4 ms·

Seriously, no https in 2021? For a website dedicated to security?

by derekzhouzhen 5y ago

jazzyjackson 5y ago
what attack vector are you worried about? CIA man-in-the-middling a zine to make the articles less entertaining?
- yodelshady 5y ago
  Fair point, but then, why bother with the PGP key?
  - sodality2 5y ago
    Content isn't private the way email is.
- mindless_solips 5y ago
  Thank you for this. The Love of Complexity is Real in this field. While I encourage and support the goals of anonymity and security everywhere, everything has its design envelope. This is an e-zine of public content. Sure, "SoMeOnE cOuLd InTeRcEpT", but why bother? Even with encrypted sockets, logs would still show your IP going to the site. What information are we trying to protect or malicious activity are we trying to stop by using SSL? ... And is it worth the unfortunate webmasters having to deal with bullshit like LetsEncrypt's root certificate expiration and all the main of keystores and PKI management so random "Very Serious People on the Internet" can say "ah, they follow The Standard on security." Controversial statement in 2021, I'm sure, but I think a use case for simple HTML over HTTP websites still exists. Your personal page with pictures of cats and your resume probably doesn't need to be some bastion of cybersecurity.
  - frankjr 5y ago
    There are ISPs that will happily inject ads and tracking codes into pages you visit. This obviously doesn't work over HTTPS. https://security.stackexchange.com/questions/157828/my-isp-bsnl-india-is-injecting-ads-using-phozeca-which-spoils-websites-and-mak https://security.stackexchange.com/questions/157828/my-isp-b... https://superuser.com/questions/902635/isp-is-inserting-ads-into-web-pages https://superuser.com/questions/902635/isp-is-inserting-ads-... https://old.reddit.com/r/india/comments/8ry1k4/does_your_isp_inject_malware_ads_in_the_websites/ https://old.reddit.com/r/india/comments/8ry1k4/does_your_isp...
    - jart 5y ago
      Even with HTTPS ad injection is still very common and it's not just happening in India. Even laptops sold here in America by big reputable brands have been known to preinstall things like layered service providers that proxy deciphered ssl communications through a server in a foreign country that injects ads. https://ag.nv.gov/uploadedfiles/agnvgov/Content/News/PR/PR_Docs/2017/2017-09-05_Lenovo_Complaint.pdf https://ag.nv.gov/uploadedfiles/agnvgov/Content/News/PR/PR_D...
      - mindless_solips 5y ago
        What an incredible link and story I hadn't heard of at all. Reading that Lenovo literally knowingly installed self-signed certs on their laptops to send encrypted traffic to ad bots is one of the more horrifying device manufacturer findings I've ever seen.
    - xorcist 5y ago
      Of course it does. You just have to install their certificate. Whole countries engage in this.
      - frankjr 5y ago
        I mean, if you go out of your way to bork the system then yeah, I suppose it does.
- derekzhouzhen 5y ago
  For the peace of mind of the readers, if nothing else. Firefox has a https only mode: https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/ https://blog.mozilla.org/security/2020/11/17/firefox-83-intr...
- handrous 5y ago
  Someone might MitM the hacking 'zine's site to display a Google login prompt, and the user will obviously trust an apropos-nothing Google login prompt on a hacking 'zine's site, and so have their Google credentials stolen. /s
  - jazzyjackson 5y ago
    Well, points for coming up with something I hadn't thought of. Makes me grateful for my password manager filling things in based on domain. EDIT oh shit, just revealed I use a password manager, please fire me if I ever reveal which one.
coretx 5y ago
Https creates a false sense of security as even the Chinese communist party is a certificate authority and various nation states are already caught abusing their privileges. Complementary, not using https also speeds things up and burns less fossil fuel.
chedabob 5y ago
Ye was hoping to use that to get around our Sonicwall appliance blocking it for "Radicalization and Extremism"
- alasdair_ 5y ago
  If only there was a zine that taught hacking techniques to bypass firewalls...

Seriously, no https in 2021? For a website dedicated to security?

jazzyjackson 5y ago

what attack vector are you worried about? CIA man-in-the-middling a zine to make the articles less entertaining?

yodelshady 5y ago
Fair point, but then, why bother with the PGP key?
- sodality2 5y ago
  Content isn't private the way email is.
mindless_solips 5y ago
Thank you for this. The Love of Complexity is Real in this field. While I encourage and support the goals of anonymity and security everywhere, everything has its design envelope. This is an e-zine of public content. Sure, "SoMeOnE cOuLd InTeRcEpT", but why bother? Even with encrypted sockets, logs would still show your IP going to the site. What information are we trying to protect or malicious activity are we trying to stop by using SSL? ... And is it worth the unfortunate webmasters having to deal with bullshit like LetsEncrypt's root certificate expiration and all the main of keystores and PKI management so random "Very Serious People on the Internet" can say "ah, they follow The Standard on security." Controversial statement in 2021, I'm sure, but I think a use case for simple HTML over HTTP websites still exists. Your personal page with pictures of cats and your resume probably doesn't need to be some bastion of cybersecurity.
- frankjr 5y ago
  There are ISPs that will happily inject ads and tracking codes into pages you visit. This obviously doesn't work over HTTPS. https://security.stackexchange.com/questions/157828/my-isp-bsnl-india-is-injecting-ads-using-phozeca-which-spoils-websites-and-mak https://security.stackexchange.com/questions/157828/my-isp-b... https://superuser.com/questions/902635/isp-is-inserting-ads-into-web-pages https://superuser.com/questions/902635/isp-is-inserting-ads-... https://old.reddit.com/r/india/comments/8ry1k4/does_your_isp_inject_malware_ads_in_the_websites/ https://old.reddit.com/r/india/comments/8ry1k4/does_your_isp...
  - jart 5y ago
    Even with HTTPS ad injection is still very common and it's not just happening in India. Even laptops sold here in America by big reputable brands have been known to preinstall things like layered service providers that proxy deciphered ssl communications through a server in a foreign country that injects ads. https://ag.nv.gov/uploadedfiles/agnvgov/Content/News/PR/PR_Docs/2017/2017-09-05_Lenovo_Complaint.pdf https://ag.nv.gov/uploadedfiles/agnvgov/Content/News/PR/PR_D...
    - mindless_solips 5y ago
      What an incredible link and story I hadn't heard of at all. Reading that Lenovo literally knowingly installed self-signed certs on their laptops to send encrypted traffic to ad bots is one of the more horrifying device manufacturer findings I've ever seen.
  - xorcist 5y ago
    Of course it does. You just have to install their certificate. Whole countries engage in this.
    - frankjr 5y ago
      I mean, if you go out of your way to bork the system then yeah, I suppose it does.
derekzhouzhen 5y ago
For the peace of mind of the readers, if nothing else. Firefox has a https only mode: https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/ https://blog.mozilla.org/security/2020/11/17/firefox-83-intr...
handrous 5y ago
Someone might MitM the hacking 'zine's site to display a Google login prompt, and the user will obviously trust an apropos-nothing Google login prompt on a hacking 'zine's site, and so have their Google credentials stolen. /s
- jazzyjackson 5y ago
  Well, points for coming up with something I hadn't thought of. Makes me grateful for my password manager filling things in based on domain. EDIT oh shit, just revealed I use a password manager, please fire me if I ever reveal which one.

coretx 5y ago

Https creates a false sense of security as even the Chinese communist party is a certificate authority and various nation states are already caught abusing their privileges. Complementary, not using https also speeds things up and burns less fossil fuel.

chedabob 5y ago

Ye was hoping to use that to get around our Sonicwall appliance blocking it for "Radicalization and Extremism"

alasdair_ 5y ago
If only there was a zine that taught hacking techniques to bypass firewalls...