3 ms·
Yes, I was about to say this - if you have a secure enough content security policy (and the browser in question supports it properly) it will be impossible for
by andy_ppp 11y ago
Yes, I was about to say this - if you have a secure enough content security policy (and the browser in question supports it properly) it will be impossible for an attacker to execute their inserted Javascript (which to be able to do this anyway is also a security vulnerability).
But yes, the best plan is to have HTTPS everywhere, something that looks a lot closer than it once did! Thanks NSA!
- briandh 11y ago> if you have a secure enough content security policy (and the browser in question supports it properly) it will be impossible for an attacker to execute their inserted Javascript I don't follow your reasoning. Why wouldn't an MITM attacker modifying an HTTP response body to insert rogue Javascript also be able to modify the response headers to strip or alter the Content Security Policy?
- andy_ppp 11y agoGood point about MITM attacks; I assumed that we were talking about cross site scripting (XSS), but I suppose you are right. I still am willing to bet that SSL is not impossible to MITM. Someone will manage to find a flaw in such a complex system.