Why Static Websites Need HTTPS • Hacker News Board

Re: Why Static Websites Need HTTPS

#221

Post by Ajedi32 » Tue, Aug 28, 2018, 11:50 PM UTC

nanoscopic wrote: post #193

I admin a number of different websites. The majority of them are static. I have forced https redirect on some of them. On others I do not. The only benefit of https I perceive in the case of static public content is that ISPs cannot easily monitor which specific pages on my domains are being visited. With plain http they could. I don't particularly care if people get MITM'ed when visiting my static sites. If they did…

There are other threat vectors you aren't considering such as DNS cache poisoning, [BGP hijacking][1], and [rogue USB sticks][2].

But even ignoring that, why wouldn't you want to take basic steps to protect against rogue access points or ISPs? "I don't particularly care if people get MITM'ed when visiting my static sites" seems, at least to me, like a rather dismissive attitude towards the security of your site's users.

I'd also like to point out that with the ever-widening deployment of HTTPS the hypothetical attack you described where your ISP MITMS your browser install is becoming less and less feasible. Nearly all modern browsers include a [HSTS preload list][3] which ensures they will never attempt to connect to certain domains over an insecure connection. A browser download site (or even just the user's search engine, which would link directly to the HTTPS-protected download page) being on this list would make the downgrade attack you describe much more difficult.

[1]: https://www.internetsociety.org/blog/2018/04/amazons-route-5...

[2]: https://samy.pl/poisontap/

[3]: https://scotthelme.co.uk/hsts-preloading/

Re: Why Static Websites Need HTTPS

#222

Post by Jach » Tue, Aug 28, 2018, 11:52 PM UTC

fmpwizard wrote: post #205

nanoscopic wrote: post #193

I admin a number of different websites. The majority of them are static. I have forced https redirect on some of them. On others I do not. The only benefit of https I perceive in the case of static public content is that ISPs cannot easily monitor which specific pages on my domains are being visited. With plain http they could. I don't particularly care if people get MITM'ed when visiting my static sites. If they did…

> generally is because they chose to use unsafe public access points It sounds like you are penalizing users for not using a vpn or some other method when out of their homes. Yes, people can do that, but in 2018 having https on the sites you manage is a lot easier than asking every possible visitor to use a vpn. I hope you would reconsider and enable https on all the sites you are an admin. > If your ISP is MITMing y…

It's all good to point this out, but it's a social argument, not a technical one. If the technical arguments have been eliminated (e.g. you have no technical use for encrypting the connection) then you're left with "Join us in giving the finger to ISPs/cafe routers that inject foreign JS!" Don't be upset when people say "Meh. Take it up with those ISPs directly, or with web browser vendors, I don't care and don't want to join your crusade." At some point web browsers will stop serving content over HTTP unless perhaps with a custom flag turned on, and even then, some people will still not use HTTPS.

Re: Why Static Websites Need HTTPS

#223

Post by schoen » Tue, Aug 28, 2018, 11:58 PM UTC

3pt14159 wrote: post #219

schoen wrote: post #172

Earlier quoted context omitted.

Can you clarify what restrictions you'd like to see in place? I didn't quite follow this, but if you can describe what you want to see, I might be able to describe a way to do it or request that it be created.

It's fine now, following CAA records is now mandatory, but prior to 2017 we didn't and even now most websites don't use it. CAA should be mandatory in a Let's Encrypted world because it's now trivial to create a HTTPS cert. It no longer requires stolen credit card details.

Thanks. I'm also hoping that some day there will be a direct domain-registrar-to-CA authentication protocol of some sort!

Re: Why Static Websites Need HTTPS

#224

Post by icebraining » Wed, Aug 29, 2018, 12:07 AM UTC

austincheney wrote: post #220

icebraining wrote: post #207

Earlier quoted context omitted.

They would need configuration access to a router in the path to perform DNS actions in order to accomplish this. Nope, they just need to poison its ARP cache. You can do that easily with a tool like Ettercap, if the router is in the same LAN as your machine. Every request (DNS, HTTP, etc) from the victim machine will now go to yours, and you control the responses it gets. Note that they aren't impersonating the domai…

ARP cache poisoning occurs at the switch not the router. It is an awesome form of attack, but access to the switch and the availability of that compromise are limited in scope. A single switch can only have so many machines connected even with VLANs. It also requires access from within the local LAN. I really don't think anybody is thinking of ARP poisoning when all these comments here mention public facing MiTM atta…

ARP poisoning is just an example of a very simple and easy attack that can affect anyone that ever uses a public hotspot - on a cafe, university, workplace, etc.

Another possibility - compromising home routers: https://arstechnica.com/information-technology/2018/05/hacke...

Other possible attacks would be to compromise an internal router at an office (affecting everyone up to the CEO), controlling a VPN or Tor exit node, etc.

None of these give you the possibility of creating your own cert, but they do give you enough MITM access to fully compromise an HTTP site.

Since ARP is only layer 3 it really doesn't care if the page is sent via HTTPS and works the same either way.

The attack works in the sense that the traffic starts flowing through the attacker's machine, but the attacker is still prevented from changing anything in the page. That's the whole point of SSL/TLS.

Re: Why Static Websites Need HTTPS

#225

Post by austincheney » Wed, Aug 29, 2018, 12:12 AM UTC

AgentME wrote: post #170

austincheney wrote: post #154

Earlier quoted context omitted.

It does not. Redirection from the router involves only TCP and DNS actions. HTTPS does not encrypt TCP. HTTPS is an encrypted tunnel that rides over TCP. HTTPS is a layer 7 protocol while TCP is a layer 4 protocol. You can encrypt TCP as well if you are using IPSEC. IPSEC is built into IPv6 by default, but it fails with NAT over IPv4, which is still most of the internet. None of that is what HTTPS is for though. The…

If the user is trying to access https://example.com , and an attacker redirects the TCP connection (or fakes a response to the DNS query so the user gets the wrong IP address) to a server that doesn't have the private key for example.com's HTTPS certificate, then the HTTPS connection will fail. The attacker is unable to serve their own content to the user as " https://example.com" . HTTPS doesn't just encrypt the con…

https://www.computerworld.com/article/2897815/microsoft-blac...

Spoofing a certificate isn't trivial but fraudulent certificates are a thing. This is why there are revocation lists and OCSP.

Re: Why Static Websites Need HTTPS

#226

Post by drewmol » Wed, Aug 29, 2018, 12:13 AM UTC

nanoscopic wrote: post #193

I admin a number of different websites. The majority of them are static. I have forced https redirect on some of them. On others I do not. The only benefit of https I perceive in the case of static public content is that ISPs cannot easily monitor which specific pages on my domains are being visited. With plain http they could. I don't particularly care if people get MITM'ed when visiting my static sites. If they did…

>I don't particularly care if people get MITM'ed when visiting my static sites.

I for one would be honored, and then irritated.

Re: Why Static Websites Need HTTPS

#227

Post by austincheney » Wed, Aug 29, 2018, 12:17 AM UTC

icebraining wrote: post #209

austincheney wrote: post #152

Earlier quoted context omitted.

> Yes, if I can masquerade as your domain How would you do that? If you could do that you could also masquerade the HTTPS connection and simply run HTTPS at the spoofed server using the spoofed X.509 cert from the legitimate web server.

You can't "spoof" a cert, that's its whole point. If you create a new, it won't have a valid signature, and if you copy the original, you won't have the associated private key to create valid responses.

https://www.computerworld.com/article/2897815/microsoft-blac...

To be more clear a malicious website can rely on fraudulently issued certificates to validate a spoofed domain. This is a bad cert that appears to be valid and establishes the same level of trust. That is why revocation lists and OCSP are necessary.

Re: Why Static Websites Need HTTPS

#228

Post by Dylan16807 » Wed, Aug 29, 2018, 12:30 AM UTC

austincheney wrote: post #83

jakelazaroff wrote: post #50

Earlier quoted context omitted.

The guarantee TLS provides is not that content is unable to be modified, but that any modifications are detectable . The router (or anything else between your computer and the server) can modify the content in transport to its heart's content, but it won't be able to sign it with the domain's private key, and so the browser will always know when such modifications have taken place and flag them as malicious.

That is true after the certificate chain is validated by the browser, but not before. A malicious router attack could just as easily modify the initial http request so that the user is directed to the domain on a spoofed IP before HTTPS trust violation. The malicious http server would also have to spoof the original cert though, but then they get malicious trusted https on the trusted domain that returns similar look…

> A malicious router attack could just as easily modify the initial http request so that the user is directed to the domain on a spoofed IP before HTTPS trust violation.

If the initial request is HTTPS, everything is validated, and a spoofed redirect is impossible.

Re: Why Static Websites Need HTTPS

#229

Post by bodas » Wed, Aug 29, 2018, 12:31 AM UTC

nanoscopic wrote: post #193

I admin a number of different websites. The majority of them are static. I have forced https redirect on some of them. On others I do not. The only benefit of https I perceive in the case of static public content is that ISPs cannot easily monitor which specific pages on my domains are being visited. With plain http they could. I don't particularly care if people get MITM'ed when visiting my static sites. If they did…

One benefit of HTTPS is that ISPs can't insert their ads onto your website. Believe me, there are ISPs that do that.

> If your ISP is MITMing you, I think you have bigger problems then whether they change the content of my static site when you visit it.

Perhaps. But in the UK ISPs are legally required to log every web page you visit. However, they are not going to serve you a fake version of Chrome (which is signed anyway).

Re: Why Static Websites Need HTTPS

#230

Post by bigiain » Wed, Aug 29, 2018, 12:37 AM UTC

thsowers wrote: post #199

nanoscopic wrote: post #193

I admin a number of different websites. The majority of them are static. I have forced https redirect on some of them. On others I do not. The only benefit of https I perceive in the case of static public content is that ISPs cannot easily monitor which specific pages on my domains are being visited. With plain http they could. I don't particularly care if people get MITM'ed when visiting my static sites. If they did…

> I don't particularly care if people get MITM'ed when visiting my static sites. If they did so it generally is because they chose to use unsafe public access points ( wifi ). This extends to some degree to all forms of wifi since so many security forms in use on them can be easily broken. While wifi offers little "complete" security, some methods of security, (like implementing HTTPS) require very little work for a…

Also, remember that people who get MITMed are not going to say "Oh, sucks to be me for using insecure public wifi and getting pwned when visiting nanoscopic.io, I'm such an idiot..." - they're going to say "The shit-weasel who runs nanoscopic.io installed a fucking cryptominer and configured porn ad dns servers on my laptop! Don't _ever_ visit that site!"

The "very little work" required to use https these days could one day be incredibly valuable in terms of not having your reputation trashed... Perhaps you _should_ care a little more about people getting MITMed...