Re:Why Static Websites Need HTTPS
by austincheney on Tuesday August 28, 2018 @08:49PM
(#17864265)
Yes, but the comment I replied to mentioned sending compromised data to a browser and then sending user data from the browser to an untrusted third party. The browser will not typically allow that due to same origin policy and certainly not if content security policy is applied.
[ Parent
| on HN ]
Re:Why Static Websites Need HTTPS
by icebraining on Wednesday August 29, 2018 @03:00AM
(#17866263)
You keep saying the thing about same-origin; I wonder how you think Google Analytics and similar services work, if sites can't send data to external services.
CSP headers won't ever reach the browser if the attacker has MITM, so they are irrelevant.
Re:Why Static Websites Need HTTPS
by austincheney on Wednesday August 29, 2018 @08:25AM
(#17867657)
They work the same way in HTTPS as they do in HTTP. Same origin applies to the domain of asset reference. If you have CSP in place you must specify an exception for GA or it won't work.
If the attacker has MITM capabilities they can redirect the page to an untrusted location and bypass the valid server completely. MITM isn't typically limited to layer 7 unless the goal is to stand in the encrypted tunnel.