The indirect costs of switching to HTTPS (like lost advertisement revenue) make it a inviable solution
This doesn't entirely make sense. I'm sure it's possible to serve adverts on a HTTPS page, and let's encrypt is hardly expensive
MitM Attack against KeePass 2’s Update Check
21–30 of 78 posts
Re: MitM Attack against KeePass 2’s Update Check
#22Why is there advertisement on the automated update server? Why can't he just split them apart? What with things like Let's Encrypt nowadays, there really shouldn't be any excuse not to use https. Especially for a security related product!
Re: MitM Attack against KeePass 2’s Update Check
#23"Received response from Dominik Reichl: The vulnerability will not be fixed. The indirect costs of switching to HTTPS (like lost advertisement revenue) make it a inviable solution." Well the indirect costs of not fixing it just got a lot bigger. Now a lot of people will realize that their passwords are not as safe as KeePass claims they are and will switch to a different product. So this way they loose both their mon…
Maybe, maybe not. People might not notice or care. (Of course I agree that this is a poor decision security-wise.)
Re: MitM Attack against KeePass 2’s Update Check
#24"Received response from Dominik Reichl: The vulnerability will not be fixed. The indirect costs of switching to HTTPS (like lost advertisement revenue) make it a inviable solution." Well the indirect costs of not fixing it just got a lot bigger. Now a lot of people will realize that their passwords are not as safe as KeePass claims they are and will switch to a different product. So this way they loose both their mon…
Why would switching to HTTPS cost him any advertising revenue?
Re: MitM Attack against KeePass 2’s Update Check
#25The indirect costs of switching to HTTPS (like lost advertisement revenue) make it a inviable solution. How does HTTPS result in lost ad revenue?
1. Many ad networks do not support serving over HTTPS.
2. Serving HTTP ads only your HTTPS-only site will show scary mixed-content warnings in many browsers, driving away users.
Re: MitM Attack against KeePass 2’s Update Check
#26I was always skeptical of KeePass which is why I've been using KeePassX. It is just a simple Qt app. Unfortunately there is no KeePassHttp support yet, so you can't hook it up to your browser, but there is a fork available with full support. https://github.com/droidmonkey/keepassx_http/
I'd probably switch to KeePassX instead of running KeePass in wine if the password generator were as flexible.
[deleted]
Re: MitM Attack against KeePass 2’s Update Check
#27"Received response from Dominik Reichl: The vulnerability will not be fixed. The indirect costs of switching to HTTPS (like lost advertisement revenue) make it a inviable solution." Well the indirect costs of not fixing it just got a lot bigger. Now a lot of people will realize that their passwords are not as safe as KeePass claims they are and will switch to a different product. So this way they loose both their mon…
Why would switching to HTTPS cost him any advertising revenue?
See https://news.ycombinator.com/item?id=11803716 from yesterday
Re: MitM Attack against KeePass 2’s Update Check
#28I was always skeptical of KeePass which is why I've been using KeePassX. It is just a simple Qt app. Unfortunately there is no KeePassHttp support yet, so you can't hook it up to your browser, but there is a fork available with full support. https://github.com/droidmonkey/keepassx_http/
I'd probably switch to KeePassX instead of running KeePass in wine if the password generator were as flexible.
Why are you running KeePass in wine?
Re: MitM Attack against KeePass 2’s Update Check
#29The indirect costs of switching to HTTPS (like lost advertisement revenue) make it a inviable solution This doesn't entirely make sense. I'm sure it's possible to serve adverts on a HTTPS page, and let's encrypt is hardly expensive
> I'm sure it's possible to serve adverts on a HTTPS page
Yes, you can, but you lose a tremendous amount of ad revenue and a number of ad providers still don't support HTTPS.
Re: MitM Attack against KeePass 2’s Update Check
#30I've already been slowly migrating from KeePass to https://www.passwordstore.org/ and this is just one more reason why.