5 ms·
http is still susceptible to man in the middle attacks even if the site contains no secrets. You have no guarantee that the contents of the website haven't been
by xmprt 4y ago
http is still susceptible to man in the middle attacks even if the site contains no secrets. You have no guarantee that the contents of the website haven't been tampered with (not that attackers would have much incentive to tamper with a blog).
- cinntaile 4y agoThat's pretty much my point, there is no reason to meddle with the contents here. It's different if you live in a country where your ISP automatically MiTMs you (as a sibling comment to yours pointed out), but that's not a thing here at least. If you know that's a threat and it bothers you, you would likely already have measures in place anyway? But I admit it's a valid reason to have https.
- xmprt 4y ago> but that's not a thing here at least Hackernews is a global website last time I checked so even if you don't face issues like that, many other users might.
- cinntaile 4y agoYou could have just cited the entire sentence, then my answer could be your answer to my answer. lol Not sure why you're talking about HN though, the website in question was not HN.
- nl 4y ago> but that's not a thing here at least By using http you are assuming your "here" (where ever that is) is the same as where your readers are. And if your "here" is in the US then hotel WiFi providers in the US are well known to have done MiTM to insert ads.
- quickthrower2 4y agoThe attacker might just wholesale inject malicious script into every http response it sees.