4 ms·

Any man in the middle might inject JavaScript in the request and hijack the user's browser.

at_a_remove 6y ago
And if our users had ever mentioned this happening once, ever, in decades, it might be important. I've never seen it happen when I used it from home, I've never heard of it happening. It's a nobody cares situation. Now, I have had to defend university servers from quite a lot of things, in a large variety of situations. But this? This has never shown up as an issue.
- deleted 6y ago
  [deleted]
- cycloptic 6y ago
  Can you say, with confidence, that it will never happen in the future? And if so, how much of your own money are you willing to put down on that? Would you stake your job/career on that claim that it won't happen in the future?
  - josteink 6y ago
    I’m not OP, but I’m willing to claim that there are going to be at least an order of magnitude more reported security vulnerabilities due to overly complex crypto-stacks than there are going to be reported successful internet-scale MITM-attacks. For many things crypto itself is going to be a bigger security-risk than what it’s defending against.
    - cycloptic 6y ago
      So, you will be betting your career/job on that assertion? And your money as well? Following that, there must be a crypto-averse bank you're using to deposit your paychecks, right? And if so, can I have the URL to their public and unencrypted site?
    - GrinningFool 6y ago
      > at least an order of magnitude more reported security vulnerabilities due to overly complex crypto-stacks than there are going to be reported successful internet-scale MITM-attacks. On the other hand, the overly-complex crypto stacks might be the thing preventing most internet-scale MITM-attacks from being successful.
    - vbrandl 6y ago
      Many bugs in "overly complex crypto-stacks" are more like "complexity to decrypt was reduced by X%". If it took a regular attacker 1,000,000 years to crack the encryption, it now takes only 900,000 years. So if you are not up against some state sponsored actors, these bugs in crypto stacks should be of no concern. The impact of these bugs is, instead of "nobody can read this data" now "only 10 people on this planet can read the data". That's still better than "anybody can read the data". And sure there are other kinds of bugs like downgrade attacks but even if an attacker can downgrade you to use RC4 and decrypt data in real time, you are now in the same situation as you were when not using crypto at all. Not even that: to be in the same situation as with no crypto at all, the attacker would need to downgrade/break encryption and signing because breaking only one of both would still not allow modifying the data stream. Bugs in crypto stacks that allow code execution or memory reads/writes on the server or client are rather rare.
- kerkeslager 6y ago
  What you are looking up in the library catalog is absolutely of interest to the surveillance state. Are you okay with anyone who looks the Autobiography of Malcolm X being added to a watchlist? And incidentally, if your ISP decided to collect that information and share it with the government, they could collect that information with a MitM attack that would give you absolutely no indication that a MitM attack, so your assertion that "this has never shown up as an issue" doesn't hold much weight.
- josteink 6y ago
  > And if our users had ever mentioned this happening once, ever, in decades, it might be important. > I've never seen it happen when I used it from home, I've never heard of it happening. It's a nobody cares situation. It’s literally asking everyone to have an anti-nuclear defence-system at home. Utterly pointless and a waste of effort.
- vbrandl 6y ago
  Shouldn't the fact that there are exploitation frameworks for that specific attack vector (e.g. https://beefproject.com/ https://beefproject.com/) be motivation enough to not leave that vector unpatched?

And if our users had ever mentioned this happening once, ever, in decades, it might be important. I've never seen it happen when I used it from home, I've never heard of it happening. It's a nobody cares situation. Now, I have had to defend university servers from quite a lot of things, in a large variety of situations. But this? This has never shown up as an issue.

deleted 6y ago
[deleted]
cycloptic 6y ago
Can you say, with confidence, that it will never happen in the future? And if so, how much of your own money are you willing to put down on that? Would you stake your job/career on that claim that it won't happen in the future?
- josteink 6y ago
  I’m not OP, but I’m willing to claim that there are going to be at least an order of magnitude more reported security vulnerabilities due to overly complex crypto-stacks than there are going to be reported successful internet-scale MITM-attacks. For many things crypto itself is going to be a bigger security-risk than what it’s defending against.
  - cycloptic 6y ago
    So, you will be betting your career/job on that assertion? And your money as well? Following that, there must be a crypto-averse bank you're using to deposit your paychecks, right? And if so, can I have the URL to their public and unencrypted site?
  - GrinningFool 6y ago
    > at least an order of magnitude more reported security vulnerabilities due to overly complex crypto-stacks than there are going to be reported successful internet-scale MITM-attacks. On the other hand, the overly-complex crypto stacks might be the thing preventing most internet-scale MITM-attacks from being successful.
  - vbrandl 6y ago
    Many bugs in "overly complex crypto-stacks" are more like "complexity to decrypt was reduced by X%". If it took a regular attacker 1,000,000 years to crack the encryption, it now takes only 900,000 years. So if you are not up against some state sponsored actors, these bugs in crypto stacks should be of no concern. The impact of these bugs is, instead of "nobody can read this data" now "only 10 people on this planet can read the data". That's still better than "anybody can read the data". And sure there are other kinds of bugs like downgrade attacks but even if an attacker can downgrade you to use RC4 and decrypt data in real time, you are now in the same situation as you were when not using crypto at all. Not even that: to be in the same situation as with no crypto at all, the attacker would need to downgrade/break encryption and signing because breaking only one of both would still not allow modifying the data stream. Bugs in crypto stacks that allow code execution or memory reads/writes on the server or client are rather rare.
kerkeslager 6y ago
What you are looking up in the library catalog is absolutely of interest to the surveillance state. Are you okay with anyone who looks the Autobiography of Malcolm X being added to a watchlist? And incidentally, if your ISP decided to collect that information and share it with the government, they could collect that information with a MitM attack that would give you absolutely no indication that a MitM attack, so your assertion that "this has never shown up as an issue" doesn't hold much weight.
josteink 6y ago
> And if our users had ever mentioned this happening once, ever, in decades, it might be important. > I've never seen it happen when I used it from home, I've never heard of it happening. It's a nobody cares situation. It’s literally asking everyone to have an anti-nuclear defence-system at home. Utterly pointless and a waste of effort.
vbrandl 6y ago
Shouldn't the fact that there are exploitation frameworks for that specific attack vector (e.g. https://beefproject.com/ https://beefproject.com/) be motivation enough to not leave that vector unpatched?