News for hackers. Stuff that matters.

A comment on Why Static Websites Need HTTPS.

Re:Why Static Websites Need HTTPS by Qub3d on Tuesday August 28, 2018 @10:34AM (#17859058)
I'm going to sorta break the prime directive and link the n-gate rebuttal to these articles: http://archive.fo/xcQ5j

Its a bit heavy-handed, but it does bring up a good point: A lot of this argument for HTTPS-by-default is all on top of assumptions about who is responsible for data security. We're doing a lot and things are improving, but the general public still are all yelling at websites for misusing data that we willingly gave over in the first place [0].

[0]:https://xkcd.com/743/

[ Parent | on HN ]
Re:Why Static Websites Need HTTPS by mo3gut on Tuesday August 28, 2018 @01:39PM (#17860916)
> assumptions about who is responsible for data security.

The chief assumption appears to be "anyone but the browser vendors". Let us consult the article:

  BeEF
  This, to me, was the most impactful demo
Quite the endorsement. So what's BeEF's angle?

"...examines exploitability within the context of the one open door: the web browser."

There could hardly be a clearer expression of contempt for the browser vendors' offerings. But remember, the "open door" is nothing to do with them, it's all your fault for not serving via HTTPS.

Welcome to Clown World.

[ Parent | on HN ]
Re:Why Static Websites Need HTTPS by pixl97 on Tuesday August 28, 2018 @02:07PM (#17861216)
Eh, there are two execution contexts here.

1. The web browser executing the injected data stream it receives from the remote computer.

2. Your brain interpreting 'non-executable' instructions as received from your browser.

Browser security has nothing to do with me going to 'xyz.com', which is the trusted website for xyz company, and being fed a MiTM telling me to go to a bad phone number for support.

[ Parent | on HN ]
Re:Why Static Websites Need HTTPS by msla on Wednesday August 29, 2018 @11:31AM (#17868990)
The fact that site gets "erased" partway down, as if attacked by an evil MiTM, proves it's not serious and is, in fact, arguing for HTTPS.
[ Parent | on HN ]