Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
lizizhikevich.github.io
Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
1–10 of 74 posts
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#2Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#3This is good right?
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#4This is good right?
Maybe not so great. I imagine a good portion of these are services being run with development configuration, which could indicate that people aren't running a more robust configuration with a reverse proxy on 443 pointing to 80 behind a firewall.
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#5> Services on unexpected ports are more likely to be insecure
than services on assigned ports.
That line really surprised me. I'd have thought that somebody who knows enough to move a frequently targeted service to a different port to avoid low effort attacks/scans would know enough to use other protections, then I saw it was partly because of cheap IoT devices that have zero issues violating specifications out of the box.
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#6Honestly I kind of dislike the security through scaring the userbase tactic. HTTPS is wonderful, but it is not needed in all situations. For your run of the mill static site, its essentially pointless.
Sure, if you are dealing with money or customer data, use all the crypto you want. But I think people should respect tools should be applied where they are actually needed, not just arbitrarily. You dont need a bulletproof safe to guard a stick of gum. Think critically people.
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#7Honestly I kind of dislike the security through scaring the userbase tactic. HTTPS is wonderful, but it is not needed in all situations. For your run of the mill static site, its essentially pointless. Sure, if you are dealing with money or customer data, use all the crypto you want. But I think people should respect tools should be applied where they are actually needed, not just arbitrarily. You dont need a bulletp…
I respectfully disagree that verifying your domain is pointless. Without proper verification, you leave yourself vulnerable to a range of risks, such as man-in-the-middle attacks and DNS spoofing. These attacks can allow bad actors to intercept your web traffic and inject malware into content or modify it. Recent security breaches have highlighted the importance of domain verification, and I believe that all users should take steps to verify their domains, such as implementing SSL/TLS certificates or using a domain verification service.
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#8Honestly I kind of dislike the security through scaring the userbase tactic. HTTPS is wonderful, but it is not needed in all situations. For your run of the mill static site, its essentially pointless. Sure, if you are dealing with money or customer data, use all the crypto you want. But I think people should respect tools should be applied where they are actually needed, not just arbitrarily. You dont need a bulletp…
Which part of confidentiality/integrity/authenticity is unnecessary for a static site?
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#9Honestly I kind of dislike the security through scaring the userbase tactic. HTTPS is wonderful, but it is not needed in all situations. For your run of the mill static site, its essentially pointless. Sure, if you are dealing with money or customer data, use all the crypto you want. But I think people should respect tools should be applied where they are actually needed, not just arbitrarily. You dont need a bulletp…
I respectfully disagree that verifying your domain is pointless. Without proper verification, you leave yourself vulnerable to a range of risks, such as man-in-the-middle attacks and DNS spoofing. These attacks can allow bad actors to intercept your web traffic and inject malware into content or modify it. Recent security breaches have highlighted the importance of domain verification, and I believe that all users sh…
And additionally I would't want anyone on my network path to be able to read what data I exchange - even if it is a static site.
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#10Earlier quoted context omitted.
I respectfully disagree that verifying your domain is pointless. Without proper verification, you leave yourself vulnerable to a range of risks, such as man-in-the-middle attacks and DNS spoofing. These attacks can allow bad actors to intercept your web traffic and inject malware into content or modify it. Recent security breaches have highlighted the importance of domain verification, and I believe that all users sh…
And additionally I would't want anyone on my network path to be able to read what data I exchange - even if it is a static site.
That’s a valid concern too. For a lot of static sites I visit, I don’t particularly care if people know I visit them as I live a boring life. My primary concern is malware and verifying identity.