6 ms·

Or to ensure that the content is not tampered.

by medecau 11y ago

peterwwillis 11y ago
Nobody would tamper with this content.
- Buge 11y ago
  China injected javascript malware into non-https traffic that joined the users into a botnet that launched a DDOS attack on Github. The "Great Cannon".
  - peterwwillis 11y ago
    The "Great Cannon" only targeted foreign traffic destined for Chinese websites. This one is not.
    - Buge 11y ago
      Yes but they just as easily could have targeted traffic to this site as well. Also a number of ISPs and wifi hotspots inject ads, and I know Verizon injected a tracking header based on your mobile plan.
      - peterwwillis 11y ago
        So Verizon is going to inject some 0day malware into this page to, what, serve you more ads? If you're concerned about tracking cookies or headers, get a plug-in to stop it. Every website on the planet should not need to use https just because Verizon wants to make money off targeted ads. And nobody is attacking this page to hack individuals. Of course you can. Security isn't about preventing every single possible attack from every possible angle. It's about making attacks more difficult when one is plausible or likely. Nobody will attack you through this particular website. So https is not needed to prevent a targeted attack.
- lenish 11y ago
  That's not actually true. There have been several documented examples now of people injecting stuff into HTTP requests when they pass by (ISPs injecting notifications, ads, people running proxies injecting malicious javascript, etc).
  - peterwwillis 11y ago
    It's completely true. This content would never be targeted for MITM. It's a dashboard for displaying the global locations of DNS root servers and links to their authoritative organizations. Not only is this an incredibly niche site, all DNS root server information is replicated around the world by multiple organizations. Nobody uses this site to maintain their DNS trusts, it probably gets incredibly low traffic, and going out of your way to MITM it would be a lot of work for no payoff. This is a terrible target. Nobody would bother.
    - lenish 11y ago
      It's not strictly about targeted attacks. There are people who modify unencrypted content that passes through their system regardless of what content it is. There have been several presentations on this topic, but I'll link the slides for one [0]. Here's an article about an ISP injecting ads in case you don't think this sort of thing happens in real systems [1]. [0] https://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-edward_zaborowski-doppelganger.pdf https://www.defcon.org/images/defcon-17/dc-17-presentations/... [1] http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok/ http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-f...

Or to ensure that the content is not tampered.

by medecau 11y ago

Or to ensure that the content is not tampered.

peterwwillis 11y ago

Nobody would tamper with this content.

Buge 11y ago
China injected javascript malware into non-https traffic that joined the users into a botnet that launched a DDOS attack on Github. The "Great Cannon".
- peterwwillis 11y ago
  The "Great Cannon" only targeted foreign traffic destined for Chinese websites. This one is not.
  - Buge 11y ago
    Yes but they just as easily could have targeted traffic to this site as well. Also a number of ISPs and wifi hotspots inject ads, and I know Verizon injected a tracking header based on your mobile plan.
    - peterwwillis 11y ago
      So Verizon is going to inject some 0day malware into this page to, what, serve you more ads? If you're concerned about tracking cookies or headers, get a plug-in to stop it. Every website on the planet should not need to use https just because Verizon wants to make money off targeted ads. And nobody is attacking this page to hack individuals. Of course you can. Security isn't about preventing every single possible attack from every possible angle. It's about making attacks more difficult when one is plausible or likely. Nobody will attack you through this particular website. So https is not needed to prevent a targeted attack.
lenish 11y ago
That's not actually true. There have been several documented examples now of people injecting stuff into HTTP requests when they pass by (ISPs injecting notifications, ads, people running proxies injecting malicious javascript, etc).
- peterwwillis 11y ago
  It's completely true. This content would never be targeted for MITM. It's a dashboard for displaying the global locations of DNS root servers and links to their authoritative organizations. Not only is this an incredibly niche site, all DNS root server information is replicated around the world by multiple organizations. Nobody uses this site to maintain their DNS trusts, it probably gets incredibly low traffic, and going out of your way to MITM it would be a lot of work for no payoff. This is a terrible target. Nobody would bother.
  - lenish 11y ago
    It's not strictly about targeted attacks. There are people who modify unencrypted content that passes through their system regardless of what content it is. There have been several presentations on this topic, but I'll link the slides for one [0]. Here's an article about an ISP injecting ads in case you don't think this sort of thing happens in real systems [1]. [0] https://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-edward_zaborowski-doppelganger.pdf https://www.defcon.org/images/defcon-17/dc-17-presentations/... [1] http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok/ http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-f...