--- title: Security Is Hard, Y'all | daily.dev description: A security expert recounts nearly falling for what appeared to be a phishing attack — only to discover it was a legitimate new Cloudflare product (Cloudflare... canonical: https://daily.dev/posts/security-is-hard-y-all-vttfbhhis twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security Is Hard, Y'all | daily.dev og:description: A security expert recounts nearly falling for what appeared to be a phishing attack — only to discover it was a legitimate new Cloudflare product (Cloudflare... og:url: https://daily.dev/posts/security-is-hard-y-all-vttfbhhis og:image: https://api.daily.dev/og/posts/VtTfbhhiS.png og:image:alt: Security Is Hard, Y'all og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security Is Hard, Y'all **[Hacker News](https://daily.dev/sources/hn)** · 4 min read · 0 upvotes · 0 comments ## Summary A security expert recounts nearly falling for what appeared to be a phishing attack — only to discover it was a legitimate new Cloudflare product (Cloudflare Wallet) that violated nearly every web security best practice. The site used an unfamiliar domain (cloudflare.pay instead of cloudflare.com), triggered urgency cues, displayed a suspicious green checkmark, and lacked any in-context scam reporting mechanism. The story illustrates how legitimate companies inadvertently train users to ignore phishing signals, making life harder for both users and URL reputation services like Microsoft SmartScreen. Key takeaways for web developers: host features under trusted domains, display security UI in trustworthy locations, and make scam reporting trivially easy. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 2 discussions and 113 comments across hackernews, lobsters (as of 2026-08-11). **TL;DR:** The community is largely critical of Cloudflare for launching a financial product on an unfamiliar domain (cloudflare.pay) that violates basic security hygiene, with many commenters noting this is a widespread industry anti-pattern rather than an isolated failure. A minority see it as a systemic organizational problem rather than a purely technical one. **Sentiment:** 5% positive · 25% mixed · 70% skeptical **The case for** - Cloudflare quickly updated the cloudflare.pay site to link to the official blog post on the same day of launch. - The OAuth permissions requested were relatively low-risk (Account Settings Read, Memberships Read, User Details Read). **The pushback** - Launching on a separate, unfamiliar TLD (cloudflare.pay) instead of a subdomain of cloudflare.com trains users to ignore phishing signals. - Cloudflare's own AI chatbot denied the product existed, undermining trust and demonstrating how uninformed support tooling can be. - The TLS certificate is domain-validated only with no org info, making it indistinguishable from a phishing site's cert. - The pattern of marketing teams spinning up new domains to bypass internal approval processes is endemic and harms users across the industry. - Brave browser blocked the site, and URL reputation services flagged it as phishing — a real-world consequence of the poor domain choice. - Cloudflare's own security reporting mechanism (HackerOne) was broken due to a Cloudflare CAPTCHA failure, adding irony to the situation. - The site returned an Internal Server Error post-auth, suggesting a rushed, under-tested launch. **By community** - hackernews (skeptical): Strongly critical of Cloudflare's domain choice and organizational dysfunction, with extensive debate about whether this is a developer, marketing, or management failure — and a side thread on whether JavaScript itself is to blame for web security woes. - lobsters (skeptical): Concisely critical, with commenters pointing out that a security-focused company actively undermining security practices is the core irony, and one commenter noting their password manager refusing to autofill is a reliable phishing signal. **Hottest debate:** Whether the blame lies with web developers, marketing teams, or organizational management for allowing new products to launch on untrusted external domains instead of subdomains of the canonical company domain. **Open questions** - Why is it so difficult for large companies to provision a subdomain on their own trusted domain for new products? - How should URL reputation services and browsers handle legitimate new domains from known companies that look identical to phishing sites? - Should companies be required to publish new product pages on their canonical domain before or simultaneously with any external domain launch? **Highlights** > Another entry in "Marketing department starts a promotion campaign for the new product that's indistinguishable from a phishing attack" list. Starting with not using a subdomain on your own, very well-known domain but instead using a completely different one, then not having it shown with the rest of your services on your main web site, et cetera. > — [Joker\_vD on hackernews · 4 comments](https://news.ycombinator.com/item?id=49173108) > You'd think, but nope, it def doesn't — the site's TLS cert is issued by Google Trust Services, which issues domain-validated certs via ACME, so no, the only thing the site owner had to do to get that certificate is demonstrate ownership of the `cloudflare.pay` domain. GTS is also one of the default CAs that Cloudflare's universal SSL uses, so that's also exactly what would show up for any Cloudflare-proxied site with TLS enabled. The cert itself only has CN=cloudflare.pay. It lacks an org, an address, or any other identifying info. It's not OV/EV, so no details there, either. The domain's whois is also devoid of identifying details: https://rdap.nominet.uk/pay/domain/cloudflare.pay Registered through 101domain, with nothing except a registrar abuse contact. I mean, great that this is legit, but CF could have done a better job with making it actually _look_ legit. This looks sketchy as fuck. edit - gawd, nevermind. they don't even have anything useful for cloudflare.com. Same GTS cert, redacted whois info. lol. how did we even get here. > — [lee\_ars on hackernews](https://news.ycombinator.com/item?id=49176283) > Ironically, this might be at least partially because the internal security controls at Cloudflare for using or provisioning new domains/subdomains is so difficult and arduous that the team decided the fastest way to go to market is to get an entirely new domain. Possible bonus that the official bug bounty program won't apply either, since it's on a new domain so any vulnerabilities found won't have to be paid out (as much). > — [epochbtc on hackernews · 2 comments](https://news.ycombinator.com/item?id=49173505) > The Cloudflare folks apparently want security issues reported via HackerOne (which wouldn’t let me log in because the Cloudflare CAPTCHA HackerOne uses seems to be broken…). That's just gold > — [Insimwytim on hackernews](https://news.ycombinator.com/item?id=49175353) > `cloudflare.pay` is quite a choice. If my password manager doesn't want to autofill a site, I'm gone. Just assume it's a scam. > — [rnb37 on lobsters · 1 points](https://lobste.rs/s/qoptbx/security_is_hard_y_all#c_zgtzym) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49172834) · 182 points · 108 comments - [lobsters](https://lobste.rs/s/qoptbx/security_is_hard_y_all) · 49 points · 5 comments ## Similar posts on daily.dev - [A rant about phishing: It's not the user's fault \(and not DNS either\)](https://daily.dev/posts/a-rant-about-phishing-it-s-not-the-user-s-fault-and-not-dns-either--n2cdie19s) · Lobsters · 0 upvotes · 0 comments - [How to spot a suspicious website](https://daily.dev/posts/how-to-spot-a-suspicious-website-oiu9edxwk) · Securelist · 0 upvotes · 0 comments - [Cheapskates wouldn't pay for security help, got hit by ransomware, and went bust months later](https://daily.dev/posts/cheapskates-wouldn-t-pay-for-security-help-got-hit-by-ransomware-and-went-bust-months-later-b7yaiyxec) · The Register · 0 upvotes · 0 comments - [What the Recent PayPal Breach Says About Modern Web Risk](https://daily.dev/posts/what-the-recent-paypal-breach-says-about-modern-web-risk-uhz6thlec) · Security Boulevard · 0 upvotes · 0 comments - [I fell for a phishing attack and lost access to my X account. Here are five mistakes I did that you need to avoid\!](https://daily.dev/posts/i-fell-for-a-phishing-attack-and-lost-access-to-my-x-account-here-are-five-mistakes-i-did-that-you--cfsxn3pdx) · Christian Heilmann · 7 upvotes · 2 comments --- Tags: [#security](https://daily.dev/tags/security), [#phishing](https://daily.dev/tags/phishing), [#cloudflare](https://daily.dev/tags/cloudflare), [#web-security](https://daily.dev/tags/web-security) [View this post on daily.dev](https://daily.dev/posts/security-is-hard-y-all-vttfbhhis) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security Is Hard, Y'all","url":"https://daily.dev/posts/security-is-hard-y-all-vttfbhhis","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-is-hard-y-all-vttfbhhis"},"datePublished":"2026-08-04T19:03:29.858Z","dateModified":"2026-08-11T15:38:28.492Z","description":"A security expert recounts nearly falling for what appeared to be a phishing attack — only to discover it was a legitimate new Cloudflare product (Cloudflare...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/security-is-hard-y-all-vttfbhhis","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,phishing,cloudflare,web-security","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Security Is Hard, Y'all"}]} ```