4 ms·

Can you give a reason for not using https in the age of LetsEncrypt? And yes, the point of MITM is that there has to be a malicious actor in the middle. This i

Can you give a reason for not using https in the age of LetsEncrypt? And yes, the point of MITM is that there has to be a malicious actor in the middle. This is mainly a threat when using public WiFi, like at an airport or a coffee shop. It's absolutely trivial for some bored individual to run SSLstrip for funsies and distribute malware through any HTTP connections. Also, an attacker doesn't need to somehow create malware-infested versions of the cat pictures on your site. They only need to append some javascript at the end of your site's body tag, which again, is trivial for a script to do. And maybe a transparent image with the malicious payload should they have JS disabled. To those wondering how they might protect themselves from these sorts of attacks when using non-SSL sites on public WiFi, this is where a VPN comes in handy. All of your connections will be encrypted and no longer vulnerable to MITM attacks.

philsnow 8y ago
I know you probably have a better understanding of how vpns work than I do, but the blanket statement that using a VPN makes your connections immune to MITM is not correct. True, an attacker needs to find some other link between the terminus of your VPN and the target site to MITM, and true, those links are orders of magnitude harder to compromise usually. But a VPN is not magic pixie dust that you sprinkle on your laptop and now you don't have to worry about security anymore.
- prophesi 8y ago
  Security is a battle with convenience. Sure, it's technically possible for someone to pull off a MITM attack on someone using a VPN; perhaps there's an attack vector before they establish their VPN connection, or they've compromised the server running the VPN service, etc. But that's probably only a threat to government agents and Snowden, whom have real fears of targeted attacks like that. For the layman, VPN pretty much is a magic pixie dust that will let you browse unencrypted websites with confidence that the pages won't be modified, and your form submissions won't be sniffable on your public network. Of course, it won't protect you from sites that already have malware on them.

philsnow 8y ago

I know you probably have a better understanding of how vpns work than I do, but the blanket statement that using a VPN makes your connections immune to MITM is not correct. True, an attacker needs to find some other link between the terminus of your VPN and the target site to MITM, and true, those links are orders of magnitude harder to compromise usually. But a VPN is not magic pixie dust that you sprinkle on your laptop and now you don't have to worry about security anymore.

prophesi 8y ago
Security is a battle with convenience. Sure, it's technically possible for someone to pull off a MITM attack on someone using a VPN; perhaps there's an attack vector before they establish their VPN connection, or they've compromised the server running the VPN service, etc. But that's probably only a threat to government agents and Snowden, whom have real fears of targeted attacks like that. For the layman, VPN pretty much is a magic pixie dust that will let you browse unencrypted websites with confidence that the pages won't be modified, and your form submissions won't be sniffable on your public network. Of course, it won't protect you from sites that already have malware on them.