41–50 of 117 posts
Unfortunately, while HTTPS is very common, this isn't really the case with HSTS Preload, so active MitM attacks are still a threat.
Unfortunately, while HTTPS is very common, this isn't really the case with HSTS Preload, so active MitM attacks are still a threat.
refresh my understanding, if i manually type "https" into the address bar, then i can't be MitM'ed through lack of HSTS, right?
Unfortunately, while HTTPS is very common, this isn't really the case with HSTS Preload, so active MitM attacks are still a threat.
refresh my understanding, if i manually type "https" into the address bar, then i can't be MitM'ed through lack of HSTS, right?
If you are, you’ll get a message that the very isn’t valid.
Unless there’s an attack on cert providers or someone adds a cert to your device.
The cert approach can be seen in some corporate environments.
Even if a WPA2 wifi point has a password, isn't the encryption key shared among all connections? I.e, if an attacker has the wifi password, it nullifies the wifi encryption? I recall that fixing this was one of WPA3's selling points.
And there are still other attacks possible on public wi-fi networks which don't involve MitM-ing HTTP(s) traffic. MitM DNS traffic and you can do nasty things: https://github.com/infobyte/evilgrade
Earlier quoted context omitted.
refresh my understanding, if i manually type "https" into the address bar, then i can't be MitM'ed through lack of HSTS, right?
You could be. If you are, you’ll get a message that the very isn’t valid. Unless there’s an attack on cert providers or someone adds a cert to your device. The cert approach can be seen in some corporate environments.
How does HSTS help with that?
Earlier quoted context omitted.
While you’re probably not going to be instantly attacked, I still wouldn’t do online banking on a public network.
Every commercial network is a public network in a sense
I believe this is the reason Turkey blocked the entirety of Wikipedia[0], which was recently lifted[1]. They wanted to block specific pages that revealed negative information (and I believe they did at some point), but when Wikipedia went https only[2] the only avenue was to block the entire domain.
0: https://en.wikipedia.org/wiki/Block_of_Wikipedia_in_Turkey
1: https://wikimediafoundation.org/news/2020/01/15/access-to-wi...
2:
Earlier quoted context omitted.
While you’re probably not going to be instantly attacked, I still wouldn’t do online banking on a public network.
Honest question... why not? Modern banks use HTTPS throughout. The banks I use all have HSTS and use preloading so no hijacking to a non-HTTPS site. I use a password manager so if somehow I do get hijacked and get sent to a phishing site, and even if that phishing site is using a Lets Encrypt cert to prevent the “Not Secure” banner in a modern browser, my password manager isn’t going to recognize the domain so it wou…
The EFF is awesome with Let's Encrypt! It was really a dreadful task to buy and renew certificates, especially as out infrastructure back then wasn't that automated. I think this article is a response to all those ads from VPN companies. They do try to scare people about public WiFi's.
One thing I would love to see in the future is the addition of LetsEncrypt support for major web servers like Nginx and Apache. I think this could go a long way. In the case of Apache it would be one of those "mod" type of packages. Someone feel free to let me know if this is already the case though, I would love to make note of it. Edit: Looks like Apache has one called 'md': https://httpd.apache.org/docs/trunk/mod/…