5 ms·

> This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. ... if transmitted over p

by dewey 9y ago

> This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. ... if transmitted over plaintext http

brango 9y ago
Or if combined with some other vulnerabilities...
- gcp 9y ago
  Somewhat pointless remark as WPA only protects up to the access point. Any vulnerability after that has wider implications regardless of the WPA status.
  - TheAdamAndChe 9y ago
    It's not really pointless. MiTM attacks become much easier to accomplish with something like sslstrip once access to the network is gained.
CityWanderer 9y ago
Exactly, this particular sentence seems to overly dramatise the situation. Is this issue any different to using open wifi at a cafe, which many many people do, relying on HTTPS for their security? (This is an honest question)
- ekimekim 9y ago
  At its worst, this attack reduces a protected network to an open wifi, yes. The risk is that you may do things on a protected network assuming it really is protected - this is more of a thing for organisations rather than consumers, for example organisations might have unprotected services accessible over their office wifi.
baby 9y ago
Note that in the demo video they use SSLStrip to cancel attempts of websites to switch to https. The only protection here is HSTS (which is not enabled by most websites, but major ones like banks will usually have them) and manually typing https:// https:// in your address.
- sanqui 9y ago
  You can (and should) also be using HTTPS Everywhere: https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere.
  - baby 9y ago
    I think it's a nice plugin until you forget that you're using it and you rage for minutes/hours trying to understand why you can't access some website. It might be worth it. I remember spending hours trying to figure out why Google Adsense wouldn't render correctly. In the end I figured out that it was Adblock's fault :))
- technion 9y ago
  I'm seeing HSTS on 0/3 of Australian banks (I'm even seeing RC4 on one of them). https://www.ssllabs.com/ssltest/analyze.html?d=commbank.com.au&s=54.192.142.239&latest https://www.ssllabs.com/ssltest/analyze.html?d=commbank.com.... https://www.ssllabs.com/ssltest/analyze.html?d=nab.com.au&s=164.53.221.205&latest https://www.ssllabs.com/ssltest/analyze.html?d=nab.com.au&s=... https://www.ssllabs.com/ssltest/analyze.html?d=westpac.com.au&latest https://www.ssllabs.com/ssltest/analyze.html?d=westpac.com.a...
  - stephen_g 9y ago
    Commonwealth's online banking is actually at my.commbank.com.au and does have HSTS - https://www.ssllabs.com/ssltest/analyze.html?d=www.my.commbank.com.au https://www.ssllabs.com/ssltest/analyze.html?d=www.my.commba... CUA does have it - https://www.ssllabs.com/ssltest/analyze.html?d=ob.cua.com.au https://www.ssllabs.com/ssltest/analyze.html?d=ob.cua.com.au Bankwest does but has some awful problems elsewhere - https://www.ssllabs.com/ssltest/analyze.html?d=ibs.bankwest.com.au&s=203.37.86.1&latest https://www.ssllabs.com/ssltest/analyze.html?d=ibs.bankwest.... But yeah, Westpac and NAB don't, and in addition to the ones you tested, ANZ and St. George don't have it either. That's pretty unacceptable really.

by dewey 9y ago

> This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. ... if transmitted over plaintext http

brango 9y ago

Or if combined with some other vulnerabilities...

gcp 9y ago
Somewhat pointless remark as WPA only protects up to the access point. Any vulnerability after that has wider implications regardless of the WPA status.
- TheAdamAndChe 9y ago
  It's not really pointless. MiTM attacks become much easier to accomplish with something like sslstrip once access to the network is gained.

CityWanderer 9y ago

Exactly, this particular sentence seems to overly dramatise the situation. Is this issue any different to using open wifi at a cafe, which many many people do, relying on HTTPS for their security? (This is an honest question)

ekimekim 9y ago
At its worst, this attack reduces a protected network to an open wifi, yes. The risk is that you may do things on a protected network assuming it really is protected - this is more of a thing for organisations rather than consumers, for example organisations might have unprotected services accessible over their office wifi.

baby 9y ago

Note that in the demo video they use SSLStrip to cancel attempts of websites to switch to https. The only protection here is HSTS (which is not enabled by most websites, but major ones like banks will usually have them) and manually typing https:// https:// in your address.

sanqui 9y ago
You can (and should) also be using HTTPS Everywhere: https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere.
- baby 9y ago
  I think it's a nice plugin until you forget that you're using it and you rage for minutes/hours trying to understand why you can't access some website. It might be worth it. I remember spending hours trying to figure out why Google Adsense wouldn't render correctly. In the end I figured out that it was Adblock's fault :))
technion 9y ago
I'm seeing HSTS on 0/3 of Australian banks (I'm even seeing RC4 on one of them). https://www.ssllabs.com/ssltest/analyze.html?d=commbank.com.au&s=54.192.142.239&latest https://www.ssllabs.com/ssltest/analyze.html?d=commbank.com.... https://www.ssllabs.com/ssltest/analyze.html?d=nab.com.au&s=164.53.221.205&latest https://www.ssllabs.com/ssltest/analyze.html?d=nab.com.au&s=... https://www.ssllabs.com/ssltest/analyze.html?d=westpac.com.au&latest https://www.ssllabs.com/ssltest/analyze.html?d=westpac.com.a...
- stephen_g 9y ago
  Commonwealth's online banking is actually at my.commbank.com.au and does have HSTS - https://www.ssllabs.com/ssltest/analyze.html?d=www.my.commbank.com.au https://www.ssllabs.com/ssltest/analyze.html?d=www.my.commba... CUA does have it - https://www.ssllabs.com/ssltest/analyze.html?d=ob.cua.com.au https://www.ssllabs.com/ssltest/analyze.html?d=ob.cua.com.au Bankwest does but has some awful problems elsewhere - https://www.ssllabs.com/ssltest/analyze.html?d=ibs.bankwest.com.au&s=203.37.86.1&latest https://www.ssllabs.com/ssltest/analyze.html?d=ibs.bankwest.... But yeah, Westpac and NAB don't, and in addition to the ones you tested, ANZ and St. George don't have it either. That's pretty unacceptable really.