Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free...
by jorl17 on Monday June 14, 2021 @05:51PM
(#27508779)
Most people have already answered you. The problem is anyone in the middle can hijack the page and put whatever they want there. See what I mentioned here in the past: https://news.ycombinator.com/item?id=25123366
Now imagine you combine MITM-ing someone with social engineering. You send them a legitimate inocuous link like http://my-bank.my-tld, but you are MITM-ing them and outright replace the content of the page with whatever you want. Yes, HSTS protects agains this example, but the problem still remains: whatever goes through HTTP can be manipulated and used for nefarious ends. It's kinda like walking around with a car door open waiting for someone to throw a bomb inside it.
Now imagine you combine MITM-ing someone with social engineering. You send them a legitimate inocuous link like http://my-bank.my-tld, but you are MITM-ing them and outright replace the content of the page with whatever you want. Yes, HSTS protects agains this example, but the problem still remains: whatever goes through HTTP can be manipulated and used for nefarious ends. It's kinda like walking around with a car door open waiting for someone to throw a bomb inside it.