3 ms·

So let's say your site is popular. What exactly is preventing a bad actor from MITM your site and spreading malware at a coffee shop or insert open public wifi

by tw04 5y ago

So let's say your site is popular. What exactly is preventing a bad actor from MITM your site and spreading malware at a coffee shop or insert open public wifi? HTTPS isn't just about securing the information, it ensures that when someone tries to get to your site, they ACTUALLY get to your site.

dvfjsdhgfv 5y ago
There are many assumptions here. Personally I don't even remember when I connected to an open wifi, I believe some systems will prevent you from doing so. In any case, using HTTPS is indeed helpful in a hostile network when combined with HSTS, but if you have already connected to a network controlled by an attacker, this means they can not only sniff all your traffic, but already control your DNS and can easily find multiple ways to deliver the payload to you.
- kelnos 5y ago
  > Personally I don't even remember when I connected to an open wifi, I believe some systems will prevent you from doing so. If that's the case, you are absolutely not the average internet user. Plenty of people, most of them non-technical, will connect to the wifi of their local cafe, and spend many tens of minutes doing things on the internet while connected to it.
merb 5y ago
you can publish a sha256 hash for every site/resource. (just kidding of course)
- randomhodler84 5y ago
  No kid, SRI : Sub Resource Integrity is exactly this and an important way to secure CDN hosted js you are using on your site, however if the channel itself has no integrity protection, like HTTP does not (but https does via TLS), an attacker can dynamically replace SRI values with their malicious equivalents. So, both?
  - merb 5y ago
    yeah that's why I said just kidding. basically you would need to host your sha hashes somewhere else, which is probably a little bit wierd. also sub resource integrity, only works with sub resources ;-) (and I think sub resource integrity is stupid, because the future is only useful for external resources, which you should trust?! I would never trust external resources)
- tialaramex 5y ago
  If the only things on your site are resources for other sites, you could actually make this work using a technology called Subresource Integrity where the hashes live in the link origin (and the browser verifies the content matches the hash on load). Unfortunately SRI is only deployed for CSS and Javascript (so your collection of JPEGs, or videos, or text snippets aren't eligible unless you somehow wrap them as a Javascript which is horrible) and most sites will themselves be HTTPS so they don't want to have active links (even with SRI) to non-HTTPS sites.

by tw04 5y ago

dvfjsdhgfv 5y ago

There are many assumptions here. Personally I don't even remember when I connected to an open wifi, I believe some systems will prevent you from doing so. In any case, using HTTPS is indeed helpful in a hostile network when combined with HSTS, but if you have already connected to a network controlled by an attacker, this means they can not only sniff all your traffic, but already control your DNS and can easily find multiple ways to deliver the payload to you.

kelnos 5y ago
> Personally I don't even remember when I connected to an open wifi, I believe some systems will prevent you from doing so. If that's the case, you are absolutely not the average internet user. Plenty of people, most of them non-technical, will connect to the wifi of their local cafe, and spend many tens of minutes doing things on the internet while connected to it.

merb 5y ago

you can publish a sha256 hash for every site/resource. (just kidding of course)

randomhodler84 5y ago
No kid, SRI : Sub Resource Integrity is exactly this and an important way to secure CDN hosted js you are using on your site, however if the channel itself has no integrity protection, like HTTP does not (but https does via TLS), an attacker can dynamically replace SRI values with their malicious equivalents. So, both?
- merb 5y ago
  yeah that's why I said just kidding. basically you would need to host your sha hashes somewhere else, which is probably a little bit wierd. also sub resource integrity, only works with sub resources ;-) (and I think sub resource integrity is stupid, because the future is only useful for external resources, which you should trust?! I would never trust external resources)
tialaramex 5y ago
If the only things on your site are resources for other sites, you could actually make this work using a technology called Subresource Integrity where the hashes live in the link origin (and the browser verifies the content matches the hash on load). Unfortunately SRI is only deployed for CSS and Javascript (so your collection of JPEGs, or videos, or text snippets aren't eligible unless you somehow wrap them as a Javascript which is horrible) and most sites will themselves be HTTPS so they don't want to have active links (even with SRI) to non-HTTPS sites.