These particular ones are $29.95/month, and don't appear to include any sort of scanning, verification, etc. So there's not even a "theater level" attempt to relate to security.
Another in the growing line of supply chain attacks. It's inevitable that as primary sites improve their security, attackers will seek to exploit other elements in the chain that might present easier targets.
Given the number of 3rd party JavaScript files that commonly get loaded for things like tracking and analytics, it seems likely we'll see more of these kinds of sites getting targeted.
Trust seals are easily faked and train users to trust in band signaling (eg images of locks etc to mimic HTTPS, logos etc) instead of paying attention to the URL bar.
They should be considered harmful with or without malicious javascript.
9 comments
[ 3.6 ms ] story [ 40.0 ms ] threadhttps://developer.mozilla.org/en-US/docs/Web/Security/Subres...
Appears these seals have died out.
Given the number of 3rd party JavaScript files that commonly get loaded for things like tracking and analytics, it seems likely we'll see more of these kinds of sites getting targeted.
What will we do without the tracking scripts???
They should be considered harmful with or without malicious javascript.