3 ms·
Does MITM on the attacker's device really increase the complexity? Setting up one of the http debugging proxies isn't that hard, all you need to do is modify a
by idunno246 10y ago
Does MITM on the attacker's device really increase the complexity? Setting up one of the http debugging proxies isn't that hard, all you need to do is modify a response body from a http request. ive done this plenty with charles to hack the loaded save state from games with no server side validation
- lstamour 10y agoSure. Let's put it this way: an app that doesn't validate SSL in such a way that your login service can be impersonated is... in some ways asking for attack, right? In addition to exploiting lax OpenID Connect validation to impersonate others, you could also steal credentials at this point, I would think. So while they're illustrating a weakness in Oauth client implementations, it relies on impersonating an SSL server that should already be mitigated by operating system or app-based certificate pinning, CRLs, etc. and as such isn't the root cause of the issue. This indirection/complication is what I meant by complexity.
- je42 10y agoNot only the authentication of an app should be TLS/SSL. The rest of the communication as well. Certificate pinning and such should be done anyway for all services the app uses. A consistent view and specified view on how to securely communicate over the network would clearly help. But maybe they should should issue another version of OAuth2 and require TLS for all communication; and leave the legacy of the non-encrypted traffic behind.
- dzhiurgis 10y agoCertificate pinning is gaining popularity e̶f̶f̶e̶c̶t̶i̶v̶e̶l̶y̶ somewhat thwarting MITM attacks.
- skrebbel 10y ago> e̶f̶f̶e̶c̶t̶i̶v̶e̶l̶y̶ wow, that must've been a lot of work
- ThisIs_MyName 10y agoHN doesn't support markdown, so he probably used http://adamvarga.com/strike/ http://adamvarga.com/strike/ Unicode strikethrough looks really bad on my font :(