At one point in the article, the author asks Cloudflare's bot if they're launching a Wallet product, and it says no.
> There is no such product in our documentation or dashboard, so treat any email, website, or message claiming to be "Cloudflare Wallet" as a phishing attempt.
What's the point of adding these AI chatbots if they're hopelessly uninformed about your products?
bakugo 4 minutes ago [-]
The point is to signal to investors that they're all-in on the current fad, thus making the stock price go up.
mirashii 25 minutes ago [-]
What’s the point? To save money paying a human to man a support email. That human would have also been hopelessly uninformed for all the same reasons.
sholladay 1 minutes ago [-]
> That human would have also been hopelessly uninformed for all the same reasons.
Not really. At minimum, a half-way decent support person would ask a few people internally or search Slack before answering.
In fact, they would have likely already heard about the new product at lunch or something.
wslh 20 minutes ago [-]
And as a dark pattern it adds "positive friction" for the company reducing the number of people that will have the motivation of obtaining the real people support.
epochbtc 5 minutes ago [-]
Ironically, this might be at least partially because the internal security controls at Cloudflare for using or provisioning new domains/subdomains is so difficult and arduous that the team decided the fastest way to go to market is to get an entirely new domain. Possible bonus that the official bug bounty program won't apply either, since it's on a new domain so any vulnerabilities found won't have to be paid out (as much).
andremendes 1 minutes ago [-]
What a ride of a read. I was 100% it was phishing and I got really surprised to find out it wasn't.
1970-01-01 10 minutes ago [-]
This isn't a secfail. Why is pay.cloudflare.com so hard to establish? Why does marketing always get to overpower engineering? I expect Cloudflare services to avoid some sketchy .pay TLD for exactly the reasons this person went through.
63stack 33 minutes ago [-]
My main takeaway from this is not that "security is hard" but that cloudflare is pretty incompetent.
madeofpalk 8 minutes ago [-]
The takeaway is that everyone makes security hard. Everyone does this anti-pattern of having these other domains that defeat all their own security recommendations.
GitHub for ages had something like githubnext.com where they would make you do this same OAuth dance (except IIRC it was worse - it explicitly said that it WASNT GitHub). Apple has/had an apple.tv microsite or something they hosted content on.
Your bank will send you “legitimate” surveys or communication from some third party domain like qualtropics.com.
dwedge 31 minutes ago [-]
I guess it's easy to judge from the sidelines but was the screenshot of the site, if not the first tweet, not an obvious scam? And you can say it's from context but I only read the title before my eyes jumped to the screenshot
dwedge 30 minutes ago [-]
I just read the rest of the article and I'm back with my tail between my legs. I guess I made the author's point.
Hovertruck 25 minutes ago [-]
Don't worry, I think everyone probably went on the same roller coaster with this one
thadt 25 minutes ago [-]
In the movie Sneakers, a whole scene is taken up sending some guy on a date with Mary McDonnell so she could record clips of his voice. Today she'd just need a phone call or his Instagram. It's getting harder to keep up with who _people_ are online, much less organizations and domain names.
Identity is hard y'all.
harshreality 17 minutes ago [-]
They probably don't value being contactable by people who can't find higher-level contact info out-of-band, because there's too much noise.
LocalH 4 minutes ago [-]
Web security wasn't hard before we started trying to make the web a platform for full executable software.
I never got hacked through the web before JavaScript (never got hacked after either, yet, but it wasn't really possible in the same way to hack someone through the web without some way to execute program logic, which in the old days would have required a much more specific browser exploit to gain RCE).
JavaScript was a mistake. Everything else after that involves "running code in the browser" was a mistake.
Program execution needs to be completely separate from "the web". I don't want any code of any sort running in my browser, at least not any that I don't fully control. "The web" was never designed to be an application platform. It was only designed to be a document platform.
Joker_vD 31 minutes ago [-]
Another entry in "Marketing department starts a promotion campaign for the new product that's indistinguishable from a phishing attack" list. Starting with not using a subdomain on your own, very well-known domain but instead using a completely different one, then not having it shown with the rest of your services on your main web site, et cetera.
raesene9 13 minutes ago [-]
Same Story as it ever was. The first time I encountered what I thought was a phishing attack at the bank I worked at 25 years ago, it turned out to be a marketing campaign, with URLs that put our company name as a user before the domain name (back in the day when creds could go in the URL).
You really would think that at least in theory a company like Cloudflare would make it very easy for internal teams to automatically request new subdomains
make3 26 minutes ago [-]
this is the correct take
sghiassy 22 minutes ago [-]
Just use LLMs. They can apparently doing everything and all the things
thataccount 25 minutes ago [-]
Cloudflare is your favorite company and they are geniuses?
Dear Diary,
Today my fanboy bubble was burst.
Signed,
Author
ericlaw 4 minutes ago [-]
Note that I said: "One of my", and Cloudflare has hired a HUGE percentage of the best networking talent I've encountered.
thataccount 53 seconds ago [-]
Another company named Cisco used to do that. They built the Great Firewall of China. Hiring talent does not equal good company.
Rendered at 19:18:53 GMT+0000 (Coordinated Universal Time) with Vercel.
> There is no such product in our documentation or dashboard, so treat any email, website, or message claiming to be "Cloudflare Wallet" as a phishing attempt.
What's the point of adding these AI chatbots if they're hopelessly uninformed about your products?
Not really. At minimum, a half-way decent support person would ask a few people internally or search Slack before answering.
In fact, they would have likely already heard about the new product at lunch or something.
GitHub for ages had something like githubnext.com where they would make you do this same OAuth dance (except IIRC it was worse - it explicitly said that it WASNT GitHub). Apple has/had an apple.tv microsite or something they hosted content on.
Your bank will send you “legitimate” surveys or communication from some third party domain like qualtropics.com.
Identity is hard y'all.
I never got hacked through the web before JavaScript (never got hacked after either, yet, but it wasn't really possible in the same way to hack someone through the web without some way to execute program logic, which in the old days would have required a much more specific browser exploit to gain RCE).
JavaScript was a mistake. Everything else after that involves "running code in the browser" was a mistake.
Program execution needs to be completely separate from "the web". I don't want any code of any sort running in my browser, at least not any that I don't fully control. "The web" was never designed to be an application platform. It was only designed to be a document platform.
Dear Diary,
Today my fanboy bubble was burst.
Signed,
Author