5 ms·

Why? Also there is https on the more sensitive parts of the site (login etc).

by Nux 7y ago

shawabawa3 7y ago
pretty meaningless when you can MITM the page and remove https from all the links
- jasonkester 7y ago
  Can you? Please demonstrate. This is one of the silliest arguments that comes up every time "SSL All The Things!" is discussed. The "you" in your story has to be both a Bad Guy and your ISP, and needs to come up with a way to sabotage a site that shows you cat pictures in such a way that it shows malicious cat pictures that somehow do anybody any harm. So yeah, please MITM this site for us real quick so we can see all the Bad Stuff you're talking about.
  - billyhoffman 7y ago
    https://moxie.org/software/sslstrip/ https://moxie.org/software/sslstrip/ The attitude of "it's cool, only use SSL for the sensitive parts" hasn't been true for a decade.
    - jasonkester 7y ago
      Again, that looks like it needs to be sitting somewhere between the end user and the webserver. I don't disagree that it is possible to mess with http traffic in flight if it's not encrypted. I do disagree that a) there are bad guys between me and the http://catpictures.com http://catpictures.com right now and b) They have targeted me with malicious cat pictures that will cause damage somehow. My sites that allow logins are all https only. My "cat picture" site is not. Because it doesn't need https.
      - prophesi 7y ago
        Can you give a reason for not using https in the age of LetsEncrypt? And yes, the point of MITM is that there has to be a malicious actor in the middle. This is mainly a threat when using public WiFi, like at an airport or a coffee shop. It's absolutely trivial for some bored individual to run SSLstrip for funsies and distribute malware through any HTTP connections. Also, an attacker doesn't need to somehow create malware-infested versions of the cat pictures on your site. They only need to append some javascript at the end of your site's body tag, which again, is trivial for a script to do. And maybe a transparent image with the malicious payload should they have JS disabled. To those wondering how they might protect themselves from these sorts of attacks when using non-SSL sites on public WiFi, this is where a VPN comes in handy. All of your connections will be encrypted and no longer vulnerable to MITM attacks.
        philsnow 7y ago
        I know you probably have a better understanding of how vpns work than I do, but the blanket statement that using a VPN makes your connections immune to MITM is not correct. True, an attacker needs to find some other link between the terminus of your VPN and the target site to MITM, and true, those links are orders of magnitude harder to compromise usually. But a VPN is not magic pixie dust that you sprinkle on your laptop and now you don't have to worry about security anymore.
        prophesi 7y ago
        Security is a battle with convenience. Sure, it's technically possible for someone to pull off a MITM attack on someone using a VPN; perhaps there's an attack vector before they establish their VPN connection, or they've compromised the server running the VPN service, etc. But that's probably only a threat to government agents and Snowden, whom have real fears of targeted attacks like that. For the layman, VPN pretty much is a magic pixie dust that will let you browse unencrypted websites with confidence that the pages won't be modified, and your form submissions won't be sniffable on your public network. Of course, it won't protect you from sites that already have malware on them.
      - 7y ago
  - alasdair_ 7y ago
    Have you ever used a public wifi connection? It’s not “your ISP” it’s any random stranger on the same network. If you really don’t believe this stuff happens, I’d suggest connecting to one of the many public wifi offerings in las vegas during Defcon.
mholt 7y ago
Doesn't matter, it needs HTTPS on the whole site. https://doesmysiteneedhttps.com https://doesmysiteneedhttps.com
- deleted 7y ago
  [deleted]

Why? Also there is https on the more sensitive parts of the site (login etc).

by Nux 7y ago

Why? Also there is https on the more sensitive parts of the site (login etc).

shawabawa3 7y ago

pretty meaningless when you can MITM the page and remove https from all the links

jasonkester 7y ago
Can you? Please demonstrate. This is one of the silliest arguments that comes up every time "SSL All The Things!" is discussed. The "you" in your story has to be both a Bad Guy and your ISP, and needs to come up with a way to sabotage a site that shows you cat pictures in such a way that it shows malicious cat pictures that somehow do anybody any harm. So yeah, please MITM this site for us real quick so we can see all the Bad Stuff you're talking about.
- billyhoffman 7y ago
  https://moxie.org/software/sslstrip/ https://moxie.org/software/sslstrip/ The attitude of "it's cool, only use SSL for the sensitive parts" hasn't been true for a decade.
  - jasonkester 7y ago
    Again, that looks like it needs to be sitting somewhere between the end user and the webserver. I don't disagree that it is possible to mess with http traffic in flight if it's not encrypted. I do disagree that a) there are bad guys between me and the http://catpictures.com http://catpictures.com right now and b) They have targeted me with malicious cat pictures that will cause damage somehow. My sites that allow logins are all https only. My "cat picture" site is not. Because it doesn't need https.
    - prophesi 7y ago
      Can you give a reason for not using https in the age of LetsEncrypt? And yes, the point of MITM is that there has to be a malicious actor in the middle. This is mainly a threat when using public WiFi, like at an airport or a coffee shop. It's absolutely trivial for some bored individual to run SSLstrip for funsies and distribute malware through any HTTP connections. Also, an attacker doesn't need to somehow create malware-infested versions of the cat pictures on your site. They only need to append some javascript at the end of your site's body tag, which again, is trivial for a script to do. And maybe a transparent image with the malicious payload should they have JS disabled. To those wondering how they might protect themselves from these sorts of attacks when using non-SSL sites on public WiFi, this is where a VPN comes in handy. All of your connections will be encrypted and no longer vulnerable to MITM attacks.
      - philsnow 7y ago
        I know you probably have a better understanding of how vpns work than I do, but the blanket statement that using a VPN makes your connections immune to MITM is not correct. True, an attacker needs to find some other link between the terminus of your VPN and the target site to MITM, and true, those links are orders of magnitude harder to compromise usually. But a VPN is not magic pixie dust that you sprinkle on your laptop and now you don't have to worry about security anymore.
        prophesi 7y ago
        Security is a battle with convenience. Sure, it's technically possible for someone to pull off a MITM attack on someone using a VPN; perhaps there's an attack vector before they establish their VPN connection, or they've compromised the server running the VPN service, etc. But that's probably only a threat to government agents and Snowden, whom have real fears of targeted attacks like that. For the layman, VPN pretty much is a magic pixie dust that will let you browse unencrypted websites with confidence that the pages won't be modified, and your form submissions won't be sniffable on your public network. Of course, it won't protect you from sites that already have malware on them.
    - 7y ago
- alasdair_ 7y ago
  Have you ever used a public wifi connection? It’s not “your ISP” it’s any random stranger on the same network. If you really don’t believe this stuff happens, I’d suggest connecting to one of the many public wifi offerings in las vegas during Defcon.

mholt 7y ago

Doesn't matter, it needs HTTPS on the whole site. https://doesmysiteneedhttps.com https://doesmysiteneedhttps.com

deleted 7y ago
[deleted]