Supporting Let’s Encrypt, the nonprofit making HTTPS free for all

Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by shard on Monday June 14, 2021 @04:36PM (#27507971)

I had the same feeling as you recently, until I read a site posted here a few weeks ago. I can't find it now, but it was a personal page where someone described in increasing levels of severity what can be done over an unsecured HTTP connection even if there is no private data transmitted over it. Can someone help?

Because unencrypted HTTP allows attackers to MITM the traffic, they can do things like put ads on your site, inject malware or bitcoin miners, or just replace your site completely. None of those affect you, the site owner, directly, but ìt subverts the purpose of your site and lowers the value and trustworthiness of your site to your visitors.

[ Parent | on HN ]

Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by bombcar on Monday June 14, 2021 @05:40PM (#27508673)

Most anyone who is in a position to reliably MITM an HTTP site would also be in a position to install a certificate source (either as part of a “install this to access the web” program or similar).

It’s a necessary level of defense but it is NOT sufficient- especially if you never check certificates.

[ Parent | on HN ]

Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by moosingin3space on Monday June 14, 2021 @07:08PM (#27509513)

I highly recommend you do a search for Firesheep - the tool that really started the push for HTTPS everywhere. You're right that a malicious network operator would be in a position to request users install root certs, but the problems with plaintext HTTP are deeper than just that.

[ Parent | on HN ]

Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by jlokier on Monday June 14, 2021 @07:06PM (#27509493)

Not really. In my experience it's always been an ISP that modified the HTTP in transit (to add their own advertising and analytics JavaScript inline), and the ISP didn't have the ability to install a certificate source.

[ Parent | on HN ]

Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by dvfjsdhgfv on Monday June 14, 2021 @05:33PM (#27508582)

Frankly, I feel it's very good, because at this point you notice your network has been hijacked and this is the first step to solve the problem. Patching it with HTTPS (especially without HSTS) won't solve the problem, it will just make it more difficult to discover by an unsuspecting user.

[ Parent | on HN ]