3 ms·

What practical difference does it make if I connect to an Australian weather forecast site via HTTP or HTTPS? Is the NZ secret police gonna MITM a rain forecast

What practical difference does it make if I connect to an Australian weather forecast site via HTTP or HTTPS? Is the NZ secret police gonna MITM a rain forecast my way when it's actually gonna be a very sunny day?

geek_at 3y ago
It's just dangerous because any party on the way between wifi and the server can edit the content See: why are free proxies free https://blog.haschek.at/2013/05/why-free-proxies-are-free-js-infection.html https://blog.haschek.at/2013/05/why-free-proxies-are-free-js...
- defrost 3y ago
  In the same way as walking to the bank is dangerous because any party on the way can rob you on the way? I regularly visit: www.bom.gov.au/<mystate>/forecasts/<mytown>.shtml It either shows me the forecast or it doesn't. To date it's always worked - if one day it doesn't I might have to look out of a window.
  - Beldin 3y ago
    > In the same way as walking to the bank is dangerous because any party on the way can rob you on the way? To make this analogy more fitting, you'd also need a big sign around your head "going to do some banking, carrying all necessary credentials, cannot tell legitimate bank from fake bank". Still not a great analogy though.
  - 8organicbits 3y ago
    Imagine a major weather event is coming and a warning banner shows on the weather site telling you to stay off the roads. But some carelessly injected ad covers it, or the injected CSS makes it unreadable. You don't see it and suffer a crash. Government communications should not be subjected to arbitrary modification by intermediaries. Ad injection on HTTP is (or at least was, when unencrypted HTTP was popular) common. It also raises the concern that the ad will appear to have government sponsorship, which invites scams and other malvertising. A government agency should seek to communicate information with the public, especially safety information, via an untamperable communication channel.
    - defrost 3y ago
      It's the BoM site, in Australia. As a site its considerably less authorative than you seem to believe; people get weather warnings here in Australia from the TV, from the radio, from apps on their phones, from looking outside and seeing weather fronts rolling in. Few people actually directly visit the BoM site, those that do are generally long time users familiar with the site using the usual array of adblockers and noscript, unlikely to fall for "Click here" injection attacks, and more likely to have a direct fibre | line connection to a major ISP to BoM with little chance for malicious injection in any case. The risks are understood and doomsday scenarios have yet to occur after nearly 40 odd years online as a non https site.
  - simondotau 3y ago
    > In the same way as walking to the bank is dangerous It could be if anyone could make their shop look exactly like a real bank branch.
verve_rat 3y ago
Nah, the NZ secret police is too busy removing NZ from maps so no one can find us.
- LAC-Tech 3y ago
  I feel like all police in NZ are secret police because I never see any out in the street anymore.
  - verisimi 3y ago
    Now you mention it, I only really see police cars around here - quite rare to see police walking. I guess this is an effect of having built a digital panopticon. As pretty much everything we do leaves a digital trace and as one is oblivious to being observed (with observation potentially occurring in the future as automated agents run over data) the potential scrutiny changes behaviour. And that in turn allows for a decrease the number of police required to be physically present.
paleface 3y ago
Aside from browsing history, privacy implications, some ISPs insert adverts, into the HTML - possibly opening up the user, to drive by browser exploits… The reality is, it’s not complicated to add HTTPS, as a feature, so there’s no good reason as to why it’s not implemented - aside from incompetence, or trying to save money, on staff?!
- hulitu 3y ago
  > some ISPs insert adverts, into the HTML - possibly opening up the user, to drive by browser exploits… Just like some sites insert adverts in web pages, "possibly opening up the user, to drive by browser exploits…"
Strilanc 3y ago
A government site has implicit authority. You could use that implicit authority to make a scam look more authentic. It also will have a lot of traffic; a lot of opportunities for the scam to work if you do manage to get in the middle. For example, inject a dialog box that says "Our records indicate your taxes were not paid this year! Before you can view the weather you must click here and log in to resolve this issue!".
chmod775 3y ago
Here's where people from Australian military intelligence sign-in: http://reg.bom.gov.au/defence/ http://reg.bom.gov.au/defence/ You tell me why http is bad now.
- LargeTomato 3y ago
  My android phone was redirected to an https endpoint.
  - entropyie 3y ago
    If the first request is plaintext, the request can be intercepted before you ever get the redirect, inserting a trojanised login page instead.
mike-cardwell 3y ago
You can sign in to this website. If you do, your password has been sent over clear text. People re-use passwords across sites.

geek_at 3y ago

It's just dangerous because any party on the way between wifi and the server can edit the content See: why are free proxies free https://blog.haschek.at/2013/05/why-free-proxies-are-free-js-infection.html https://blog.haschek.at/2013/05/why-free-proxies-are-free-js...

defrost 3y ago
In the same way as walking to the bank is dangerous because any party on the way can rob you on the way? I regularly visit: www.bom.gov.au/<mystate>/forecasts/<mytown>.shtml It either shows me the forecast or it doesn't. To date it's always worked - if one day it doesn't I might have to look out of a window.
- Beldin 3y ago
  > In the same way as walking to the bank is dangerous because any party on the way can rob you on the way? To make this analogy more fitting, you'd also need a big sign around your head "going to do some banking, carrying all necessary credentials, cannot tell legitimate bank from fake bank". Still not a great analogy though.
- 8organicbits 3y ago
  Imagine a major weather event is coming and a warning banner shows on the weather site telling you to stay off the roads. But some carelessly injected ad covers it, or the injected CSS makes it unreadable. You don't see it and suffer a crash. Government communications should not be subjected to arbitrary modification by intermediaries. Ad injection on HTTP is (or at least was, when unencrypted HTTP was popular) common. It also raises the concern that the ad will appear to have government sponsorship, which invites scams and other malvertising. A government agency should seek to communicate information with the public, especially safety information, via an untamperable communication channel.
  - defrost 3y ago
    It's the BoM site, in Australia. As a site its considerably less authorative than you seem to believe; people get weather warnings here in Australia from the TV, from the radio, from apps on their phones, from looking outside and seeing weather fronts rolling in. Few people actually directly visit the BoM site, those that do are generally long time users familiar with the site using the usual array of adblockers and noscript, unlikely to fall for "Click here" injection attacks, and more likely to have a direct fibre | line connection to a major ISP to BoM with little chance for malicious injection in any case. The risks are understood and doomsday scenarios have yet to occur after nearly 40 odd years online as a non https site.
- simondotau 3y ago
  > In the same way as walking to the bank is dangerous It could be if anyone could make their shop look exactly like a real bank branch.

verve_rat 3y ago

Nah, the NZ secret police is too busy removing NZ from maps so no one can find us.

LAC-Tech 3y ago
I feel like all police in NZ are secret police because I never see any out in the street anymore.
- verisimi 3y ago
  Now you mention it, I only really see police cars around here - quite rare to see police walking. I guess this is an effect of having built a digital panopticon. As pretty much everything we do leaves a digital trace and as one is oblivious to being observed (with observation potentially occurring in the future as automated agents run over data) the potential scrutiny changes behaviour. And that in turn allows for a decrease the number of police required to be physically present.

paleface 3y ago

Aside from browsing history, privacy implications, some ISPs insert adverts, into the HTML - possibly opening up the user, to drive by browser exploits… The reality is, it’s not complicated to add HTTPS, as a feature, so there’s no good reason as to why it’s not implemented - aside from incompetence, or trying to save money, on staff?!

hulitu 3y ago
> some ISPs insert adverts, into the HTML - possibly opening up the user, to drive by browser exploits… Just like some sites insert adverts in web pages, "possibly opening up the user, to drive by browser exploits…"

Strilanc 3y ago

A government site has implicit authority. You could use that implicit authority to make a scam look more authentic. It also will have a lot of traffic; a lot of opportunities for the scam to work if you do manage to get in the middle. For example, inject a dialog box that says "Our records indicate your taxes were not paid this year! Before you can view the weather you must click here and log in to resolve this issue!".

chmod775 3y ago

Here's where people from Australian military intelligence sign-in: http://reg.bom.gov.au/defence/ http://reg.bom.gov.au/defence/ You tell me why http is bad now.

LargeTomato 3y ago
My android phone was redirected to an https endpoint.
- entropyie 3y ago
  If the first request is plaintext, the request can be intercepted before you ever get the redirect, inserting a trojanised login page instead.

mike-cardwell 3y ago

You can sign in to this website. If you do, your password has been sent over clear text. People re-use passwords across sites.