Here’s why we keep getting hacked – clear and present Billabong failures

Re:Here’s why we keep getting hacked – clear and present Bil... by vampirechicken on Tuesday July 24, 2012 @11:22AM (#4286049)

I can use LWP, Curl, Wget, etc. to submit a form over https to any HTTP server.

I am unaware of any protocol semantics that allow an HTTP server to determine how the submitted data was marshaled.

[ Parent | on HN ]

Re:Here’s why we keep getting hacked – clear and present Bil... by TazeTSchnitzel on Tuesday July 24, 2012 @11:26AM (#4286061)

Eh? I think you misunderstand me.

As Facebook learned, submitting to an HTTPS server isn't enough, the form must be too. Otherwise you can be man-in-the-middle attacked on the form page. Better yet, serve everything over HTTPS, so people can't change the links.

[ Parent | on HN ]

Re:Here’s why we keep getting hacked – clear and present Bil... by vampirechicken on Wednesday August 01, 2012 @02:45PM (#4324826)

So what what you mean to say is that if you don't use SSL all the time, somebody with a sniffer can pull you session ID out of the air and impersonate you by hijacking your session.

That's VERY different for a man-in-the-middle attack.

Do you think the coffee shop should have offered encrypted wifi?

[ Parent | on HN ]

Re:Here’s why we keep getting hacked – clear and present Bil... by vampirechicken on Monday July 30, 2012 @01:43PM (#4313582)

Google 'ssl man in the middle attacks' and you'll see that SSL does not prevent man-in-the-middle attacks.

[ Parent | on HN ]