3 ms·

You're exposing your users to MITM attacks by not deploying SSL. While your setup stays the same, major security flaws are found in different parts of the stac

You're exposing your users to MITM attacks by not deploying SSL. While your setup stays the same, major security flaws are found in different parts of the stacks. Security is a process, by neglecting it you're paying for resources that are abused by attackers in order to harm other users.

1996 8y ago
If you want to mitm my static site with no login and mostly PDFs, you are welcome to. Security is a state of mind, not a bunch of recipes. Some things must be protected, some for some others it doesn't make sense
- purerandomness 8y ago
  How do you know your users are seeing "a static site with no login and mostly PDFs"? Security is a state of mind, indeed.
  - 1996 8y ago
    I know because I make the site and use it too
    - purerandomness 8y ago
      I know, but now anyone can: * Inject a cryptocurrency miner JavaScript into your page during the transmission of your static HTML page to your clients, without you or your users knowing it [1] * Injecting explicit, illegal image material that would get your clients immediately in legal trouble for possession of such material, without you knowing * Injecting a JS snippet that, instead of your site's contents, shows a fake antivirus page, telling the clients that your site is malicious and that a threat was eliminated by Fake Antivirus 10.0 and that they should immediately call Microsoft Support (Phone number in Bangladesh) for further "assistance". There they're told they need to get a full cleaning of the hard drive for only 99$ and are asked for their CC number The point is: If you don't have end-to-end-encryption, you can never be sure what your users see. They might see your site - or some slightly modified version of your site, with a login box, phishing passwords from your users, abusing their trust in your brand. A MITM has nothing to do with someone gaining access to your server. It's someone gaining access to infrastructure - a vulnerable public wifi, for instance. [1] https://www.hacking.reviews/2018/01/coffeeminer-collaborative-mitm.html?m=0 https://www.hacking.reviews/2018/01/coffeeminer-collaborativ...
      - 1996 8y ago
        Fair enough. I will enable https on cloudflare.

1996 8y ago

If you want to mitm my static site with no login and mostly PDFs, you are welcome to. Security is a state of mind, not a bunch of recipes. Some things must be protected, some for some others it doesn't make sense

purerandomness 8y ago
How do you know your users are seeing "a static site with no login and mostly PDFs"? Security is a state of mind, indeed.
- 1996 8y ago
  I know because I make the site and use it too
  - purerandomness 8y ago
    I know, but now anyone can: * Inject a cryptocurrency miner JavaScript into your page during the transmission of your static HTML page to your clients, without you or your users knowing it [1] * Injecting explicit, illegal image material that would get your clients immediately in legal trouble for possession of such material, without you knowing * Injecting a JS snippet that, instead of your site's contents, shows a fake antivirus page, telling the clients that your site is malicious and that a threat was eliminated by Fake Antivirus 10.0 and that they should immediately call Microsoft Support (Phone number in Bangladesh) for further "assistance". There they're told they need to get a full cleaning of the hard drive for only 99$ and are asked for their CC number The point is: If you don't have end-to-end-encryption, you can never be sure what your users see. They might see your site - or some slightly modified version of your site, with a login box, phishing passwords from your users, abusing their trust in your brand. A MITM has nothing to do with someone gaining access to your server. It's someone gaining access to infrastructure - a vulnerable public wifi, for instance. [1] https://www.hacking.reviews/2018/01/coffeeminer-collaborative-mitm.html?m=0 https://www.hacking.reviews/2018/01/coffeeminer-collaborativ...
    - 1996 8y ago
      Fair enough. I will enable https on cloudflare.