Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US Senate website says use HTTP instead of HTTPS

senate.gov

Post reply on HN
Print view View original

121–129 of 129 posts

Re: US Senate website says use HTTP instead of HTTPS

#121

Post by jamesdwilson »

Buge wrote: post #119
jamesdwilson wrote: post #115

Earlier quoted context omitted.

as does US GOV... https://www.wired.com/2015/04/researchers-uncover-method-det...

Good point. Although some people might say that that isn't something they need to protect their website users against, because Quantum Insert is targeted only against very specific users such as terrorists. The Great Cannon targets all internet users indiscriminately, so website owners are more likely to sympathize with them and want to protect them.

LOL you didn't see the talk by Jacob Applebaum did you? They do this en masse to everyone they possibly can. https://www.youtube.com/watch?v=vILAlhwUgIU

Re: US Senate website says use HTTP instead of HTTPS

#122

Post by Buge »

jamesdwilson wrote: post #121
Buge wrote: post #119

Earlier quoted context omitted.

Good point. Although some people might say that that isn't something they need to protect their website users against, because Quantum Insert is targeted only against very specific users such as terrorists. The Great Cannon targets all internet users indiscriminately, so website owners are more likely to sympathize with them and want to protect them.

LOL you didn't see the talk by Jacob Applebaum did you? They do this en masse to everyone they possibly can. https://www.youtube.com/watch?v=vILAlhwUgIU

That doesn't really give an example of them injecting malware into the http traffic of an innocent user.

With the Great Cannon, not only did they inject malware into the traffic of an innocent user, they injected malware into the traffic of all innocent users whose traffic went through certain Great Firewall routers.

I've used this example several times when talking to website owners who think they don't need https. My goal is to provide a specific example of how their website visitors are being attacked. With the apparently targeted attacks of Quantum Insert, the website owners could convince themselves that only terrorists are targeted, and that thus they don't need to bother protecting anyone. With the completely untargeted Great Cannon attacks, I hope to prove to them that their website visitors are actual innocent victims.

Re: US Senate website says use HTTP instead of HTTPS

#123

Post by SFJulie »

unepipe wrote: post #40
SFJulie wrote: post #26

Earlier quoted context omitted.

Well it does the job, and if it aint broken why fix it?

It creates an easy vector for MITM attacks - could be done by nefarious parties on US citizens traveling in other countries for example.

So looking who are your senators is putting you at risk?

Isn't it a tad paranoid?

Re: US Senate website says use HTTP instead of HTTPS

#124

Post by viraptor »

Buge wrote: post #104
boomlinde wrote: post #99

Earlier quoted context omitted.

What exactly are these techniques that work in plain HTTP but not in HTTPS? It seems like the difference between the two does not pertain to the actual content at all, but I am more curious than knowledgeable in this case.

Intermediate nodes can cache http traffic, but not https. Also intermediate nodes could compress or shrink images or do similar types of things.

> Also intermediate nodes could compress or shrink images or do similar types of things.

And we come back a full circle. Even if the image is not sensitive, I'm glad I can force https to workaround my ISP being "helpful" and shrinking images.

Re: US Senate website says use HTTP instead of HTTPS

#125

Post by mike-cardwell »

inglor wrote: post #107
mike-cardwell wrote: post #91

Earlier quoted context omitted.

I gave 3 examples. Phishing, malware injection and CSRF. If you want to know how these sorts of attacks work, there isn't enough space in a HN comment so go use a search engine.

Phishing and malware injection are obvious - but how would that give you (any more) leverage to perform CSRF? (since well, the backend validates the token). XSS for sure (which is probably what you meant by malware injection) and that sort of can enable CSRF if the vulnerability was already there - but I don't think it can cause it.

CSRF is "cross site request forgery". It is an attack. What you are talking about when you start mentioning tokens, is presumably the various methods of mitigation that a number of websites use to defend against that particular attack.

A MITM can initiate a CSRF attack, because they can add arbitrary code to the page. Whether or not the target site has protection, and whether or not the attack is successfull, does not change the fact that a MITM can launch one. Sites still need to protect against CSRF because there are other methods of launching them, but nontheless, if all sites were HTTPS and HTTP didn't exist, then that would defend you against a MITM on an untrusted network launching one.

I didn't mean XSS when I said malware injection. I didn't mention XSS and I didn't intend to.

Re: US Senate website says use HTTP instead of HTTPS

#126

Post by mike-cardwell »

formula_ninguna wrote: post #98
liveoneggs wrote: post #92

Earlier quoted context omitted.

it's fairly common for an ISP to inject popups into web traffic (or redirect your dns)

by the way, is it legal? how do they explain that?

In which country, in which jurisdiction, according to which lawyer?

Re: US Senate website says use HTTP instead of HTTPS

#127

Post by boomlinde »

Buge wrote: post #104
boomlinde wrote: post #99

Earlier quoted context omitted.

What exactly are these techniques that work in plain HTTP but not in HTTPS? It seems like the difference between the two does not pertain to the actual content at all, but I am more curious than knowledgeable in this case.

Intermediate nodes can cache http traffic, but not https. Also intermediate nodes could compress or shrink images or do similar types of things.

As far as I'm concerned, that third parties can change the content of a response mid-air is exactly the reason that you should use HTTPS. If you rely on handing unencrypted data over the internet to a third party provider, you have to accept that other parties may also modify the requests and their responses.

You may think that it isn't a big deal because you aren't serving sensitive information, but if your users are dropping in from a random hotspot or are in one of the countries where ISPs seem to be able to do whatever the hell they want, there are tons of possible intrusions, ranging from inserting ads or replacing the entire response with a gentle reminder to pay your internet bill, to inserting outright malicious software.

It's like leaving your front door unlocked just for the convenience of being able to walk inside without unlocking it.

Re: US Senate website says use HTTP instead of HTTPS

#128

Post by MichaelBurge »

ryan_lane wrote: post #117
excalibur wrote: post #97

Earlier quoted context omitted.

EV isn't that difficult to acquire, only more expensive. Not a huge deal when working with other people's money. What boggles the mind is that the US Senate is using a commercial CA for their website.

Would you be OK with your browser trusting a US government managed CA in its default trust list?

Sure - why not. They already manage my water supply.

Re: US Senate website says use HTTP instead of HTTPS

#129

Post by Benjamin_Dobell »

boomlinde wrote: post #127
Buge wrote: post #104

Earlier quoted context omitted.

Intermediate nodes can cache http traffic, but not https. Also intermediate nodes could compress or shrink images or do similar types of things.

As far as I'm concerned, that third parties can change the content of a response mid-air is exactly the reason that you should use HTTPS. If you rely on handing unencrypted data over the internet to a third party provider, you have to accept that other parties may also modify the requests and their responses. You may think that it isn't a big deal because you aren't serving sensitive information, but if your users ar…

Supporting caching doesn't necessarily mean intermediates can modify the requests/responses mid-air. You can still hash and sign content, and servers can cache these responses.

Nonetheless, that approach seems to be a way of the past. HTTPS is essentially expected now, so CDNs are required to achieve similar performance - Great news for CDNs ;)

Post reply on HN