4 ms·
Currently the only mitigation is to constrain your browsing to properly configured https (SSL) web sites.
by 1ba9115454 9y ago
Currently the only mitigation is to constrain your browsing to properly configured https (SSL) web sites.
- w458cmau 9y agoOr using a VPN.
- hunter2_ 9y agoIt was quite nice to let a wifi router be the VPN client to offload it from all your laptops/phones/etc. and better guarantee "VPN always on".. so much for that.
- deleted 9y ago[deleted]
- filomeno 9y agoYou can (try) to restrict your browsing to HTTPS sites only. But it's very difficult to ensure that all the communications your device is making (background services, vendor apps...) go through that channel.
- haggy 9y agoThis issue is two-fold right. You can install plugins that force SSL client side (on the main site and any AJAX calls thereafter) but like you said you have no idea what calls that site is making server side. They could be sending everything you send them over plaintext after the initial TLS secured request. Rough times.
- Gaelan 9y agoLuckily, the servers past the initial SSL link won’t be using wifi, so at least you won’t be any worse off than before.
- krallja 9y agoIf only there were some certification body that ran an App Store with rules against unencrypted traffic...
- pixl97 9y agoToo bad DNS doesn't fall under properly protected against local attacks.
- pfg 9y agoFortunately, SSL/TLS (with HSTS) does not depend on your local DNS resolver being secure.
- Piskvorrr 9y agoFail-safe is indeed the preferred option here, yet the resulting Denial of Service is still unpleasant.
- Someone1234 9y agoHSTS only works if you have visited the site before or it is hard coded (see Chrome and Google services for example). Reality is that DNS remains and will continue to remain a giant hole in TLS.
- pfg 9y agoAll major browsers implement HSTS preloading, and getting added is quite simple. A very large percentage of your average internet user's traffic is covered by this.
- pixl97 9y agoPreloading is a problem waiting to happen. It works fine when only a small portion of the internet uses it. But when you have 2 GB preload file with a few billion entries things are not going to work so well.
- pfg 9y agoThe idea is to make HTTPS the default before that happens. In the meantime, you can fit a lot of domains into bloom filter-like data structures.