4 ms·
The ways in which MITM attacks are dangerous are not limited to sites running JavaScript. The big one is that MITM can change what you see on sites. I should be
by jefftk 4y ago
The ways in which MITM attacks are dangerous are not limited to sites running JavaScript. The big one is that MITM can change what you see on sites. I should be able to trust that everything I read on superkuh.com is your writing, but today anyone operating a network node between my browser and your server can make arbitrary edits to your work.
- superkuh 4y agoI agree. But this doesn't matter for the vast majority of websites (ie, non-commercial, non-institutional, personal websites). You can change it so it says or shows whatever and it's not going to hurt anyone. Just like requiring everyone to wear a level 3 bullet proof vest while making dinner will make the process safer, so will requiring CA based certs. And in this particular exact scenario, you can use my .onion site for superkuh.com to verify the end-point identity if you're really worried that someone might change the text. A system that works without CAs.
- afiori 4y agoIt matters if you have concerns about the experience users have on your site. Among other things a MitM can: - insert ads in your page - run miners on your user's browser - change links or redirect the page (likely to an CA-signed malware site) - insert malware in downloadable scripts on your site (http://superkuh.com/TkTTS.pl http://superkuh.com/TkTTS.pl)