The “Front Door” and the “Inner Door” of a Shop’s Website: Which One Is Stronger?

Also published on Egosaru and Site Scouter. Japanese edition: 日本語版

Phone payment and bank websites have a “front door” that everyone sees, and an “inner door” you use when you log in. We knocked on 343 front doors and 1,010 inner doors. This manga gently shows which ones are stronger, and what can happen when a door is not strong.

The Manga

Under each page, the same story is also written out in words.

Page 1: Why Did We Look?

Mio (looking at a phone, worried) “Mom’s phone payment said ‘Can’t connect’ at the shop…”
Sota (opening a laptop) “Remember? We collected searches for ‘not working’ from all over the world. This time, we went to see if those shops’ websites are strong.”
Senior Haruka (knocking on a door) “We only ‘went to see’ by knocking on the door and saying ‘Hello.’ We don’t go inside. We don’t try to open the lock, either.”

Page 2: The Front Door and the Inner Door

Senior Haruka (pointing at a picture of a shop) “Websites have a ‘front door’ that everyone sees. They also have an ‘inner door’ you go through when you log in. We looked at 343 front doors and 1,010 inner doors.”
Sota “The inner door has to let old apps and old phones through, too. So it’s hard to make it new.”
Mio “But they make the front door all over again for every new campaign!”

Page 3: About Locks

Senior Haruka (holding two keys) “Door locks come in a new type and an old type. If a door still opens with the old-type lock, there’s a little more worry that someone could force it open.”
Sota “Doors that still open with the old-type lock: 4 out of 100 front doors, and 8 out of 100 inner doors.”
Mio “Huh? That’s not very different?” Sota “That’s when you count them all together. But if you compare inside ‘the same shop,’ only the sign is very different.”

Page 4: Comparing Inside the Same Shop

Sota (showing a table) “At about 11 shops, the front door says no to the old-type lock, but the inner door still opens with it. About 6 shops are the other way around. So the difference is small.”
Senior Haruka “About 24 shops have the newest-type lock at the front door, but not at the inner door. About 17 are the other way around. That’s not a very big difference, either.”
Mio (thinking) “So how new the locks are isn’t that different… Then what about the sign?”

Page 5: The “Always Come This Way” Sign

Senior Haruka (holding a sign) “A door can put up a sign. It says, ‘You can only come in by the safe road.’ 45 out of 100 inner doors have no sign.”
Sota “About 84 shops have the sign at the front door, but not at the inner door. Only about 17 are the other way around.”
Senior Haruka (raising one finger) “But some inner doors are just ‘desks that show you the way.’ They may not need a sign. So don’t take that number too strictly.”

Page 6: Why Is It a Problem?

Mio (holding a phone in a café; a person in a hood sits at the next table) “I’ll log in on the café’s free Wi-Fi. …Huh? Is the person next to me looking this way?”
Senior Haruka (pointing at a map with two roads on it) “This is what happens without the sign. A bad person can secretly offer a ‘road with no lock.’ Your phone won’t notice, and it will go that way. Then the password you type can be seen by anyone.”
Sota (pointing at a door with an old padlock and a model-number plate) “If a door still opens with the old-type lock, someone can ask it, ‘Please open with the old lock.’ If the door has its model number on it, people can look up how to open it. Of the doors we checked, 8 had their way of opening already made public.”

Page 7: A Door’s Name Tells You a Lot

Sota “Doors have names. Doors with old-generation names like ‘mobile’ or ‘online’ don’t have the new lock about 30 out of 100 times.”
Senior Haruka “Doors made recently, with names like ‘login’ or ‘auth,’ were about as new as the front door.”
Mio (smiling) “Then we can start by fixing the doors with old names!”

Page 8: Wrap-Up

Senior Haruka (giving a thumbs-up) “This way of checking doesn’t decide if a shop is ‘safe or dangerous.’ We just knocked and listened to the answer.”
Sota “The locks had a small difference. But for the sign, many more shops had it ‘at the front door, but not at the inner door.’ We want to tell them, ‘Please check the inner door, too.'”
All three “We won’t say the shops’ names. These numbers are for fixing things together.”

For Adults (About the Numbers in This Article)

Figure 1 Main results of this survey (4 points)

All numbers come from the same observation as the sister article, “Clean at the Front, Outdated Further In?”. The “lock” is TLS (old type = TLS 1.0/1.1, new type = TLS 1.3), the “sign” is HSTS, the “inner door” is a host used for login, authentication or APIs, and the “knock” is passive observation consisting of one DNS lookup, one TLS handshake and one HTTP GET each.
“N out of 100” is the percentage from the standard edition (one decimal place) rounded to an integer. The numbers in “Comparing Inside the Same Shop” use 268 shops (domains) as the denominator and are the mean of 1,000 repetitions of choosing one inner door per shop (shops with more inner doors more often have “any one of them” old, so this removes that bias).
The inner doors were selected mechanically from their names, and whether they are really login screens was not checked. The “no sign” figures also include desks that only show the way (redirects).
On page 6, the “road with no lock” refers to SSL stripping, “asking it to open with the old lock” refers to a downgrade attack, and “the way of opening already made public” refers to matching disclosed versions against known vulnerabilities (CVE). These are all general descriptions of techniques and have never been tried against real sites. “The 8 whose way of opening was made public” is the number of hosts whose disclosed version strings matched known vulnerability information; whether they can actually be attacked was not confirmed.
The correspondence between shops (brands) and sites was checked one by one before publication, and where a different shop’s site had been examined, it was either replaced with the correct site or excluded from the aggregation (Section 2.1 of the standard edition).
Which shops are involved is not disclosed.