6 ms·
It would make sense to add HTTPS to your website if you are promoting security and privacy....
by dlapiduz 11y ago
It would make sense to add HTTPS to your website if you are promoting security and privacy....
- Touche 11y agoWhy, the only thing I see on the page that could be compromised is the mailto: link.
- r1ch 11y agoCompromising a page doesn't necessarily have to alter existing content. It would be easy to add a "Download Preview Build" link pointing to a trojan, add links to a fake kickstarter, etc.
- giancarlostoro 11y agoThat sounds like altering existing content by adding new content btw.
- nitrogen 11y agoYes, a MITM can do that.
- jessaustin 11y agoAnd could still do the exact same thing if they had TLS: get the page, add crap, and serve the result (albeit without TLS).
- 3pt14159 11y agoYou know, I've never really realized that before. It's actually a pretty huge security hole for average users, no? There should be a way to explicitly forbid non-encrypted connections on a DNS level.
- lfowles 11y agoThat's roughly the purpose of HSTS, but you need to have visited the site at least once first (or in the case of popular sites, HSTS status of a site is shipped with the browser.)
- schoen 11y agoPeople who are encountering this for the first time might want to look at http://www.thoughtcrime.org/software/sslstrip/ http://www.thoughtcrime.org/software/sslstrip/ for some of the motivation!
- vacri 11y agoA technical user could reasonably be expected to look for https before downloading 'preview build' or something equally payload-ey. Then sigh and download PuTTY anyway...
- chinathrow 11y agoIt's information leakage at its finest.
- sp332 11y agoHTTPS still leaks the domain name, so that wouldn't help too much. (Unless you meant some other information?)