Re:Show HN: Curl https://ec2.shop
by saurik on Tuesday June 30, 2020 @07:24AM
(#23688957)
For HTTPS to truly be meaningful we need to stop supporting HTTP as an on-ramp, to prevent people from just hijacking that initial unencrypted connection and sending anything they want.
[ Parent
| on HN ]
If you MITM and the user agent send an HTTP request for ec2.shop it does not matter whether the webserver supports HTTP or not, you can send a fake HTTP response either way.
That was the GPs point.
Re:Show HN: Curl https://ec2.shop
by mschuster91 on Tuesday June 30, 2020 @07:35AM
(#23689019)
Anyone who likes to prevent that can submit their site to the HSTS preload list. Chrome, Firefox and Edge use a shared one, the only two relevant other agents (Safari and curl) unfortunately don't though.
This is about curl though.
(speaking only for myself, not my employer)
I truly do not care if someone goes through the effort to MITM my curl of ec2.shop to inject fake prices or something like that.
There's nothing here that's going to be executed, it'll just be printed or grepped.
In theory you could exploit a 0 day in curl or my terminal or something like that, but I think if you truly think about the risks and tradeoffs here it's really not worth worrying about.
If curl had an hsts list to make this irrelevant that'd also be cool.