News for hackers. Stuff that matters.

A comment on MitM Attack against KeePass 2’s Update Check.

Re:MitM Attack against KeePass 2’s Update Check by jackson_1 on Wednesday June 01, 2016 @04:49PM (#11818039)
The indirect costs of switching to HTTPS (like lost advertisement revenue) make it a inviable solution

This doesn't entirely make sense. I'm sure it's possible to serve adverts on a HTTPS page, and let's encrypt is hardly expensive

[ Parent | on HN ]
Re:MitM Attack against KeePass 2’s Update Check by eightysix_four on Wednesday June 01, 2016 @05:09PM (#11818174)
> I'm sure it's possible to serve adverts on a HTTPS page

Yes, you can, but you lose a tremendous amount of ad revenue and a number of ad providers still don't support HTTPS.

[ Parent | on HN ]
Re:MitM Attack against KeePass 2’s Update Check by AjithAntony on Wednesday June 01, 2016 @05:18PM (#11818241)
Is this becuase all the third party assets and scripts would need to be HTTPS as well? If they weren't then you get that browser warning about mixed content?
[ Parent | on HN ]
Re:MitM Attack against KeePass 2’s Update Check by cortesoft on Wednesday June 01, 2016 @05:36PM (#11818399)
https://news.ycombinator.com/item?id=11803716

Too many ad buyers don't have https support, so the number of bidders for the ad space is lower, meaning a lower price per ad.

[ Parent | on HN ]