6 ms·
If my little web page containing a few photos of flowers is never moved to HTTPS, is that bad in any practical sense at all? Is there any plausible scenario wh
by exodust 10y ago
If my little web page containing a few photos of flowers is never moved to HTTPS, is that bad in any practical sense at all?
Is there any plausible scenario whereby visiting such a basic site without any forms or data collection over HTTP is in some way a disadvantage to HTTPS?
- nerdponx 10y agoAs far as I understand, it leaves your user is vulnerable to man in the middle attacks, injecting malicious code and so on.
- TheCycoONE 10y agoSure - your site is vulnerable to a MitM attack where the attacker abuses the trust your visitors have in your flower site to exploit whatever the latest browser vulnerability of the week is and compromise their computers.
- caf 10y agoSure. A MITM can inject javascript into the HTML the user receives from your site (just like the Comcast bandwidth cap example in the article) that causes the browser to open phishing or browser exploit pages.
- exodust 10y agoOk, fair enough. MITM attacks seems to be the consensus and good enough reason to move the flower page over to HTTPS.
- fiatjaf 10y agoThe disadvantage is only that Google will punish your site in its searches.
- exodust 10y agoThat was kind of what I was thinking, but several replies above mention MITM attacks, which I thought were extremely rare and non-trivial to execute, but I don't read up on that stuff much.
- guitarbill 10y agoExtremely trivial and common, see captive portals. They're not malicious, but could easily be. You can intercept and inject anything you want if you control the network with HTTP. Also, e.g. spoofing an unsecured WiFi network is pretty easy. Even on wired networks, do you know what path your traffic is taking? With HTTPS, it doesn't matter.
- kryptiskt 10y agoAn ISP or access point can inject ads in your page content.
- TorKlingberg 10y agoAn attacker can MitM your visitors, inject JavaScript and use it to DDoS third parties using your visitors browsers.
- marcosdumay 10y agoYes. Somebody can change in transit your flower site to do data collection, or even to install malware. When you visit a site over HTTP you can never be sure you are really getting the site you wanted to visit. There have been many recent cases of ISPs inserting advertisement on sites like yours. From there to malware it just takes a more ill intentioned actor.
- exodust 10y agoThanks, I suppose then the question is how rare these MITM attacks are. Would be interested to know stats and also growth of the attacks... like are they on the increase.
- marcosdumay 10y agoISPs hijacking HTTP sites is very common. That DDoS some other comment was talking about was used by China's gov to attack Github just about an year ago. I don't think script kiddie level attacks happen very often, because there are many easier avenues if you want to mass attack people. But MITM attacks can be very valuable for targeted attacks, because with it one can corrupt peers that your target trusts.
- euyyn 10y agoDo you actually have that web page with photos of flowers? Now I want to see them!
- exodust 10y agoI do have a flowers page, although I was only using 'flowers' as an example of something very simple served from http, I wasn't referring to my page. My flowers are actually hosted on Amazon so it's already automatically both http and https. I don't generally share my photos too widely, but since you asked I'll share my flowers... https://ozimg.s3.amazonaws.com/macro-flowers/index.htm https://ozimg.s3.amazonaws.com/macro-flowers/index.htm
- euyyn 10y agoOh, wow!