3 ms·

> As for why this absolutely should be frowned upon: this doesn't provide any actual security... I was under the impression that some of the newer APIs only wo

by mook 9y ago

> As for why this absolutely should be frowned upon: this doesn't provide any actual security... I was under the impression that some of the newer APIs only work under SSL (e.g. geolocation, https://developers.google.com/web/updates/2016/04/geolocation-on-secure-contexts-only https://developers.google.com/web/updates/2016/04/geolocatio... ). This would mean they'd need this even if they were not requiring security. The specific instance is probably to tick a checklist for the content provider though.

saurik 9y ago
...and the reason that those APIs require SSL is so you can't access them via man-in-the-middle attacks of other websites that you have authorized access to those APIs for. The attack here is that I can use those APIs on your computer if you try to access this service, as I can forge the insecure DNS responses to get you to connect to my instead of localhost and then forge the SSL verification to make the hostname valid. I don't even need you to try to use the service as I can hijack an existing HTTP connection you make and give you an iframe or a redirect. If I access those APIs, I am then working off of Cisco's authorizations; if they have used any of these APIs and the user authorized them I control them, and if the user hasn't they will be asked to authorize Cisco, not me, which might seem legitimate.