Fighting cryptojacking and doing good things with content security policies

Re:Fighting cryptojacking and doing good things with content... by walrus01 on Thursday April 01, 2021 @12:44AM (#26656757)

What's interesting is that as he points out in the part about the mikrotik routers doing mitm on http traffic, lots of websites out there are not serving the .js, they are just http only sites which are vulnerable. Any user inside the border of one of those hacked mikrotiks requesting any non https page will get the .js from any site.

[ Parent | on HN ]

Re:Fighting cryptojacking and doing good things with content... by mjgs on Thursday April 01, 2021 @01:08AM (#26656862)

You’re right, it’s the end user that gets screwed either way, not the website.

Could happen to anyone on http, there’s just no way to know if you’ll be routed through a hacker router.

Even with https there’s no way to know ahead of time that the site isn’t adding the malicious js, though probably will happen less often than on http.

In a future AR/VR world this is the sort of problem that could get quite horrible.

You really would not want a cryptojacked-sites-all-the-way-down situation to develop.

[ Parent | on HN ]

Re:Fighting cryptojacking and doing good things with content... by walrus01 on Thursday April 01, 2021 @01:20AM (#26656915)

From an ISP perspective it's an unfortunate side effect of a race to the bottom in pricing and network equipment in the developing world. And cargo cult network engineering where people know just enough to be dangerous, copying and pasting templates of bgp configurations into $800 mikrotiks and calling themselves an ISP.

[ Parent | on HN ]

Re:Fighting cryptojacking and doing good things with content... by mjgs on Thursday April 01, 2021 @02:00AM (#26657097)

I’m not so worried about the networking, it happens anyway even without the dodgy networking.

It’s the wasted resources that worry me.

[ Parent | on HN ]