The Bureau of Meteorology has form when it comes to computer security incidents[0].
[0] https://www.abc.net.au/news/2018-03-08/bureau-of-meteorology...
The Bureau of Meteorology website does not support connections via HTTPS
11–20 of 58 posts
Re: The Bureau of Meteorology website does not support connections via HTTPS
#12What practical difference does it make if I connect to an Australian weather forecast site via HTTP or HTTPS? Is the NZ secret police gonna MITM a rain forecast my way when it's actually gonna be a very sunny day?
It's just dangerous because any party on the way between wifi and the server can edit the content See: why are free proxies free https://blog.haschek.at/2013/05/why-free-proxies-are-free-js...
In the same way as walking to the bank is dangerous because any party on the way can rob you on the way?
I regularly visit: www.bom.gov.au//forecasts/.shtml
It either shows me the forecast or it doesn't.
To date it's always worked - if one day it doesn't I might have to look out of a window.
Re: The Bureau of Meteorology website does not support connections via HTTPS
#13I wonder if you could mitm an HSTS header.. short term dick move but might raise enough of a stink for it to be fixed..? I can only dream.
HSTS headers are only respected on HTTPS connections
Re: The Bureau of Meteorology website does not support connections via HTTPS
#14I remember seeing this yesterday when visiting the site. Wasn't sure if it'd always been like this, or if this was recent.
Re: The Bureau of Meteorology website does not support connections via HTTPS
#15I find intriguing their explanation about how to use their FTP service and why it’s not possible to access it with a modern browser.
Re: The Bureau of Meteorology website does not support connections via HTTPS
#16The Bureau of Meteorology has form when it comes to computer security incidents[0]. [0] https://www.abc.net.au/news/2018-03-08/bureau-of-meteorology...
Employees on the inside using the data cruncher to mine bitcoin isn't a HTTPS issue - given these chancers were caught it appears the BOFH functioned uncorrupted and reported their illicit cycles.
Re: The Bureau of Meteorology website does not support connections via HTTPS
#17Welcome to Australia. This has been an issue for years, and I don't know why.
The rationale, such as it is, is that BoM serves current and historic weather parameters for various parts of Australia and hasn't seen any need to ensure that be delivered in a secure manner to individual web users. There might be some hypothetical scenario from faking weather data and injecting it to fool the casual user but that seemingly hasn't come up in practice and so they don't fuss about it. On the flip side…
I think the more likely scenario for a MITM attack is to insert malicious scripts or links into the web page, not to fake weather data.
Re: The Bureau of Meteorology website does not support connections via HTTPS
#18It least someone had decided to have common sense.
Re: The Bureau of Meteorology website does not support connections via HTTPS
#19Controverse opinion: Why do I need https when looking for the weather forcast. Https is blindly thrown on everything. If the data is public and no login or personal/sensitive data is involved why do I need https?
Re: The Bureau of Meteorology website does not support connections via HTTPS
#20I remember seeing this yesterday when visiting the site. Wasn't sure if it'd always been like this, or if this was recent.
Probably your browser trying HTTPS-first