3 ms·
> The main threat that HTTPS everywhere secures against is preventing your ISP from analyzing your traffic in order to build and sell an advertising profile on
by throwaway2016a 9y ago
> The main threat that HTTPS everywhere secures against is preventing your ISP from analyzing your traffic in order to build and sell an advertising profile on you.
That is not true. The main threat it protects against is MitM (man in the middle attacks) that allow someone to redirect all traffic to a website through their machine and thus see all the data including your password.
HTTPS when combined with root certificate trust is very effective at preventing these kind of attacks. Without it, using any shared internet at all (such as a company, school, or coffee shop) to log into any website or enter your credit card would be trivially easy to hack.
Seriously, I can boot up Wireshark, go to my coffee shop and easily see every non-HTTPS communication going over the network. IM messages, emails, and in cases like this post suggests... passwords too.
Edit: As a side note... I do this all the time to reverse engineer the wireless protocol for IOT devices since most of them do not use HTTPS yet. I use it for personal use but it could be used for harm as well. For instance, if the security cameras are IP cameras over HTTP I could probably intercept the password and use it to remotely turn off the cameras.
- oldmandutch 9y agoOr MitM and swap out G ads for someone else’s ads?
- revmoo 9y agoI'm not sure you understood his point..
- peterwwillis 9y agoMitM is blown out of proportion. Afaik, only dns poisoning attacks will result in MitM as effective as phishing or botnets, and poisoning can be mostly-solved with better resolvers. No criminal anywhere cares about your password going over the wire in a coffee shop.
- zAy0LfpBZLC8mAC 9y agoWhich is true exactly up to the point where some criminal decides it's an attack worth automating, as with every other attack. The one thing that reduces the likelihood of that happening is to minimize the amount of credentials you could get your hands on using that attack.
- throwaway2016a 9y agoIf you have a mass target sure, there are better attacks. But if you target is only a single network, packet sniffing is pretty effective and is stopped by HTTPS. And if you target is a single person or small group of enumerable machines, arp poisoning still works on many (most?) networks. Personally I am more scared of the damage that can be caused by being a direct target than I am having my info in one of those massive dark-web data dumps. Edit: Also, the ops post is actually an example of a MitM (where the ISP is the one in the middle). I just expanded it to the superset.