3 ms·
So in a nutshell, could we summarise the issue here as "Valve didn't use TLS and thus Valve's users are vulnerable to the exceptionally well-known consequences
by gnfargbl 7y ago
So in a nutshell, could we summarise the issue here as "Valve didn't use TLS and thus Valve's users are vulnerable to the exceptionally well-known consequences of not using TLS?"
If so, then... okay, but I don't know what the blog author was expecting when he reported this. Pointing out that HTTP has MiTM possibilities is kind of up there with pointing out that the sky is blue. If, in 2020, a site has made the choice not to upgrade to TLS then it's more likely a conscious decision than an oversight.
- deleted 7y ago[deleted]
- minitech 7y agoIt was an oversight. They had HTTPS support. Going by the bug report, the client checked for a redirect to HTTPS, but didn’t check that it was to the correct domain.
- gnfargbl 7y agoOK, that's a little more understandable. I assume that the initial use of HTTP is an intentional tactic that Steam uses to discover whether it is behind a captive portal or similar. That being the case then yes, the Steam client shouldn't rely on the data returned from the HTTP request, and this seems like a bug.
- karagenit 7y agoThe author stated that Valve ended up patching this and switching to fully-HTTPS, which makes me think that this was a bug and not intentional.