Is This Site Secure?
kermitproject.org
Is This Site Secure?
1–10 of 51 posts
Re: Is This Site Secure?
#2Seriously? And what about Man-in-the-middle attacks?
I mean come on, there are files to download from that website? How can I know if the site I see is REALLY your site without https?
Really, I don't know why you just don't obtain a Let's Encrypt certificate, it's not difficult anymore...
Re: Is This Site Secure?
#3Another reminder that we should fight for encryption by default, without requiring a validated certificate. Just self-signed like most end-ro-end encryption schemes. For such sites, browsers could not display a padlock to differentiate them from validated certificates (DV/EV).
Thus without any additional configuration, the data sent over those connections would be safe.
Re: Is This Site Secure?
#4While at the begining I thought I sensed a bigger argument here, the further I read I am certain the author either prefers to discount MITM or lacks the understanding of the full scope of a MITM. I agree that there are other evils of the web but that does not mean we make trade-offs.
The last paragraph goes as far as to say
"The ad is not from the website; rather, it is inserted into the datastream — after it has left the Web server as it streams the web page to your computer — by your own Internet Service Provider (Optimum in my case). This is called "watermarking", a variation on the classic Man-in-the-Middle attack. So far it's an infrequent occurrence and not a major problem, and in any case definitely not a security risk, just Yet Another Annoyance"
You let go of your user's privacy and security the moment you make such a trade-off calling it just another annoyance. While visiting this site a MITM could possibly inject a malicius javascript or sticky cookie. How is that just an annoyance? Protecting this is the biggest selling point of HTTPS.
Re: Is This Site Secure?
#5Sounds like the author doesn't know about Let's Encrypt. Pretty simple and free way to secure your site with no disadvantage and it kills OPs primary argument.
Re: Is This Site Secure?
#6This site serves executables and script files via HTTP. Those potentially dangerous files are thus neither encrypted nor - and that's the bad part - authenticated, meaning that any man in the middle can inject content that infects your machine.
I draw the line at this point. Serve with HTTP if you just have some text. Serve with HTTPS if you have logins, sensitive information or executables and scripts.
Re: Is This Site Secure?
#7Yes, the phrasing "secure/insecure" is an abbreviation that loses a lot of meaning, but to dismiss TLS based on that seems dishonest. Even if you don't care about your user's privacy, don't you at least want the authenticity and integrity TLS provides? The author doesn't only acknowledge MitM, but even show an example where they themselves are MitM'd.
Those same anti-TLS arguments have been rehashed often enough by now.
Re: Is This Site Secure?
#8> So Internet security has become a big and ongoing business, which has to be paid for. If I want to have a secure E-commerce site so I can make money, I have buy security services on top of the basic web services: an HTTPS address instead of the original HTTP: — OK, fair enough.
Has this guy not heard of Let's Encrypt? HTTPS certificates are literally free. I was astounded when I got to the end of the article and saw it was published in 2020 and not 2015.
Re: Is This Site Secure?
#9Another reminder that we should fight for encryption by default, without requiring a validated certificate. Just self-signed like most end-ro-end encryption schemes. For such sites, browsers could not display a padlock to differentiate them from validated certificates (DV/EV). Thus without any additional configuration, the data sent over those connections would be safe.
No they wouldn't, because this is trivially easy to MITM. The whole reason CAs exist is to verify the identity of the domain owner, because any random MITMer can claim to be yourbank.com and you can't prove it either way.
Very technically this would be slightly better because it stops passive observers, but in reality I suspect it would be worse because tons of websites would use this broken by design solution and think they were perfectly secure because encryption.
What we really need is to stop making HTTPS so hard to setup. It has gotten better in the last 5-10 years, but you still have to do this whole rigamarole with Apache2/nginx to disable weak cipher suites, setup all the right TLS parameters, etc because the default configuration is so bad. Imagine a world where I just installed an HTTP server and it asks me if I wanted to get a cert from Let's Encrypt (or any other ACME provider) and just did all the setup correctly for me.
Re: Is This Site Secure?
#10Seriously? And what about Man-in-the-middle attacks? I mean come on, there are files to download from that website? How can I know if the site I see is REALLY your site without https? Really, I don't know why you just don't obtain a Let's Encrypt certificate, it's not difficult anymore...
> How can I know if the site I see is REALLY your site without https?
HTTPS has never been about non-repudiation or authenticity; it's always been about confidentiality. You get some half-assed "authenticity" if you didn't mistyped the domain, and your clock is correctly set, and the certificate authority wasn't compromised, and the web server wasn't compromised, etc.
You should use GPG or signify if you need authenticity.
HTTPS just prevents injection and monitoring, a bit (see SNI, sniffing downloaded sizes, etc.).