4 ms·
Unfortunately, while HTTPS is very common, this isn't really the case with HSTS Preload, so active MitM attacks are still a threat.
by GlitchMr 7y ago
Unfortunately, while HTTPS is very common, this isn't really the case with HSTS Preload, so active MitM attacks are still a threat.
- IshKebab 7y agoI wrote a wifi hotspot app for Android that could MitM HTTPS requests as you suggest about 8 years ago. Even back then it didn't work very well because even without HSTS preload, most people aren't visiting new websites for the first time on your free public Wifi.
- moviuro 7y agoEven just HSTS is not widely deployed. Here in France for instance: * top 1 banking, top 18 FR https://www.ssllabs.com/ssltest/analyze.html?d=labanquepostale.fr&latest https://www.ssllabs.com/ssltest/analyze.html?d=labanqueposta... no HSTS * top 2 banking, top 20 FR https://www.ssllabs.com/ssltest/analyze.html?d=credit-agricole.fr https://www.ssllabs.com/ssltest/analyze.html?d=credit-agrico... no HSTS * top 1 taxes, top 30 FR https://www.ssllabs.com/ssltest/analyze.html?d=www.impots.gouv.fr https://www.ssllabs.com/ssltest/analyze.html?d=www.impots.go... with CAA, HSTS (not preload), OCSP Must-Staple! (that's a surprise) * top 3 banking, top 45 FR https://www.ssllabs.com/ssltest/analyze.html?d=caisse%2depargne.fr&latest https://www.ssllabs.com/ssltest/analyze.html?d=caisse%2depar... no HSTS Hopefuly, by 2030 banks will have caught up to the 2018 standard for "secure".
- Ajedi32 7y agoYep. Not only is HTTPS stripping still a problem, but active attackers can do all sorts of other nasty things as well, like force the user's browser to initiate plaintext HTTP requests to non-HSTS sites and then use that to steal cookies from third party domains, or achieve persistent XSS by poisoning the user's browser cache. See https://samy.pl/poisontap/ https://samy.pl/poisontap/ for a great example of that attack in action.
- skrebbel 7y agorefresh my understanding, if i manually type "https" into the address bar, then i can't be MitM'ed through lack of HSTS, right?
- detaro 7y agocorrect, assuming you don't let yourself get tricked into trying without https.
- JohnFen 7y agoWhich, if my experience pentesting is any indication, most people will.
- aksss 7y agoThis. The question of public WiFi often isn’t “can you keep your comms secure if you try”, but “will my average user who just wants stuff to work While traveling be better off on their own mobile hotspot or connecting to dodgy free WiFi?” Unquestionably, they’ll be better off avoiding public WiFi. Applications like Outlook will warn you about cert problems but still let you bypass them. This could be better on app side, but it’s a reality end users deal with. And when/if IT knows about it, it’s because the user complains that their laptop/Outlook is broken. The avg business user doesn't think about cert chains.
- rovr138 7y agoYou could be. If you are, you’ll get a message that the very isn’t valid. Unless there’s an attack on cert providers or someone adds a cert to your device. The cert approach can be seen in some corporate environments.
- eximius 7y agoSpecifically preload or HSTS? Because HSTS gets you most of the protection you need while being able to recover if something goes horribly wrong. Set your HSTS timeout to greater than the gap between user visits and it does prevent active MitM. You're only unprotected for first time visits being actively intercepted or particularly long gaps where HSTS can expire (both of which are hard targets).