News for hackers. Stuff that matters.
Re:Tell HN: 6.3% of HN top submissions in plain HTTP, more t... by JoshTriplett on Saturday July 11, 2020 @11:25AM (#23802829)
How much do you trust the "static content"? Are you going to trust another site more because of a link there? What about all the scripts and static content loaded by that site, or that that site could be made to load by tampering with its contents? Could that site be made to attack other sites using your browser (see https://en.wikipedia.org/wiki/Great_Cannon )? Could anyone learn something about you because of the site, or what pages you access and links you follow from the site? Could someone learn what https site you're likely to access, by knowing the http site you accessed, making traffic analysis easier?

MITM tampering might not just be from an ISP. It could be from public wifi, or from an exploited/infected router, or with some care perhaps from another person on the same network/wifi, or from an office, or from an entire country.

There are no comments on this comment yet.