3 ms·

1. example.com is not on the HSTS preload list 2. Because you normally visit example.com using an incognito window, your browser hasn't cached the redirect to

1. example.com is not on the HSTS preload list 2. Because you normally visit example.com using an incognito window, your browser hasn't cached the redirect to SSL, or the address bar suggestion, and you haven't bookmarked the site. 3. You key in example.com, the browser connects over http, and the evil wifi MITMs your unencrypted connection - removing the redirect to SSL and messing with the page however the evildoer wants. Obviously a VPN provider can also do this, but you might hope they're less likely to.

sciencejerk 1y ago
Will Chromium generate a "Your connection is not private" warning in this scenario, that the user has to click through to proceed? And the user would have to type example.com in the browser bar; https://example.com https://example.com would also trigger a warning, correct?
extraduder_ire 1y ago
You connect to an access point, and your browser/OS tries to open one of http://detectportal.firefox.com/canonical.html http://detectportal.firefox.com/canonical.html, http://www.msftconnecttest.com/connecttest.txt http://www.msftconnecttest.com/connecttest.txt, http://connectivitycheck.gstatic.com/generate_204 http://connectivitycheck.gstatic.com/generate_204, https://captive.apple.com/hotspot-detect.html https://captive.apple.com/hotspot-detect.html and loads/displays whatever unencrypted web page is served. Getting someone to open an unencrypted webpage is almost trivial. It's often one of the only web pages you can open on a device.
- Dylan16807 1y ago
  The problem isn't getting you to open a page, it's putting that page behind a known legitimate URL.
TZubiri 1y ago
"Obviously a VPN provider can also do this, but you might hope they're less likely to." So you have identified some marginal privacy issue, and have identified that a VPN doesn't solve it, but rather that it moves the risk to a third party actor you subjectively feel is better. Well I feel that, subjectively, introducing a third party generally decreases security. I believe that not all privacy and security considerations can or should be solved technically, but rather we have extra-technical mechanisms like law and social norms that provide some protection on the edge cases. For example, an employee cannot lookup information for personal reasons on a system they are entrusted to in a professional capacity. I'm no expert, but you probably have first laws that prohibit that, second corporate policy that prohibits that, and thirdly social pressure that prohibits that to some extent. Are they perfect? Not necessarily which is why for the most part we rely on technical encryption and security mechanisms. But at some point these examples become so contrived and the medicine becomes the poison, so you enter into territory that is pretty standard in other industries, what's to stop a waiter from spitting into a cup? There's no spit filter in place of McDonalds, there's other mechanisms protecting us. On a similar note, logic and debate is not the only way to convey this phenomenon, so here's some more artistic retort to privacy schizophrenia. https://www.youtube.com/watch?v=jf9I04Oa-hU https://www.youtube.com/watch?v=jf9I04Oa-hU
- Dylan16807 1y ago
  Using a VPN means you have to trust one company instead of every wifi you connect to, and also makes that an entity that's an expert at privacy instead of working off a half-forgotten router in the back. How is any of this "medicine becoming the poison" or "schizophrenic"?
  - TZubiri 1y ago
    No, you have to trust the one company, as well as everyone you were trusting before. You are still using the router, and now you are also trusting the VPN provider, as well as the nodes in between the VPN provider and your original destination. Also, you are just switching up the "unprotected stretch" between your local wifi, and, say, Google's servers, whereas now that "unprotected stretch" lies between the VPN provider servers in Latvia or British Virgin Islands or Panama, or whatever dubious jurisdiction, and, say, Google. Sure, you added a layer of protection against the random hacker sitting in your Starbucks, but you have added many more vectors. It becomes the poison because the solution you are introducing brings more issues. And it's schizophrenic because the issue to begin with, was minuscule (a hacker stepping into MacDonalds, breaking the network encryption and then also the application encryption. Maybe if this were 2010 and websites still used HTTP, or you are using a local email client without TLS configured. But it's 2025, everything has HTTPs and you are using an HTTPs email client. VPNs to protect corporate networks is sensible. Consumer VPNs are a different thing entirely and they do not provide increased security at best, decrease security at worst, and usually cater to schizoid threat models, where the threat actor is the state, rather than more realistic threat scenarios.
    - Dylan16807 1y ago
      > No, you have to trust the one company, as well as everyone you were trusting before. You are still using the router, and now you are also trusting the VPN provider, as well as the nodes in between the VPN provider and your original destination. As long as the VPN is up, the worst the wifi can do is cut you off. It can't alter your connections. It's far fewer trust points. > Also, you are just switching up the "unprotected stretch" between your local wifi, and, say, Google's servers, whereas now that "unprotected stretch" lies between the VPN provider servers in Latvia or British Virgin Islands or Panama, or whatever dubious jurisdiction, and, say, Google. Sure, you added a layer of protection against the random hacker sitting in your Starbucks, but you have added many more vectors. When I use a VPN for protection, the server is in the US too. And if it's for netflix I'm going to some major country, not dubious-land. (Also I'd say datacenter and internet core routers are less likely to attack some random person's traffic, but that's not core to my argument.) > It becomes the poison because the solution you are introducing brings more issues. And it's schizophrenic because the issue to begin with, was minuscule (a hacker stepping into MacDonalds, breaking the network encryption and then also the application encryption. For most wifi networks, there is no encryption between users. And it's quite likely that the neglected router got hacked over the internet and is part of a botnet. > Maybe if this were 2010 and websites still used HTTP, or you are using a local email client without TLS configured. But it's 2025, everything has HTTPs and you are using an HTTPs email client. Until you type in a URL and HSTS isn't set.

sciencejerk 1y ago

Will Chromium generate a "Your connection is not private" warning in this scenario, that the user has to click through to proceed? And the user would have to type example.com in the browser bar; https://example.com https://example.com would also trigger a warning, correct?

extraduder_ire 1y ago

You connect to an access point, and your browser/OS tries to open one of http://detectportal.firefox.com/canonical.html http://detectportal.firefox.com/canonical.html, http://www.msftconnecttest.com/connecttest.txt http://www.msftconnecttest.com/connecttest.txt, http://connectivitycheck.gstatic.com/generate_204 http://connectivitycheck.gstatic.com/generate_204, https://captive.apple.com/hotspot-detect.html https://captive.apple.com/hotspot-detect.html and loads/displays whatever unencrypted web page is served. Getting someone to open an unencrypted webpage is almost trivial. It's often one of the only web pages you can open on a device.

Dylan16807 1y ago
The problem isn't getting you to open a page, it's putting that page behind a known legitimate URL.

TZubiri 1y ago

"Obviously a VPN provider can also do this, but you might hope they're less likely to." So you have identified some marginal privacy issue, and have identified that a VPN doesn't solve it, but rather that it moves the risk to a third party actor you subjectively feel is better. Well I feel that, subjectively, introducing a third party generally decreases security. I believe that not all privacy and security considerations can or should be solved technically, but rather we have extra-technical mechanisms like law and social norms that provide some protection on the edge cases. For example, an employee cannot lookup information for personal reasons on a system they are entrusted to in a professional capacity. I'm no expert, but you probably have first laws that prohibit that, second corporate policy that prohibits that, and thirdly social pressure that prohibits that to some extent. Are they perfect? Not necessarily which is why for the most part we rely on technical encryption and security mechanisms. But at some point these examples become so contrived and the medicine becomes the poison, so you enter into territory that is pretty standard in other industries, what's to stop a waiter from spitting into a cup? There's no spit filter in place of McDonalds, there's other mechanisms protecting us. On a similar note, logic and debate is not the only way to convey this phenomenon, so here's some more artistic retort to privacy schizophrenia. https://www.youtube.com/watch?v=jf9I04Oa-hU https://www.youtube.com/watch?v=jf9I04Oa-hU

Dylan16807 1y ago
Using a VPN means you have to trust one company instead of every wifi you connect to, and also makes that an entity that's an expert at privacy instead of working off a half-forgotten router in the back. How is any of this "medicine becoming the poison" or "schizophrenic"?
- TZubiri 1y ago
  No, you have to trust the one company, as well as everyone you were trusting before. You are still using the router, and now you are also trusting the VPN provider, as well as the nodes in between the VPN provider and your original destination. Also, you are just switching up the "unprotected stretch" between your local wifi, and, say, Google's servers, whereas now that "unprotected stretch" lies between the VPN provider servers in Latvia or British Virgin Islands or Panama, or whatever dubious jurisdiction, and, say, Google. Sure, you added a layer of protection against the random hacker sitting in your Starbucks, but you have added many more vectors. It becomes the poison because the solution you are introducing brings more issues. And it's schizophrenic because the issue to begin with, was minuscule (a hacker stepping into MacDonalds, breaking the network encryption and then also the application encryption. Maybe if this were 2010 and websites still used HTTP, or you are using a local email client without TLS configured. But it's 2025, everything has HTTPs and you are using an HTTPs email client. VPNs to protect corporate networks is sensible. Consumer VPNs are a different thing entirely and they do not provide increased security at best, decrease security at worst, and usually cater to schizoid threat models, where the threat actor is the state, rather than more realistic threat scenarios.
  - Dylan16807 1y ago
    > No, you have to trust the one company, as well as everyone you were trusting before. You are still using the router, and now you are also trusting the VPN provider, as well as the nodes in between the VPN provider and your original destination. As long as the VPN is up, the worst the wifi can do is cut you off. It can't alter your connections. It's far fewer trust points. > Also, you are just switching up the "unprotected stretch" between your local wifi, and, say, Google's servers, whereas now that "unprotected stretch" lies between the VPN provider servers in Latvia or British Virgin Islands or Panama, or whatever dubious jurisdiction, and, say, Google. Sure, you added a layer of protection against the random hacker sitting in your Starbucks, but you have added many more vectors. When I use a VPN for protection, the server is in the US too. And if it's for netflix I'm going to some major country, not dubious-land. (Also I'd say datacenter and internet core routers are less likely to attack some random person's traffic, but that's not core to my argument.) > It becomes the poison because the solution you are introducing brings more issues. And it's schizophrenic because the issue to begin with, was minuscule (a hacker stepping into MacDonalds, breaking the network encryption and then also the application encryption. For most wifi networks, there is no encryption between users. And it's quite likely that the neglected router got hacked over the internet and is part of a botnet. > Maybe if this were 2010 and websites still used HTTP, or you are using a local email client without TLS configured. But it's 2025, everything has HTTPs and you are using an HTTPs email client. Until you type in a URL and HSTS isn't set.