3 ms·

How viable is the interception a http-to-https redirect page? What is the recommended way to redirect users to https?

schoen 9y ago
> How viable is the interception a http-to-https redirect page? It can be very powerful if done maliciously: https://www.youtube.com/watch?v=MFol6IMbZ7Y https://www.youtube.com/watch?v=MFol6IMbZ7Y (This kind of attack is a primary motivation for the existence of HSTS.)
- ktta 9y ago
  Relevant part starts here https://youtu.be/MFol6IMbZ7Y?t=23m17s https://youtu.be/MFol6IMbZ7Y?t=23m17s Although for anyone interested in HTTPS, I'd recommend watching the whole thing. Very entertaining.
deleted 9y ago
[deleted]
hannob 9y ago
If you're a network-level attacker it's basically trivial. If you get requests over HTTP of course you should still redirect them, as there's nothing more secure you can do. However via HSTS and even more via HSTS preloading you can prevent them from happening in the first place.
niftich 9y ago
Exactly as viable as any MitM against (unsecured) HTTP. The recommended way is still a 3xx-class redirect (consult your SEO) to the HTTPS version, because it's better than nothing -- in other words: - if an MitM already tampered with the response, they already have control and given the momentary circumstances there's nothing more anyone can do to save you; - else, if no one tampered with the response, then hopefully the site was configured properly and you ended up at the HTTPS version, receiving any HSTS headers the site owner may have issued, at which point you're either safe for the current session, or depending on any received HSTS headers, longer than that. Rinse and repeat.
Ajedi32 9y ago
Ideally, you should use HSTS preloads in combination with a 301 or 308 redirect. HTTP redirects can be intercepted by anyone who is a MITM (man-in-the-middle) to your connection. (Such as a Wi-Fi hotspot owner, ISP, or someone attacking the network itself via DNS poisoning, ARP spoofing, etc.) So using _only_ HTTP redirects leaves you open to a [SSL Stripping attack][1]. A better option is to use a HSTS header. This ensures that once a user visits your site once over HTTPS, all subsequent visits will also happen over HTTPS. This makes SSL Stripping attacks harder, but still possible if the attacker is able to MITM your users on their first visit to your site. The best option is to get your site on the list of HSTS preloads. This list ships with web browsers, which will then _always_ load your site over HTTPS. A site that uses HSTS preloads is nearly immune to SSL Stripping attacks, and that's what Google is using here. Some browsers still don't support HSTS though, so you might not be able to rely entirely on HSTS preloads to redirect your users. For that reason, it's best to _also_ redirect users via 301 or 308 HTTP redirects, just in case. [1]: https://security.stackexchange.com/q/41988/29865 https://security.stackexchange.com/q/41988/29865
- CydeWeys 9y ago
  > HTTP redirects can be intercepted by anyone who is a MITM (man-in-the-middle) to your connection. (Such as a Wi-Fi hotspot owner, ISP, or someone attacking the network itself via DNS poisoning, ARP spoofing, etc.) Don't forget state actors. Billions of people live in countries that censor/track/edit/redirect Web connections.

> How viable is the interception a http-to-https redirect page? It can be very powerful if done maliciously: https://www.youtube.com/watch?v=MFol6IMbZ7Y https://www.youtube.com/watch?v=MFol6IMbZ7Y (This kind of attack is a primary motivation for the existence of HSTS.)

ktta 9y ago
Relevant part starts here https://youtu.be/MFol6IMbZ7Y?t=23m17s https://youtu.be/MFol6IMbZ7Y?t=23m17s Although for anyone interested in HTTPS, I'd recommend watching the whole thing. Very entertaining.

deleted 9y ago

[deleted]

hannob 9y ago

If you're a network-level attacker it's basically trivial. If you get requests over HTTP of course you should still redirect them, as there's nothing more secure you can do. However via HSTS and even more via HSTS preloading you can prevent them from happening in the first place.

niftich 9y ago

Exactly as viable as any MitM against (unsecured) HTTP. The recommended way is still a 3xx-class redirect (consult your SEO) to the HTTPS version, because it's better than nothing -- in other words: - if an MitM already tampered with the response, they already have control and given the momentary circumstances there's nothing more anyone can do to save you; - else, if no one tampered with the response, then hopefully the site was configured properly and you ended up at the HTTPS version, receiving any HSTS headers the site owner may have issued, at which point you're either safe for the current session, or depending on any received HSTS headers, longer than that. Rinse and repeat.

Ajedi32 9y ago

Ideally, you should use HSTS preloads in combination with a 301 or 308 redirect. HTTP redirects can be intercepted by anyone who is a MITM (man-in-the-middle) to your connection. (Such as a Wi-Fi hotspot owner, ISP, or someone attacking the network itself via DNS poisoning, ARP spoofing, etc.) So using _only_ HTTP redirects leaves you open to a [SSL Stripping attack][1]. A better option is to use a HSTS header. This ensures that once a user visits your site once over HTTPS, all subsequent visits will also happen over HTTPS. This makes SSL Stripping attacks harder, but still possible if the attacker is able to MITM your users on their first visit to your site. The best option is to get your site on the list of HSTS preloads. This list ships with web browsers, which will then _always_ load your site over HTTPS. A site that uses HSTS preloads is nearly immune to SSL Stripping attacks, and that's what Google is using here. Some browsers still don't support HSTS though, so you might not be able to rely entirely on HSTS preloads to redirect your users. For that reason, it's best to _also_ redirect users via 301 or 308 HTTP redirects, just in case. [1]: https://security.stackexchange.com/q/41988/29865 https://security.stackexchange.com/q/41988/29865

CydeWeys 9y ago
> HTTP redirects can be intercepted by anyone who is a MITM (man-in-the-middle) to your connection. (Such as a Wi-Fi hotspot owner, ISP, or someone attacking the network itself via DNS poisoning, ARP spoofing, etc.) Don't forget state actors. Billions of people live in countries that censor/track/edit/redirect Web connections.