search

ScottHelme / hibp-breached-sites-security-analysis

0 stars 1 forks source link

Ancestry.com has security.txt file #1

Open slavos1 opened 1 year ago

slavos1 commented 1 year ago

Looking at FAIL: ancestry.com - 301, it is probably too strict -- the site serves the file if the request https://ancestry.com/.well-known/security.txt is allowed to be redirected:

HTTP/1.1 200 OK
...
Content-Type: text/plain;charset=UTF-8
...
Contact: mailto:securityinfo@ancestry.com
Expires: 2024-01-05T17:00:00.000Z
Preferred-Languages: en
Canonical: https://www.ancestry.com/.well-known/security.txt
Policy: https://www.ancestry.com/c/legal/security
slavos1 commented 1 year ago

Actually, it's a bit more. In the blog post, you state:

On the strict check, only 6 sites out of the 641 checked have a security.txt file and on the relaxed check, it's slightly better at 11... That means we're only seeing around 1.7% of these sites using security.txt files!

but if one allows redirects, the results are a tiny bit better albeit still abysmal: 15/641=2.3% (strict) and 25/641=3.9% (relaxed).