3 ms·

i do not understand what is the drama about 100% https adoption? if i am watching videos or reading comics or reading recipes or surfing old books and stuff, wh

i do not understand what is the drama about 100% https adoption? if i am watching videos or reading comics or reading recipes or surfing old books and stuff, why the hell should i be concerned about "privacy" and "mitm" and "end to end" ? i would be personally happy if my payments are secure enough that i pay and the seller should acknowledge payment received. thats it. thats the whole "security" i want from the internet. Now, if there is someone who wants to impersonate my news website and supply me a falsified news article about harmless kittens, maybe i should be concerned about why i am being a target instead of protecting that i be able to securely read my harmless kittens news article?

daveoc64 5y ago
People often don't think about the transition from a "public" page to a "private" page. Take Hacker News for example. If you go to the home page without logging in, you'll see a list of posts. Does this need HTTPS? Using your logic, it wouldn't. But there's a login link in the top right corner of the page. If someone were to MITM the home page, they could make this login link go elsewhere, and harvest data. The same is true of any site which has links to login/signup/payments/contact forms etc. That describes virtually every site these days. It's much easier to have every part of the site on HTTPS, than to have to worry about this. Plus you avoid the possibility of malicious ads, scripts, and malware being injected into the page.
- 2Gkashmiri 5y ago
  agreed for the most part. does this MITM happen on the local network level or between the ISP and device or upstream level? genuinely interested in figuring this out
PeterisP 5y ago
Random examples of attacks through a non-https site with kitten articles (assuming an attacker on a shared wifi doing MITM). 1. inject javascript on the kitten site that, in case if you move on to a different tab for five minutes, redirect the page to a spoofed version of the login page of your payment provider or email account usable to recover other credentials, so that if you go back to that tab you might think that your session there just expired and "re-login". 2. inject javascript on the kitten site that replaces any legitimate links to social media platforms with links to spoofed login pages for these platforms. 3. inject javascript on the kitten site that adds an overlay over the kitten videos where clicking on it prompts you to download video_player_plugin_totally_legit.exe in order to watch the kitten videos. 4. inject javascript that replaces any ads (or just adds them) with attacker-controlled ones; possibly for some targeted scams. 5. inject javascript that runs cryptomining in the background. The attacker earns some pennies, but your computer temperature and battery life starts to suck. 6. perhaps they get to inject a javascript sandbox escape - those are rare and not actively exploited at the moment but if your browser isn't up to date for some reason, then sooner or later another exploitable vulnerability will appear again in the wild. In short, any http-only site is effectively potentially fully attacker-controlled for malware delivery, as much as websites can be used for malware delivery.
- a1369209993 5y ago
  > Random examples of attacks through a non-https site with kitten articles None of those attacks work unless you whitelist the site to run javascript, and if you are dumb enough to do that, those are all attacks you should be worried about the site itself deploying even if it is on https.
- 2Gkashmiri 5y ago
  would ublock origin help in this case? not talking about noscript
  - PeterisP 5y ago
    As far as I understand, ublock origin is based on blocking specific things, so anything previously unseen (e.g. custom malware) would be left untouched by it.

daveoc64 5y ago

People often don't think about the transition from a "public" page to a "private" page. Take Hacker News for example. If you go to the home page without logging in, you'll see a list of posts. Does this need HTTPS? Using your logic, it wouldn't. But there's a login link in the top right corner of the page. If someone were to MITM the home page, they could make this login link go elsewhere, and harvest data. The same is true of any site which has links to login/signup/payments/contact forms etc. That describes virtually every site these days. It's much easier to have every part of the site on HTTPS, than to have to worry about this. Plus you avoid the possibility of malicious ads, scripts, and malware being injected into the page.

2Gkashmiri 5y ago
agreed for the most part. does this MITM happen on the local network level or between the ISP and device or upstream level? genuinely interested in figuring this out

PeterisP 5y ago

Random examples of attacks through a non-https site with kitten articles (assuming an attacker on a shared wifi doing MITM). 1. inject javascript on the kitten site that, in case if you move on to a different tab for five minutes, redirect the page to a spoofed version of the login page of your payment provider or email account usable to recover other credentials, so that if you go back to that tab you might think that your session there just expired and "re-login". 2. inject javascript on the kitten site that replaces any legitimate links to social media platforms with links to spoofed login pages for these platforms. 3. inject javascript on the kitten site that adds an overlay over the kitten videos where clicking on it prompts you to download video_player_plugin_totally_legit.exe in order to watch the kitten videos. 4. inject javascript that replaces any ads (or just adds them) with attacker-controlled ones; possibly for some targeted scams. 5. inject javascript that runs cryptomining in the background. The attacker earns some pennies, but your computer temperature and battery life starts to suck. 6. perhaps they get to inject a javascript sandbox escape - those are rare and not actively exploited at the moment but if your browser isn't up to date for some reason, then sooner or later another exploitable vulnerability will appear again in the wild. In short, any http-only site is effectively potentially fully attacker-controlled for malware delivery, as much as websites can be used for malware delivery.

a1369209993 5y ago
> Random examples of attacks through a non-https site with kitten articles None of those attacks work unless you whitelist the site to run javascript, and if you are dumb enough to do that, those are all attacks you should be worried about the site itself deploying even if it is on https.
2Gkashmiri 5y ago
would ublock origin help in this case? not talking about noscript
- PeterisP 5y ago
  As far as I understand, ublock origin is based on blocking specific things, so anything previously unseen (e.g. custom malware) would be left untouched by it.