Re:Why Static Websites Need HTTPS
by dragonwriter on Tuesday August 28, 2018 @11:45AM
(#17859694)
> Just because you could modify page content does not mean you could transmit that content to an alternate location.
Yes, if I can masquerade as your domain, I can have the data transmitted back to the same server conducting the attack (which is the “same origin”), which can then send it anywhere else.
Re:Why Static Websites Need HTTPS
by austincheney on Tuesday August 28, 2018 @03:09PM
(#17861896)
> Yes, if I can masquerade as your domain
How would you do that? If you could do that you could also masquerade the HTTPS connection and simply run HTTPS at the spoofed server using the spoofed X.509 cert from the legitimate web server.
Re:Why Static Websites Need HTTPS
by icebraining on Tuesday August 28, 2018 @06:58PM
(#17863667)
You can't "spoof" a cert, that's its whole point. If you create a new, it won't have a valid signature, and if you copy the original, you won't have the associated private key to create valid responses.
Re:Why Static Websites Need HTTPS
by austincheney on Tuesday August 28, 2018 @08:17PM
(#17864089)
https://www.computerworld.com/article/2897815/microsoft-blac...
To be more clear a malicious website can rely on fraudulently issued certificates to validate a spoofed domain. This is a bad cert that appears to be valid and establishes the same level of trust. That is why revocation lists and OCSP are necessary.
That isn’t true either as TLS protects http headers in addition to the http body.
Modification of requested content does not void the same origin policy. Just because you could modify page content does not mean you could transmit that content to an alternate location.