4 ms·
> If you don't care about the data you're getting back from a server being wrong, why bother requesting it in the first place Perhaps I'm not overly concerned
by IanCal 12y ago
> If you don't care about the data you're getting back from a server being wrong, why bother requesting it in the first place
Perhaps I'm not overly concerned with the prospect of someone altering a gif of a cat falling over because someone put ham on its face.
People can send me fake letters and post can be intercepted but it's still useful.
I'm not saying that security isn't important or that we shouldn't be securing more than we are but the argument that it's vital everything is secured is clearly false. There is traffic that I simply do not care if it is public, and the risk of it being modified (and the consequences if it is) are so low that I think the added time and stress of worrying about it would be more detrimental to me.
- growse 12y agoSo if I intercepted kittens.gif and altered the content type to be 'text/javascript' and the body to be a javascript payload that tries to exploit your browser, you're not overly concerned?
- ryanlol 12y agoNot really assuming said gif is inside an img tag.
- pdpi 12y agoI'd be more worried about my UA not being able to handle that scenario by just refusing to run that javascript payload.
- lewisl9029 12y agoA more realistic situation could be a malicious attacker intercepting the cat picture and replacing it with an image containing something that could land the viewer in jail for having any trace of it on his computer (child pornography), and then sending an anonymous tip to law enforcement...
- IanCal 12y agoNot really, since javascript loaded into an image tag shouldn't run and I was already following an unknown link to an unknown location coming from an unknown server. The risk that it was intercepted by you is low, and the consequences seem to be low too. You're also skipping straight over the risk that it happens at all, which is a fairly important part of a risk assessment.
- rythie 12y agoWhat if they replaced the cat gif with a some objectionable content? e.g. a beheading, surely this could scar you for life?
- IanCal 12y agoIs that particularly likely? That someone will MITM my connection to show me a shock image? Is that a realistic threat you're trying to guard against? What makes that much more likely than someone just emailing it to me? Or tricking me into it by putting different text in the link?