4 ms·
> All he had to do was visit one website. Any website. The author directly contradicts the headline used here: > The website must use “clear text” which means
by shbooms 6y ago
> All he had to do was visit one website. Any website.
The author directly contradicts the headline used here:
> The website must use “clear text” which means the URL starts with “http” not “https.”
- notRobot 6y agoWelcome to tech journalism. This is how it almost always is.
- bb88 6y agoConsider the following: http://google.com http://google.com https://google.com https://google.com Both wind up eventually to the same place, but the first redirects to the second. That can be a link, it can be an old bookmark, etc. Worse if it was a targeted ad, the https:// https:// link could be just a redirect back to an http:// http:// link, something the browser probably has no trouble doing.
- dmurray 6y ago> the https:// https:// link could be just a redirect back to an http:// http:// link, something the browser probably has no trouble doing. Doesn't HSTS prevent exactly this? Sure, not every website implements it, but the most visited ones overwhelmingly do - it's certainly misleading to say "any website" in that context.
- VWWHFSfQ 6y agodoesn't the hsts header have to be delivered in cleartext the first time you visit the site with http? so your browser knows from then on it can only ever visit via https? the header can be removed in that initial cleartext request so it never gets set in your browser in the first place. I don't think HSTS works against highly targeted MITM attacks like this.
- strombofulous 6y agohsts lists ship with browsers. otherwise it'd be useless for the reason you described
- VWWHFSfQ 6y agobut that's not an exhaustive list of websites though. any website not in the list is vulnerable to this
- deleted 6y ago[deleted]
- netheril96 6y agobb88 raises a bad example. Not only is google protected by HSTS, but also most browsers ship with HSTS preload list that includes google. It is nearly impossible to perform downgrade attacks on google domains.
- heipei 6y agogoogle.com does not seem to return HSTS headers nor is it on the HSTS preload list in Chrome.
- gruez 6y ago>That can be a link, it can be an old bookmark, etc. Doesn't even have to be a link. If you type addresses like most be people do (ie. without https:// https://), the browser is going to attempt http first. So any manually typed in address will be vulnerable as well.
- dkonofalski 6y agoAt least in the current state of browsers, they all try https:// https:// first. That may not have been the case when the attack in question that's shown in the article was performed but every major browser now checks https:// https:// before http:// http://.
- gruez 6y ago>At least in the current state of browsers, they all try https:// https:// first. That's trivially disproven by typing "example.com" in the address bar and hitting enter. Both chrome and firefox goes to the http version not the https version, even though the https version is available. Even if that were true though, an attacker in a position to perform an MITM attack can also block the https connection from going through, forcing the browser to make a http connection.
- boring_twenties 6y agoWhy would anyone post something like this without even bothering to check if it's actually true, which takes less time than typing the comment itself?