3 ms·

This was a problem for Pokémon Showdown recently. We use HTTPS for logins and some other things, which stopped working a few days ago for users using MitM antiv

by Zarel 11y ago

This was a problem for Pokémon Showdown recently. We use HTTPS for logins and some other things, which stopped working a few days ago for users using MitM antiviruses and Firefox. https://twitter.com/TonyFlygon/status/684756701027954689 https://twitter.com/TonyFlygon/status/684756701027954689 (Example user complaint.) There's no way to detect whether or not an HTTPS iframe has failed to load, so my workaround was to fall back to HTTP if the HTTPS iframe didn't load within 2 seconds. We still switch the connection over to HTTPS if the iframe does eventually load. I'm kind of confused by why so many users thought it was a Pokemon Showdown issue, specifically. Doesn't Google default to HTTPS? PS shouldn't be the most significant website they have trouble with.

leesalminen 11y ago
Why not use HTTPS everywhere?
- Zarel 11y ago
  Well, we do support full-HTTPS, it just isn't required. If it were, PS would have been unusable to anyone with Firefox and Avast/BitDefender/etc. It also allows image embeds. Users often share HTTP images in the chatrooms, which browsers using the HTTPS site complain about. For some weird reason, Google Chrome doesn't support data-URIs in HTTPS when using HTML5 drag-and-drop to drag files from a website to the desktop, which requires an annoying workaround. In addition, most people wanting to set up a third-party PS server don't want to go through the hassle of acquiring a certificate. It makes the setup process a lot more complicated than just "clone the repository and run ./pokemon-showdown"
Buge 11y ago
That opens you up to any active attacker simply stopping traffic. You're usually safe against passive attacks if the network has no glitches, but completely vulnerable to active attacks. Then again, if you don't use https on the whole site, active attacks could already simply change the url of the iframe to be http and intercept that with sslstrip, and passive attacks could already steal cookies.
- Zarel 11y ago
  Yeah, I was going to ask the user for confirmation before falling back to HTTP, when I realized what you did: an active attacker can just change the URL of the iframe. Anyone who really needs secure pokemon battles can just use the HTTPS site, anyway. (Which does ask the user for confirmation before falling back to HTTP, if an HTTPS connection fails)

by Zarel 11y ago

leesalminen 11y ago

Why not use HTTPS everywhere?

Zarel 11y ago
Well, we do support full-HTTPS, it just isn't required. If it were, PS would have been unusable to anyone with Firefox and Avast/BitDefender/etc. It also allows image embeds. Users often share HTTP images in the chatrooms, which browsers using the HTTPS site complain about. For some weird reason, Google Chrome doesn't support data-URIs in HTTPS when using HTML5 drag-and-drop to drag files from a website to the desktop, which requires an annoying workaround. In addition, most people wanting to set up a third-party PS server don't want to go through the hassle of acquiring a certificate. It makes the setup process a lot more complicated than just "clone the repository and run ./pokemon-showdown"

Buge 11y ago

That opens you up to any active attacker simply stopping traffic. You're usually safe against passive attacks if the network has no glitches, but completely vulnerable to active attacks. Then again, if you don't use https on the whole site, active attacks could already simply change the url of the iframe to be http and intercept that with sslstrip, and passive attacks could already steal cookies.

Zarel 11y ago
Yeah, I was going to ask the user for confirmation before falling back to HTTP, when I realized what you did: an active attacker can just change the URL of the iframe. Anyone who really needs secure pokemon battles can just use the HTTPS site, anyway. (Which does ask the user for confirmation before falling back to HTTP, if an HTTPS connection fails)