3 ms·

Here's the scenario they're trying to prevent: 1. Bob often views videos on YouTube, so he grants youtube.com permanent access to the fullscreen API. 2. Eve r

Here's the scenario they're trying to prevent: 1. Bob often views videos on YouTube, so he grants youtube.com permanent access to the fullscreen API. 2. Eve runs an open wifi AP near a coffee shop. The AP includes a proxy server that redirects youtube.com requests to Eve's own server. 3. Bob connects to Eve's AP. When he goes to youtube.com, he instead gets a response from Eve's server, which is designed to imitate a full desktop environment. Since Bob has already given youtube.com access to the fullscreen API, the browser grants Eve's site fullscreen rights without notifying Bob.

ldng 12y ago
Ok. Here I can see the problem. That said, does this happens really that much ? Shouldn't we educate on open wifi instead ? My point is HTTPS has a cost and is a barrier of entry, the trade off isn't always worth it, IMHO.
- icebraining 12y ago
  Open Wifi is not necessarily the problem. An AP with a shared password (99% of them) is also vulnerable, if the attacker also has a password. It's not reasonable to expect people to never use YouTube on public WiFi hotspots. And the cost of HTTPS is pretty low nowadays. Cloudflare even offers it on their free plan, and it doesn't require you to set it up on your own server.
  - ldng 12y ago
    Do you really need to secure Youtube viewing on a public WiFi hotspots ? Unless you want to sell DRM movies, I don't see the need for HTTPS here. Unless you want privacy on a public network. But we're not talking about security anymore. So you're suggesting trading a potential MitM but an official Cloudflare MitM ? :) It is not only about a money cost, it is also about a complexity cost and false sense of security. HTTPS is not the be-all and the end-all of security. Just a step to security, if/when you need it. I'm not arguing HTTPS is not needed. I'm the first to push for when needed. But it is not needed for watching cat videos, sorry.
    - nknighthb 12y ago
      > Do you really need to secure Youtube viewing on a public WiFi hotspots ? This suggests you did not, in fact, see the problem. The attacker in this scenario is not limited to replacing YouTube videos. They can make anything they want appear on the user's screen, including things like a Google login page, or even a bank login page.
      - ldng 12y ago
        You're probably right, I am not a security expert and might not be seeing the whole picture. You log into your bank website connected to an open WiFi hotspot ? I never would do that. I think there is a point where you have to apply common sense. I do not care about the downvote, my opinion is what it is and I maintain my position. As I see it (me not been a field expert), HTTPS Everywhere will not save the world. You will still have people connecting to the wrongly spelled site (HTTPS or not). Some will even have a false sense of security which would be counter-productive. I access my through HTTPS explicitly typing the URL. My bank ask confirmation out of band for every dangerous action (by SMS). IMHO, one should be educated to take necessary precautions. In Europe, banks have to cover frauds, the positive side effect is that some banks started to educated user on security (it's cheaper !). I don't know how it is in the rest of the world. Just to be clear, I am not against HTTPS where it makes sense. I am against HTTPS everywhere as the only security measure. Because, that's what it will come to, "We have HTTPS so we're good, security checkbox ticked". That is not, IMHO, not a good way of thinking about security. I guess my point is HTTPS everywhere is not the solution and should rather/also educated better/more on the risks of Internet. That said, I wouldn't mind being pointed at a screencast/viedo (on youtube ;-)) showing how the scenario you refer to would unfold.
        organsnyder 12y ago
        HTTPS is not a panacea. However, it does provide security advantages over HTTP, even when the communication itself does not have particularly sensitive content. While not impenetrable, HTTPS does provide a reasonable assurance (or at least a higher hurdle for an attacker) that the server is actually officially representing a particular domain. Of course there are still issues. The certification process has plenty of flaws (such as the fact that an attack on a single one of the multitude trusted in most browsers is just as good as attacking all of them), and there are still other vectors (such as the mistyped URL example you provide). However, HTTPS still provides a clear—and increasingly low-cost—advantage over HTTP.

ldng 12y ago

Ok. Here I can see the problem. That said, does this happens really that much ? Shouldn't we educate on open wifi instead ? My point is HTTPS has a cost and is a barrier of entry, the trade off isn't always worth it, IMHO.

icebraining 12y ago
Open Wifi is not necessarily the problem. An AP with a shared password (99% of them) is also vulnerable, if the attacker also has a password. It's not reasonable to expect people to never use YouTube on public WiFi hotspots. And the cost of HTTPS is pretty low nowadays. Cloudflare even offers it on their free plan, and it doesn't require you to set it up on your own server.
- ldng 12y ago
  Do you really need to secure Youtube viewing on a public WiFi hotspots ? Unless you want to sell DRM movies, I don't see the need for HTTPS here. Unless you want privacy on a public network. But we're not talking about security anymore. So you're suggesting trading a potential MitM but an official Cloudflare MitM ? :) It is not only about a money cost, it is also about a complexity cost and false sense of security. HTTPS is not the be-all and the end-all of security. Just a step to security, if/when you need it. I'm not arguing HTTPS is not needed. I'm the first to push for when needed. But it is not needed for watching cat videos, sorry.
  - nknighthb 12y ago
    > Do you really need to secure Youtube viewing on a public WiFi hotspots ? This suggests you did not, in fact, see the problem. The attacker in this scenario is not limited to replacing YouTube videos. They can make anything they want appear on the user's screen, including things like a Google login page, or even a bank login page.
    - ldng 12y ago
      You're probably right, I am not a security expert and might not be seeing the whole picture. You log into your bank website connected to an open WiFi hotspot ? I never would do that. I think there is a point where you have to apply common sense. I do not care about the downvote, my opinion is what it is and I maintain my position. As I see it (me not been a field expert), HTTPS Everywhere will not save the world. You will still have people connecting to the wrongly spelled site (HTTPS or not). Some will even have a false sense of security which would be counter-productive. I access my through HTTPS explicitly typing the URL. My bank ask confirmation out of band for every dangerous action (by SMS). IMHO, one should be educated to take necessary precautions. In Europe, banks have to cover frauds, the positive side effect is that some banks started to educated user on security (it's cheaper !). I don't know how it is in the rest of the world. Just to be clear, I am not against HTTPS where it makes sense. I am against HTTPS everywhere as the only security measure. Because, that's what it will come to, "We have HTTPS so we're good, security checkbox ticked". That is not, IMHO, not a good way of thinking about security. I guess my point is HTTPS everywhere is not the solution and should rather/also educated better/more on the risks of Internet. That said, I wouldn't mind being pointed at a screencast/viedo (on youtube ;-)) showing how the scenario you refer to would unfold.
      - organsnyder 12y ago
        HTTPS is not a panacea. However, it does provide security advantages over HTTP, even when the communication itself does not have particularly sensitive content. While not impenetrable, HTTPS does provide a reasonable assurance (or at least a higher hurdle for an attacker) that the server is actually officially representing a particular domain. Of course there are still issues. The certification process has plenty of flaws (such as the fact that an attack on a single one of the multitude trusted in most browsers is just as good as attacking all of them), and there are still other vectors (such as the mistyped URL example you provide). However, HTTPS still provides a clear—and increasingly low-cost—advantage over HTTP.