4 ms·
Incidentally binaries from support.apple.com are also served on http.
by ChrisCinelli 8y ago
Incidentally binaries from support.apple.com are also served on http.
- aboutruby 8y agoThe downloads are in an HTTPS page leading to HTTPS download links, and HTTP redirects to HTTPS: https://support.apple.com/downloads/quicktime https://support.apple.com/downloads/quicktime for instance.
- ptx 8y ago> and HTTP redirects to HTTPS ...or to anywhere a MITM attacker wants to redirect you.
- ptx 8y agoI guess some people disagree? But if any response in the redirect chain is served over HTTP, it can be replaced with a different response containing any "Location" header of the attacker's choosing instead of the original one. So it doesn't matter if the eventual intended URL is an HTTPS URL, because it will never be reached. The redirect will go to the attacker's site instead. (And in the case of a download, the user will never notice because the file URL is usually not prominently displayed.) So a HTTP response anywhere in a redirect chain is equivalent to serving it over HTTP. Perhaps this was exactly the point of the parent post, but I thought it would be useful to make it explicit.