Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is This Site Secure?

kermitproject.org

Post reply on HN
Print view View original

41–50 of 51 posts

Re: Is This Site Secure?

#41

Post by mixedCase »

Wowfunhappy wrote: post #38
omk wrote: post #4

While at the begining I thought I sensed a bigger argument here, the further I read I am certain the author either prefers to discount MITM or lacks the understanding of the full scope of a MITM. I agree that there are other evils of the web but that does not mean we make trade-offs. The last paragraph goes as far as to say "The ad is not from the website; rather, it is inserted into the datastream — after it has lef…

I agree the author lost their argument partway through, and I would have made the point a bit differently. Broadcast TV and radio signals are not secure, and don't need to be. Their information is supposed to be available for everyone. If someone hijacks a radio station, the worst they can do is spread disinformation, and there are easier ways to accomplish that. Similarly, if all a website does is display text that…

> the worst they can do is spread disinformation

From a seemingly reputable source that people trust. Now take a 4chan prank like the home grown crystals and put it on a site like the NHS'. Grab one of the blogs of these people who post about https not being necessary and if they have any tutorial where they have terminal snippets to copy and paste you can own their reader's machines.

There are so, so many ways to do mischief if not outright ruin the lives of people in these websites that "just display text".

Re: Is This Site Secure?

#42

Post by yjftsjthsd-h »

moviuro wrote: post #29
lvh wrote: post #19

Earlier quoted context omitted.

Non-repudiation and authenticity are terms of art. By redefining them well outside of what everyone else means by those terms, I don't think you're helping discourse along. HTTPS _absolutely_ guarantees non-repudiation and authenticity. Casually dismissing the most important protocol on the Internet as giving you some "half-assed authenticity" is pretty silly, especially when one of your suggested alternatives is GPG…

> HTTPS _absolutely_ guarantees non-repudiation and authenticity No it doesn't. Correct HTTPS (i.e. connecting to a site with no errors) guarantees: * the entity that requested the certificate at the date it did had control over either the website or the DNS for a domain (if it is domain-squatting, it's even legal) * the Certificate Authority that did deliver that certificate did not suffer a breach; and otherwise fo…

.... you propose that HTTPS is insecure because someone could compromise the website, server, or CA? That precludes... pretty much everything from being "secure". If an attacker can compromise a website and CA, we should assume that they can compromise every other website and every software update server, thereby compromising >90% of computers on Earth inside a week, starting with anything connecting to the Microsoft and Ubuntu update servers.

Re: Is This Site Secure?

#43

Post by pixl97 »

Wowfunhappy wrote: post #38
omk wrote: post #4

While at the begining I thought I sensed a bigger argument here, the further I read I am certain the author either prefers to discount MITM or lacks the understanding of the full scope of a MITM. I agree that there are other evils of the web but that does not mean we make trade-offs. The last paragraph goes as far as to say "The ad is not from the website; rather, it is inserted into the datastream — after it has lef…

I agree the author lost their argument partway through, and I would have made the point a bit differently. Broadcast TV and radio signals are not secure, and don't need to be. Their information is supposed to be available for everyone. If someone hijacks a radio station, the worst they can do is spread disinformation, and there are easier ways to accomplish that. Similarly, if all a website does is display text that…

>Similarly, if all a website does is display text that is designed to be visible to everyone, a secure protocol is unnecessary

And how is the browser supposed to figure that out? If I can edit your data stream I can load up inline javascript that could add data submission in very hard to figure out ways.

Secure protocols dont just encrypt, they authenticate the originality of the data (at least from the https instance it was sent from).

Re: Is This Site Secure?

#44

Post by pixl97 »

kalleboo wrote: post #24

My own website is on HTTP because I mainly edit it and browse it on old computers where modern encryption is not available[0]. I assumed it would be the same reasoning here, as who else is using Kermit in 2020? Is anyone here using Kermit? Would love to know what for. Website seems to suggest it's for embedded systems, but I've only seen TFTP used in those cases. [0] http://www.kalleboo.com/retrotech/screenshots/powe…

Well, if someone was bored enough they could mitm your downloads and have fun with whatever computer they were loaded on. That said your not much of a target, but are still and easy one if someone chose to do so.

Re: Is This Site Secure?

#45

Post by pixl97 »

Kenji wrote: post #6

This site serves executables and script files via HTTP. Those potentially dangerous files are thus neither encrypted nor - and that's the bad part - authenticated, meaning that any man in the middle can inject content that infects your machine. I draw the line at this point. Serve with HTTP if you just have some text. Serve with HTTPS if you have logins, sensitive information or executables and scripts.

If I mitm you, your plain txt website now serves scripts.

That's what everybody seems to miss. I can change your content type headers online.

In theory the only way this would work is if browsers would not do javascript at all, or any other type of executable content on http sites.

Re: Is This Site Secure?

#46

Post by brazzy »

thenewnewguy wrote: post #9
bouke wrote: post #3

Another reminder that we should fight for encryption by default, without requiring a validated certificate. Just self-signed like most end-ro-end encryption schemes. For such sites, browsers could not display a padlock to differentiate them from validated certificates (DV/EV). Thus without any additional configuration, the data sent over those connections would be safe.

No they wouldn't, because this is trivially easy to MITM. The whole reason CAs exist is to verify the identity of the domain owner, because any random MITMer can claim to be yourbank.com and you can't prove it either way. Very technically this would be slightly better because it stops passive observers, but in reality I suspect it would be worse because tons of websites would use this broken by design solution and th…

>Imagine a world where I just installed an HTTP server and it asks me if I wanted to get a cert from Let's Encrypt (or any other ACME provider) and just did all the setup correctly for me.

That is exactly what Caddy https://caddyserver.com/ does - except it doesn't even ask. Automatically setting up HTTPS is the default, zero-extra-configuration behaviour.

Re: Is This Site Secure?

#47

Post by Wowfunhappy »

pixl97 wrote: post #43
Wowfunhappy wrote: post #38

Earlier quoted context omitted.

I agree the author lost their argument partway through, and I would have made the point a bit differently. Broadcast TV and radio signals are not secure, and don't need to be. Their information is supposed to be available for everyone. If someone hijacks a radio station, the worst they can do is spread disinformation, and there are easier ways to accomplish that. Similarly, if all a website does is display text that…

>Similarly, if all a website does is display text that is designed to be visible to everyone, a secure protocol is unnecessary And how is the browser supposed to figure that out? If I can edit your data stream I can load up inline javascript that could add data submission in very hard to figure out ways. Secure protocols dont just encrypt, they authenticate the originality of the data (at least from the https instanc…

I should have added Javascript to the list of things http sites shouldn’t be able to do without triggering a browser warning.

If it’s just a document/markup format, the warning strikes me as unnecessary. Mind, I realize that wouldn’t apply to many sites today.

Re: Is This Site Secure?

#48

Post by bulatb »

pixl97 wrote: post #45
Kenji wrote: post #6

This site serves executables and script files via HTTP. Those potentially dangerous files are thus neither encrypted nor - and that's the bad part - authenticated, meaning that any man in the middle can inject content that infects your machine. I draw the line at this point. Serve with HTTP if you just have some text. Serve with HTTPS if you have logins, sensitive information or executables and scripts.

If I mitm you, your plain txt website now serves scripts. That's what everybody seems to miss. I can change your content type headers online. In theory the only way this would work is if browsers would not do javascript at all, or any other type of executable content on http sites.

Or modify a TIFF or JPEG or whatever to attack the parser. That ancient system with no modern crypto that can only do HTTP is fully patched, right?

Re: Is This Site Secure?

#49

Post by Karunamon »

anderskaseorg wrote: post #17
moviuro wrote: post #10

Earlier quoted context omitted.

> How can I know if the site I see is REALLY your site without https? HTTPS has never been about non-repudiation or authenticity; it's always been about confidentiality. You get some half-assed "authenticity" if you didn't mistyped the domain, and your clock is correctly set, and the certificate authority wasn't compromised, and the web server wasn't compromised, etc. You should use GPG or signify if you need authent…

Confidentiality without authentication is not a thing. If I don't know that I'm talking to you, then I might be talking to a MITM attacker who's reading everything we're saying (and may or may not be altering it). It really is that simple.

Sure it is. Imagine a website with a self signed cert. You're over HTTPS and still encrypted, but it's you vs the (statistically unlikely) MITM entity holding that cert's private key, rather than you vs everyone in traceroute running wireshark. It's strictly better.

Granted this meant more before the days of LE, but you get what I'm saying.

Re: Is This Site Secure?

#50

Post by commandersaki »

lioeters wrote: post #28
omk wrote: post #4

While at the begining I thought I sensed a bigger argument here, the further I read I am certain the author either prefers to discount MITM or lacks the understanding of the full scope of a MITM. I agree that there are other evils of the web but that does not mean we make trade-offs. The last paragraph goes as far as to say "The ad is not from the website; rather, it is inserted into the datastream — after it has lef…

If unencrypted data in transit and an open man-in-the-middle attack vector are "definitely not a security risk", I cannot trust the author's concept of security, risk, or privacy.

Yet people use 3rd party VPNs that do this all the time in the guise of security & privacy.
Post reply on HN