81–90 of 98 posts
Earlier quoted context omitted.
You can always run browser in a vitrual machine. Or open it with a text browser like Lynx or Links. Or use wget to download the file and read in text editor.
But what if the page uses HTML5 audio to "jump the gap" and reprogram all nearby electronic devices to attack you on 1/1/2014!?
not positively surprisrd, more like dissapoined.
Does anyone have any details about how this was done? Was it a compromised admin account, a local root exploit, social engineering, etc? I'm eagerly awaiting the post-mortem.
No, and this is what makes it non-news. Especially since it links to the hacked webpage. Neither really Hacker nor News...
Sorry to prefer build things and creating value than destroy it.
I wonder why so many security guys are so condescending and contemptuous...
Earlier quoted context omitted.
It's necessary for HTTP requests. Are you being deliberately obtuse?
It doesn't work if the user hasn't visited the site before because the HSTS header can be stripped just as easily.
Also, you're forgetting about browsers that ship with lists of HSTS-enabled sites.
I tend not to click on links advertising pages that are hacked. You know, not that many zero days on Chrome, but still seems like a risky click, as they say.
$ curl www.openssl.org TurkGuvenligiTurkSec Was Here @turkguvenligi + we love openssl _
Earlier quoted context omitted.
$ curl www.openssl.org TurkGuvenligiTurkSec Was Here @turkguvenligi + we love openssl _
Oh those turk hackers. Remember the mid-2000s, when searching google dork on a certain public exploit, one would most certainly find lots of already defaced websites? Even on some forsaken lice breeding forum with 2 users, there would always be mad photoshop collage with star and crescent on dark background, and a message to those few poor visitors, who probably would not even comprehend what is going on. Anyway, wha…
Earlier quoted context omitted.
Which is, to say, 99.99% of people. Noone types " https://" or " http://"; 99% of people don't even know what https means. Us developers should know better and protect our users. It's our responsibility to make sure the default is secure.
But you expect 99% of all people are downloading vanilla OpenSSL libraries. Because that's a thing that everyone does.
Earlier quoted context omitted.
Oh those turk hackers. Remember the mid-2000s, when searching google dork on a certain public exploit, one would most certainly find lots of already defaced websites? Even on some forsaken lice breeding forum with 2 users, there would always be mad photoshop collage with star and crescent on dark background, and a message to those few poor visitors, who probably would not even comprehend what is going on. Anyway, wha…
Ever seen a graffiti of someones name you can't even decipher on the back of a trash can at the far off bus stop near the forest? It's kind of like that.
Earlier quoted context omitted.
Because it doesn't need it. Technically no website needs it. Only people who don't know how to type "https" need it.
Point is, I should not be able to access a plaintext version of a website hosting such cryptographically crucial software/information. It's obvious why it can be a grand target for Man in the Middle, defacement and worst of all integrity attacks. Apart from preventing many of the latter, implementing HSTS could have really mitigated the problem. Anyone who had already visited the site wouldn't see the defaced page. F…
I said this in a lower thread but I figured it's better up here. Why is there not a standard for links of this type in browsers. Eg OpenSSL That's a simple way to go but I really think it's as generally insecure as reading a signature form a url that is advertised by a website. It's also why I rarely bother. But if browsers were good about this then it could be done in a much better way which is to sign the applicati…
But that's if we're talking websites in general. For the specific use here, installing "trusted" software packages, far better solutions already exist and already protected the users of OpenSSL.