Hence if you have a shopping cart, I could re-use your cert on my shared site on the same box, spoof your page, and steel credit card numbers. So the browser behavior is correct.

    2) The SSL cert could have been accidently re-used (unlikely).

    My general rule is that if the hostname's TLD matches with the cert (capitalone.com), but the most host-specific portion does not (servicing vs online banking), this is reasonably (though not completely) safe to ignore. Revoked certs should ALWAYS be treated with suspicion because you don't know why it was revoked. Expired certs.... Well, it depends. There are other things that can cause certs to be improperly shown as expired so that demands more careful consideration.

    • Re: (Score:3, Informative)

      by BigBuckHunter (722855)

      SSL cert is set up to one hostname

      The parent is for all intensive purposes is correct. Class 3 SSL certificates are assigned to a common name (foo.com). Unless the certificate contains a wild-card, it ill not work for bar.foo.com. It will however work for foo.com/bar.

      It sounds like the bank in question has a Class 3 for CN=bank.com and their webapp is located at online.bank.com. The browser caught the mismatch and throws a warning.

      Please alert the webmaster of the institution with a full description of the error.It's easy to resolve

    • by Skapare (16644)

      The cert I got was good. Maybe they repurposed some servers around in the pool of servers behind load balancers, and one or more didn't get their certs updated for the new purpose (e.g. changed from "onlinebanking" to "servicing"). Or maybe the OP really did have a MitM attack.

  • by synthesizerpatel (1210598) on Thursday March 19, 2009 @03:06PM (#27260795)

    This reminds me of an story. A friend and I were moving a heavy couch and at an inopportune time he got flustered and said 'Hold on, we need to put this down and take a break'. We did, finished moving it later and that was that.

    About 6 months later out of the blue he explained to me that he had to put the couch down because the apparently strained a bit too hard and pooped his pants.

    I have no idea why he told me, much less told me 6 months later. He was kind of a weird guy.

    The moral of this story is:

    If you do something embarassing or stupid and privately get away with it, don't tell anyone.

  • has a mismatched certificate. something like www.ourdomain.com not matching subdomain.ourdomain.com

    i don't know enough about SSL and certs to tell you that subdomain, as opposed to domain, mismatches are exploitable. but i know in my particular instance, its just laziness on my company's part, and it smells like someone just dropped the ball on a configuration at capitalone

    i know in my company's case i complain about it, but nothing ever gets done about it (until we get exploited i bet)

  • by poot_rootbeer (188613) on Thursday March 19, 2009 @03:09PM (#27260837)

    What is "Cap It Alone"?

    Doesn't sound like a website I'd entrust my financial information to...

  • Now you know why I no longer bank with Capital One. They not only are really not concerned at all with their security, but they really could care less about you; their customer. I had nothing but issues with them and just closed everything up and moved on.

  • by Jason Levine (196982) on Thursday March 19, 2009 @03:21PM (#27261009)

    An ID Thief opened a Capital One account in my name. They had my name, address, SSN, and DOB, but got my mother's maiden name wrong. Capital One approved the card anyway. Then, when the thief immediately changed the address (from mine to another address), before even activating the card, it didn't raise any red flags in their systems. Then, when the thief tried to get a $5,000 cash advance on the card (still not activated), it didn't raise any red flags in their systems (though they denied the advance). Then, when I called them, they refused to give me any information on the theory that I could "go and shoot the guy and they would be liable." Instead, I had to have a police officer call a special "cops number." The police officer called that number and got a recording which apparently no one ever returned phone calls from. At every step of the way, Capital One seemed to be going out of its way to protect itself *from* me and my ID Theft investigation instead of caring about the fact that it was an accessory to ID theft. Needless to say, I won't ever do business with Capital One again.

    • by icydog (923695)

      They had my name, address, SSN, and DOB, but got my mother's maiden name wrong. Capital One approved the card anyway.

      What did you expect Capital One to do? Reject the seemingly valid app because they got your mother's maiden name wrong? That question is there for verifications purposes after the account's already open and you call customer service. How would Capital One know your mother's maiden name to verify that for account opening purposes?

      I do agree that trying to change the address before card activat

    • Needless to say, I won't ever do business with Capital One again.

      Maybe, but someone with your name, address, SSN, and DOB will likely be banking with them again in the near future.

    • At every step of the way, Capital One seemed to be going out of its way to protect itself *from* me and my ID Theft investigation instead of caring about the fact that it was an accessory to ID theft.

      That's really no surprise - the entire reason the term "identity theft" was created was to redirect responsibility from the banks for being accessories to fraud. Nobody steals an identity, they steal money from the bank by exploiting weaknesses in the bank's system. But call it identity theft and the fact that it was the bank's failure to protect itself adequately against fraud is not so immediately obvious and that since your identity was involved it is at least partially your fault.

    • by RobertB-DC (622190) * on Thursday March 19, 2009 @03:54PM (#27261465) Homepage Journal

      I was going to reply with my own tales of Capital One woe, the $500 credit line with the $50 overlimit fees, the annual fee they charged after I cancelled, the continuing flood of "offers" (with worse and worse fine print). But I can't, because I'm laughing too hard at the banner ad at the top of the page.

      Capital One® Credit Cards
      Competitive Rates. More Rewards. Apply Now for No Hassle Cards.
      www.CapitalOne.com

      I've run-not-walked from Capital One ever since my one and only experience with them, and if this situation (and their bannermania) is any indication, everyone else should too.

    • by geekoid (135745)

      The same thing could happen at any bank.
      It's bad, but Capitalone is no different.

      "Then, when the thief tried to get a $5,000 cash advance on the card (still not activated), "

      This happens all the time from legitimate customers.

      Curious why you think they should give you all that information based on a phone call.
      That would mean someone could claim to be you and get your banking information.
      That handled that part in a way that minimizes chances at social engineering through that vector. That was a good thing.

      "

  • It worked for me. The server certificate I got was valid (issued 2008-10-02, expires 2009-10-15, for "servicing.capitalone.com"). There could be many problems causing this.

    http://skapare.ipal.org/servicing.capitalone.com.cert.general.png [ipal.org]

    One is that the actual server (of many servers they are running through load balancing port redirectors) you connected to doesn't have the right certificate (e.g. they didn't install the new one on all servers ... maybe new servers coming online and the update of renewed

    • Re: (Score:3, Informative)

      by icydog (923695)
      It also works for me. I bank with Capital One, and in fact the link in the summary is the exact link I have stored in my bookmarks. I have never had certificate trouble with that link. I'd watch that account closely if I were you, and perhaps change your passwords if you use the same password elsewhere.
  • Banks? Seriously? (Score:5, Interesting)

    by NineNine (235196) on Thursday March 19, 2009 @03:29PM (#27261111)

    I don't really understand why any individual with regular "banking" needs would use a bank today. Credit unions are non-profit, and generally, because of their structure, are run much better than banks are. My credit union has been impacted 0% by this banking mess stuff. I'm earning 4% on my PERSONAL CHECKING account, and not paying any fees. I also have all of my business accounts, and my mortgage with my local credit union.

    Credit Unions: Like banks, but cheaper, non-profit, less corrupt, no over-paid executives, and not out to screw you over.

  • well, there's your problem right there

    was it the retro arcade game commercial that suckered you in?

    admittedly, they nailed the music on that one perfectly

  • by pak9rabid (1011935) on Thursday March 19, 2009 @03:38PM (#27261245)
    DO NOT continue banking online, and call them to let them know of the problem. Continue banking over the phone or in person (I know..it's a pain in the ass compared to doing it online, but it's nothing compared to having to deal with identity theft).
  • by Slipped_Disk (532132) on Thursday March 19, 2009 @03:38PM (#27261249) Homepage Journal

    OK, your bank screwed the pooch and you should complain - LOUDLY - until it's fixed. You should also look for a bank that understands basic internet/web concepts like "SSL cert's CN must match DNS hostname" -- I fear for the rest of their infrastructure.

    That said, you were logging into your bank, which presumably holds a large percentage of your cash assets, you received a SSL error and you continued the transaction?
    You deserve to have your account cleaned out for reckless disregard for the security of your financial information. Go to a brick-and-mortar bank, or call them on the telephone (*gasp*) if your banking is so urgent.

    • "You deserve to have your account cleaned out for reckless disregard for the security of your financial information. "

      no no NO. No one deserves that, stop pandering the insurance companies line.

      If you car is not locked, you don't deserve to have it robber, if you leave a window to your house, you do not deserve to be robbed. if you windows are easily breakable, you do not deserve to be robbed. If you were a short skirt, you do not deserve to be raped.
      You deserve to live in a world where you don't have to lock everything.

  • Didn't we have a story recently where it was possible to sign new certs in an existing domain without authorisation ? That would make the "don't worry too much, it's a sub-domain" answers a bit weak.
  • that real massive online and electronic banking will fail.

    There are more and more way to compromise systems technically and socially due to the nature of computers.

  • by Animats (122034) on Thursday March 19, 2009 @04:32PM (#27261953) Homepage

    Something strange is going on here. Capital One's main site [capitalone.com] returns a certificate for the correct domain, but the certificate is invalid. This isn't a wrong-domain issue; the cert is bad. CN="www.capitalone.com", the dates are valid, the issuer is Verisign, but it won't validate in Firefox. Our own system, SiteTruth, which uses OpenSSL, also indicates it's no good. But neither Firefox nor OpenSSL is producing a useful error message. It looks like this certificate is either corrupted or bogus.

    The location ("L") in the cert is Glen Allen, VA. Capital One has a facility in Glen Allen, according to Google, and it looks like a huge warehouse. So that's probably their data center, at 4871 Cox Rd, Glen Allen, VA - (804) 270-4104.

    A traceroute ends at "capitalone-gw.customer.alter.net", which doesn't mean much one way or the other.

    Their stock has dropped from 55 to 12 since September 2008. If you have any money in there above the FDIC insurance limits, get it out now..

  • by 6Yankee (597075) on Thursday March 19, 2009 @05:07PM (#27262347)
    What's "capping it", and why would I want to do it alone?
  • Here's an idea (Score:4, Insightful)

    by bensafrickingenius (828123) on Thursday March 19, 2009 @07:22PM (#27263631)
    If you suspect you're visiting a phishing site, try first entering the WRONG password. Since the fishing site shouldn't know your true password, it will just accept the incorrect one and store it away for the purpuse of dastardly use later on. If the site rejects the incorrect password, then accepts the true one, you know you're OK. Right?
    • Re: (Score:3, Informative)

      by narcc (412956)

      Great for phishing sites, totally useless for man-in-the-middle attacks.

  • by jefftp (35835) on Thursday March 19, 2009 @08:07PM (#27263883)

    Electronic banking is heavily regulated. If you feel your concerns are being taken seriously by the bank you need to head on over to the federal reserves website and file a complaint. The Federal Reserve will forward the complaint to the correct regulating facility and banks will respond or be fined.

    http://www.federalreserveconsumerhelp.gov/ [federalres...erhelp.gov]

The bogosity meter just pegged.

Working...