4 ms·

One can argue there is no rational threat vector to access a static content via http instead of https. (At least with an ISP in America that won't inject things

One can argue there is no rational threat vector to access a static content via http instead of https. (At least with an ISP in America that won't inject things.)

oefrha 6y ago
Look up coffee shop WiFi MITM.
- Nextgrid 6y ago
  I'd be more concerned about advertising/marketing companies collecting data about unencrypted websites visited by users on their public Wi-Fi as opposed to rare malicious actors who are typically isolated to a single location.
  - oefrha 6y ago
    I’d rather be tracked everyday than be pwned once. Nevertheless, what I posted is just an example against the “no rational threat vector” reply.
- markstos 6y ago
  This happened to someone I know while they were traveling. Their (http:// http://) Wordpress site was taken over and filled with malware a few seconds later.
woodruffw 6y ago
Two of the three (four?) major American ISPs are known to inject JavaScript and custom headers into HTTP requests for tracking and analytic purposes: * https://www.privateinternetaccess.com/blog/comcast-still-uses-mitm-javascript-injection-serve-unwanted-ads-messages/ https://www.privateinternetaccess.com/blog/comcast-still-use... * https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh Edit: Spectrum has apparently used this technique as well[1]. That covers the vast majority of home Internet users in America. [1]: https://gist.github.com/jzebedee/7c5000779cd131df2498a3e6d041991c https://gist.github.com/jzebedee/7c5000779cd131df2498a3e6d04...
- deleted 6y ago
  [deleted]
JoshTriplett 6y ago
How much do you trust the "static content"? Are you going to trust another site more because of a link there? What about all the scripts and static content loaded by that site, or that that site could be made to load by tampering with its contents? Could that site be made to attack other sites using your browser (see https://en.wikipedia.org/wiki/Great_Cannon https://en.wikipedia.org/wiki/Great_Cannon )? Could anyone learn something about you because of the site, or what pages you access and links you follow from the site? Could someone learn what https site you're likely to access, by knowing the http site you accessed, making traffic analysis easier? MITM tampering might not just be from an ISP. It could be from public wifi, or from an exploited/infected router, or with some care perhaps from another person on the same network/wifi, or from an office, or from an entire country.
pessimizer 6y ago
Maybe by declaring that your ISP knowing which page you visited within a domain cannot be a threat. Not all threats are threats of impersonation.
Sayrus 6y ago
Reminds me of a Troy Hunt article [1] that was on HN years ago. [1] https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs...
- sbmthakur 6y ago
  This was the article that convinced me to be HTTPS everywhere (well maybe in 99.99% cases if not everywhere). The linked video is a must watch to those who still doubt HTTPS[0]. The mention of China's Great Cannon was particularly eye-opening[1]. 0. https://youtu.be/_BNIkw4Ao9w https://youtu.be/_BNIkw4Ao9w 1. https://citizenlab.ca/2015/04/chinas-great-cannon/ https://citizenlab.ca/2015/04/chinas-great-cannon/
thefreeman 6y ago
This is patently false. You do realize someone in a position to modify your traffic can turn easily insert javascript into your static content right?
- samaxe 6y ago
 Jokes on them, JavaScript won’t do shit if your target audience is not using a browser to render content. I got a site that renders in a terminal, much like wttr.in, ifconfig.co, etc.
 - quickthrower2 6y ago
 You sound like this guy: http://n-gate.com/software/2017/07/12/0/ http://n-gate.com/software/2017/07/12/0/ (copy paste URL as the owner doesn’t allow HN as a referrer!)
 - zzo38computer 6y ago
 Some of the points are good, and some otherwise. (I enable referrer spoofing in my browser, so following the link from here works fine) I think "Users must keep themselves safe" is good. (Software can help at that, but it should not do so by forcing stuff onto the user; it should do so by giving the user control over it; with enough ropes to hang yourself and also a few more just in case, and documentation should be included so that the user can know how to work the software properly rather than wrongly.) The text they quote says "The only reason you should open port 80 on your server is to redirect all requests to port 443 and then close the connection on port 80." and that is wrong. You can serve the same stuff on both; no need to redirect either one to the other. (HSTS isn't so good either, mainly due to the "no user recourse" feature, and some of its other features; if it was limited to denoting that all content is available over HTTPS, then it would be acceptable.) Of course, you can also serve Gopher and whatever other services you might want; you need not be limited to HTTP and HTTPS. I did not know about "TLS 1.3 and HTTP/2 have padding frames to inflate the size of the ciphertext.", but it is good that TLS supports such a feature, whether HTTPS or any other protocol that uses TLS. (In the case of HTTPS, even if it didn't do that, you could perhaps add a "X-Padding" header to include worthless data, but other protocols that use TLS might not do that.) If you don't need JavaScripts on your webpages (and in most cases you shouldn't), you might write something like document.write("Please disable JavaScript for an improved experience") to notify the user; this can be done whether the connection is secure or not. If the connection is secure that only means that third parties aren't tampering with it, not that the author of the webpage isn't malicious! I often just serve plain text files anyways, rather than HTML (you can use it without needing to load the web browser). It uses HTML for directory listings; I designed another format for HTTP directory listings but I don't know how to make Apache to serve directory listings in my format based on the contents of the Accept header (or at all, actually). I have Gopher as well as HTTP service, and also NNTP and some others too.
seanwilson 6y ago
Can you explain why you think this? It's common for people to say https is only for shops or site with logins, but if you can modify an http only site that might normally only show plain text articles, you can make it show fake payments, fake logins and malware downloads to steal data.

One can argue there is no rational threat vector to access a static content via http instead of https. (At least with an ISP in America that won't inject things.)

oefrha 6y ago

Look up coffee shop WiFi MITM.

Nextgrid 6y ago
I'd be more concerned about advertising/marketing companies collecting data about unencrypted websites visited by users on their public Wi-Fi as opposed to rare malicious actors who are typically isolated to a single location.
- oefrha 6y ago
  I’d rather be tracked everyday than be pwned once. Nevertheless, what I posted is just an example against the “no rational threat vector” reply.
markstos 6y ago
This happened to someone I know while they were traveling. Their (http:// http://) Wordpress site was taken over and filled with malware a few seconds later.

woodruffw 6y ago

Two of the three (four?) major American ISPs are known to inject JavaScript and custom headers into HTTP requests for tracking and analytic purposes: * https://www.privateinternetaccess.com/blog/comcast-still-uses-mitm-javascript-injection-serve-unwanted-ads-messages/ https://www.privateinternetaccess.com/blog/comcast-still-use... * https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh Edit: Spectrum has apparently used this technique as well[1]. That covers the vast majority of home Internet users in America. [1]: https://gist.github.com/jzebedee/7c5000779cd131df2498a3e6d041991c https://gist.github.com/jzebedee/7c5000779cd131df2498a3e6d04...

deleted 6y ago
[deleted]

JoshTriplett 6y ago

How much do you trust the "static content"? Are you going to trust another site more because of a link there? What about all the scripts and static content loaded by that site, or that that site could be made to load by tampering with its contents? Could that site be made to attack other sites using your browser (see https://en.wikipedia.org/wiki/Great_Cannon https://en.wikipedia.org/wiki/Great_Cannon )? Could anyone learn something about you because of the site, or what pages you access and links you follow from the site? Could someone learn what https site you're likely to access, by knowing the http site you accessed, making traffic analysis easier? MITM tampering might not just be from an ISP. It could be from public wifi, or from an exploited/infected router, or with some care perhaps from another person on the same network/wifi, or from an office, or from an entire country.

pessimizer 6y ago

Maybe by declaring that your ISP knowing which page you visited within a domain cannot be a threat. Not all threats are threats of impersonation.

Sayrus 6y ago

Reminds me of a Troy Hunt article [1] that was on HN years ago. [1] https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs...

sbmthakur 6y ago
This was the article that convinced me to be HTTPS everywhere (well maybe in 99.99% cases if not everywhere). The linked video is a must watch to those who still doubt HTTPS[0]. The mention of China's Great Cannon was particularly eye-opening[1]. 0. https://youtu.be/_BNIkw4Ao9w https://youtu.be/_BNIkw4Ao9w 1. https://citizenlab.ca/2015/04/chinas-great-cannon/ https://citizenlab.ca/2015/04/chinas-great-cannon/

thefreeman 6y ago

This is patently false. You do realize someone in a position to modify your traffic can turn easily insert javascript into your static content right?

samaxe 6y ago
Jokes on them, JavaScript won’t do shit if your target audience is not using a browser to render content. I got a site that renders in a terminal, much like wttr.in, ifconfig.co, etc.
- quickthrower2 6y ago
 You sound like this guy: http://n-gate.com/software/2017/07/12/0/ http://n-gate.com/software/2017/07/12/0/ (copy paste URL as the owner doesn’t allow HN as a referrer!)
 - zzo38computer 6y ago
 Some of the points are good, and some otherwise. (I enable referrer spoofing in my browser, so following the link from here works fine) I think "Users must keep themselves safe" is good. (Software can help at that, but it should not do so by forcing stuff onto the user; it should do so by giving the user control over it; with enough ropes to hang yourself and also a few more just in case, and documentation should be included so that the user can know how to work the software properly rather than wrongly.) The text they quote says "The only reason you should open port 80 on your server is to redirect all requests to port 443 and then close the connection on port 80." and that is wrong. You can serve the same stuff on both; no need to redirect either one to the other. (HSTS isn't so good either, mainly due to the "no user recourse" feature, and some of its other features; if it was limited to denoting that all content is available over HTTPS, then it would be acceptable.) Of course, you can also serve Gopher and whatever other services you might want; you need not be limited to HTTP and HTTPS. I did not know about "TLS 1.3 and HTTP/2 have padding frames to inflate the size of the ciphertext.", but it is good that TLS supports such a feature, whether HTTPS or any other protocol that uses TLS. (In the case of HTTPS, even if it didn't do that, you could perhaps add a "X-Padding" header to include worthless data, but other protocols that use TLS might not do that.) If you don't need JavaScripts on your webpages (and in most cases you shouldn't), you might write something like document.write("Please disable JavaScript for an improved experience") to notify the user; this can be done whether the connection is secure or not. If the connection is secure that only means that third parties aren't tampering with it, not that the author of the webpage isn't malicious! I often just serve plain text files anyways, rather than HTML (you can use it without needing to load the web browser). It uses HTML for directory listings; I designed another format for HTTP directory listings but I don't know how to make Apache to serve directory listings in my format based on the contents of the Accept header (or at all, actually). I have Gopher as well as HTTP service, and also NNTP and some others too.

seanwilson 6y ago

Can you explain why you think this? It's common for people to say https is only for shops or site with logins, but if you can modify an http only site that might normally only show plain text articles, you can make it show fake payments, fake logins and malware downloads to steal data.