61–70 of 117 posts
Earlier quoted context omitted.
This comments thread literally starts with someone who discovered their bank's app wasn't validating the certificate, though.
In that case it wouldn't be safe to use the app on a private network either.
Earlier quoted context omitted.
refresh my understanding, if i manually type "https" into the address bar, then i can't be MitM'ed through lack of HSTS, right?
correct, assuming you don't let yourself get tricked into trying without https.
> So when you visit HTTPS sites, anyone along the communication path... can see their domain names (e.g. wikipedia.org) and when you visit them. But these parties can’t see the pages you visit on those sites (e.g. wikipedia.org/controversial-topic), your login name, or messages you send. I believe this is the reason Turkey blocked the entirety of Wikipedia[0], which was recently lifted[1]. They wanted to block specif…
Am Turkish, and not really. There is no evidence of Turkey caring about what the individual citizens visit (except in case of a crime investigation etc.) Bans in Turkey works like this: Turkey sees something they don't like on the Internet, Turkey reaches the company / individuals behind it (they can be anywhere in the world) and tells them "take it down or we will block your access to Turkish citizens and you'll los…
Earlier quoted context omitted.
You could be. If you are, you’ll get a message that the very isn’t valid. Unless there’s an attack on cert providers or someone adds a cert to your device. The cert approach can be seen in some corporate environments.
> Unless there’s an attack on cert providers or someone adds a cert to your device. How does HSTS help with that?
Err, no it is not safe unless you trust the app you are running to validate the certificate chain. Not so long ago, I found out my bank's app didn't validate the cert and I could happily put a proxy and intercept all calls.
Earlier quoted context omitted.
What's the odds that the corporate network the developers are on does MITM https interception, and the only way they could get their app to work was to remove certificate validation
Very slim, as you can still verify the certificate chains up to a trusted root certificate and it’s trivial (and generally part of the enrollment process) to load the companies root CA on your device. We MITM and certificate validation works correctly.
Earlier quoted context omitted.
> Unless there’s an attack on cert providers or someone adds a cert to your device. How does HSTS help with that?
HSTS has a certificate pinning extension, but base HSTS wouldn't.
You mean HPKP? AFAIK it isn't an extension, but rather another feature. Also, it's deprecated at this point.
Err, no it is not safe unless you trust the app you are running to validate the certificate chain. Not so long ago, I found out my bank's app didn't validate the cert and I could happily put a proxy and intercept all calls.
I feel like this needs to be an OS-level requirement. All network comms should be encrypted and any unencrypted traffic needs to be allowed with a user opt-in.
Earlier quoted context omitted.
correct, assuming you don't let yourself get tricked into trying without https.
Which, if my experience pentesting is any indication, most people will.
Applications like Outlook will warn you about cert problems but still let you bypass them. This could be better on app side, but it’s a reality end users deal with. And when/if IT knows about it, it’s because the user complains that their laptop/Outlook is broken. The avg business user doesn't think about cert chains.