4 ms·

I remember when back in the day Facebook didn't default to HTTPS. You could just put your 802.11 card to monitor mode, power up ettercap in an area where there

I remember when back in the day Facebook didn't default to HTTPS. You could just put your 802.11 card to monitor mode, power up ettercap in an area where there are a lot of unencrypted WiFi packets flying around, and easily you have dozens of session cookies. Script-kiddie level. More interesting would be to take over a network (MITM style) and set up iptables to route all connections to Facebook IP's to a local webserver (DNAT target helps). Then you host a phishing FB page and soon you have logged emails and passwords from unsuspecting users. I think this can actually work even if Facebook does default to HTTPS, because users never actually reach Facebook itself.

callahad 12y ago
> I think this can actually work even if Facebook does default to HTTPS, because users never actually reach Facebook itself. If the user has successfully reached Facebook in the past 90 days, then their browser will have seen FB's HSTS header, and refuse to connect without TLS... provided they're not browsing with IE. :(
aptwebapps 12y ago
"I think this can actually work even if Facebook does default to HTTPS, because users never actually reach Facebook itself." The certificate won't match. I don't know how many users will click past the big red warning page most browsers show, but I don't have much sympathy for them if they do.
- thegeomaster 12y ago
  I was referring to serving an ordinary HTTP page on port 80. Most people type facebook.com into the address bar and hit Enter (and don't have HTTPSEverywhere). In normal circumstances, Facebook would issue a redirect to https://facebook.com https://facebook.com, but if you're controlling the network you just serve the front page via HTTP.
  - aptwebapps 12y ago
    Yes, I suppose that might work at least some of the time. Most browsers these days, however, would send you to the https site simply because you had visited it more frequently unless you typed out the full url and managed not to select the offered completion.
    - callahad 12y ago
      > Most browsers these days, however, would send you to the https site simply because you had visited it more frequently Actually, in that case, modern browsers would completely refuse to send you to the http site, even if you typed it in explicitly. All thanks to Facebook's 90 day HSTS header [0]. They could improve their security further by getting Facebook into the Chromium preload list. That list, which is shared with Firefox, eliminates the need for an initial, clear connection. [0]: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security [1]: https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...
- icambron 12y ago
  You should have lots of sympathy for them, though. They're not on their guard about MITM attacks, so they deserve to have their data stolen?
  - aptwebapps 12y ago
    I do have sympathy for them usually, just not when I wrote that. ;)
eyeareque 12y ago
Remember Firesheep? http://en.wikipedia.org/wiki/Firesheep http://en.wikipedia.org/wiki/Firesheep This addon was just more fuel to the fire to coax sites to move to ssl only. Now even youtube uses SSL.

callahad 12y ago

> I think this can actually work even if Facebook does default to HTTPS, because users never actually reach Facebook itself. If the user has successfully reached Facebook in the past 90 days, then their browser will have seen FB's HSTS header, and refuse to connect without TLS... provided they're not browsing with IE. :(

aptwebapps 12y ago

"I think this can actually work even if Facebook does default to HTTPS, because users never actually reach Facebook itself." The certificate won't match. I don't know how many users will click past the big red warning page most browsers show, but I don't have much sympathy for them if they do.

thegeomaster 12y ago
I was referring to serving an ordinary HTTP page on port 80. Most people type facebook.com into the address bar and hit Enter (and don't have HTTPSEverywhere). In normal circumstances, Facebook would issue a redirect to https://facebook.com https://facebook.com, but if you're controlling the network you just serve the front page via HTTP.
- aptwebapps 12y ago
  Yes, I suppose that might work at least some of the time. Most browsers these days, however, would send you to the https site simply because you had visited it more frequently unless you typed out the full url and managed not to select the offered completion.
  - callahad 12y ago
    > Most browsers these days, however, would send you to the https site simply because you had visited it more frequently Actually, in that case, modern browsers would completely refuse to send you to the http site, even if you typed it in explicitly. All thanks to Facebook's 90 day HSTS header [0]. They could improve their security further by getting Facebook into the Chromium preload list. That list, which is shared with Firefox, eliminates the need for an initial, clear connection. [0]: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security [1]: https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...
icambron 12y ago
You should have lots of sympathy for them, though. They're not on their guard about MITM attacks, so they deserve to have their data stolen?
- aptwebapps 12y ago
  I do have sympathy for them usually, just not when I wrote that. ;)

eyeareque 12y ago

Remember Firesheep? http://en.wikipedia.org/wiki/Firesheep http://en.wikipedia.org/wiki/Firesheep This addon was just more fuel to the fire to coax sites to move to ssl only. Now even youtube uses SSL.