Tag Info

Hot answers tagged

68

The issue you're dealing with, here, is that if you decide not to encrypt a connection, you're making assumptions regarding the sensitivity of the data that goes over that connection. Unfortunately, it is impossible to properly make that assumption because: You might not have fully understood all the implication of the data (for instance, if Twitter ...


53

Encryption is not just about preventing eavesdroppers from reading data, it also prevents them from changing it. Flipping images on webpages upside down is an amusing prank to play on housemates but a malicious person could inject ads, or harmful code (Java, Javascript, Flash etc.) into your webpages without you realizing it. ...


32

You shouldn't really be worrying about this, the certificate contains only your public key, which is supposed to be public anyway. The only issue is the privacy concern of giving away the information in your certificate to any site that asks for it. Summary of the issue: The BBC weather page has a request to http://www.live.bbc.co.uk. HTTPS Everywhere is ...


27

In addition to the other good answers I would add that HTTPS ensures that when I think I'm reading bbc.com, I really am reading the content provided by bbc.com, not a hostile third-party who wants to fool me. Some news sites still present facts. People make decisions based on those facts -- decisions that have real-world consequences.


11

One reason in general I would like to add to the above answers is that even though you might not be doing something highly illegal in a western country, you should not assume that the government is not interested in what you read. Reading the following might put you on a list: Classified, documents leaked by whistle-blowers that are technically illegal A ...


10

As a general rule, it's good policy to strongly encrypt all data travelling across public networks. The reason is that if only "sensitive" data is encrypted, it's very easy for eavesdroppers to target potentially useful data simply by looking for anything that's encrypted. However, if everything is encrypted by default then they have no idea what ...


8

I think that really depends on the extent of definition of "sensitive data." Passwords and credit card numbers is certainly one, but perhaps looking up on WebMD info about a rash, while a generally public info, may be something that you're sensitive about, and don't want employer or your ISP to know (employers' rights and use of work equipment arguments ...


3

Yes it can, for example using : Ajax A reference to an external JS or css file An iframe or even a HTTP 302 redirect. This can be used by online malware to generate trafic for a DDoS Attack. Note, all those are used for legitimate purpose on many (most) websites, and hence do not imply a malicious behavior. In response to your edit: Yes, Ajax can do ...


3

Lots of news sites/newspaper sites provide accounts for additional functionality, subscriptions, etc. Forcing all web traffic through SSL reduces risk by making sure no one can ever log in on an unencrypted connection. Generally it's better to be safe than sorry. Nowadays HTTPS isn't as much as an overhead as it used to be, so why not encrypt all ...


3

It's a risk. XP has had enough holes over the years that it's hard to imagine there aren't some un-found holes in what remains. I'd recommend getting off XP if possible. If not, at least keep your ear to the ground. If a researcher finds more vulnerabilities that Microsoft is now unwilling to fix, you can bet they're going to hit the tech news media. ...


3

AppArmor or SELinux is probably a better solution than running Firefox as a different user. As you mention, running any kind of new software (including Mandatory Access Controls like these) potentially introduces new vulnerabilities (I'm fairly sure some have been found for SELinux) but I think most agree that the tradeoff is worth it.


2

Because you don't really know what can be infered from the data you emit. Since the whole NSA fuss surfaced in the news, lot of people think : "yeah, right, the NSA knows about the emails I send to my little cousin and my buying habits ? So what ?". Unfortunately we've entered the age of BigData and machine learning. This isn't just about crunching huge ...


2

Some background before I get to my answer: I find telephones fascinating and one of the most interesting phones I came across was the STU or Secure Telephony Unit which basically consisted of an a/d-d/a some audio codecs a digital encryption module and a modem and a bypass circuit all stuffed inside a telephone and was for the most part connected to ...


2

paranoid mode: install a different linux on a different machine, better, use a ro-mounted distro from cd like knoppix or so (virtualbox and kvm is your friend) run your browser from that other machine, using x-forwaring or x2go (free and good linux terminalserver/client-solution, works very nice on debian) harden this browser with noscript, adblockplus, ...


2

Have you thought about using something like Tails(https://tails.boum.org/)? As was suggested above you could use it with a Vm, but based on what it is fundamentally for you wouldn't need to keep an instance on your machine for it. There are also things like sandfox(http://igurublog.wordpress.com/downloads/script-sandfox/) that allow you to run firefox in a ...


2

The advice is usually in the context of avoiding phishing links: Don't click on links in emails! Bookmark your banking websites and always use the bookmark! I think using browsing history as a similar safeguard is probably fine also (within the parameters you described), as long as you've never clicked on a malicious link in the past. However, it's ...


2

I think I know what's happening with you. Actually, that's exactly what I do with the image in my "about me" section in my StackExchange profiles. It's a .php file that grabs some information about the visitor (IP address, browser type, whether the visitor made the smiley happy or not, etc.*). I simply rewrote the URL to show two different images that are in ...


2

Although running Google chrome on top of Windows XP seems secure but the reason it isn't is that exploiting vulnerabilities on Windows XP is easy (many orders of magnitude) compared to Windows 7. Windows XP is lacking common memory corruption protections such as DEP and ASLR. This means that a vulnerability that might be just a denial of service for the ...


2

One point that often gets missed in this discussion is the fact that SSL also encrypts the page URL that you use when accessing a website. If someone were eavesdropping on your connection, (NSA?) and you were visiting a site that wasn't provided over SSL, someone could see which pages you access and build a profile around you based on your browsing habits. ...


1

this approach is already found in various frameworks and works (more or less) against basic attack-patterns. another, more elegant way is to use CSP, but you have some requirements when using this approach (no inline js/styles etc) the problem is, from defender-pov, an attacker might have other points), nasty stuff like encoding, nullbytes and different ...


1

This is a moving target, as there is a cat-and-mouse game as attackers discover new techniques and browsers implement new defences. In general, JavaScript: can access config information about your browser and plugins. The site you linked seems to be a good summary of the current techniques. cannot access your local files, at least, unless you explicitly ...


1

Good Question. TACK is a "dynamic pinning" solution to the broken Certificate Authority model we all depend on today. A competitor is Google's Certificate Transparency (CT). Status of TACK is No browsers currently support it. There are no browser extensions to enable it. The last posting from the developers (January, 2014) is that it is entirely up ...


1

You are on the right track realizing that the Xclient (in this case Firefox) will not be able to access an Xserver running under a different user (by default). The simplest solution would be to ssh -X webuser@localhost firefox (note I would explicitly NOT use the 'nobody' account - this should not be used for this purpose) - which automatically deals with ...


1

The certificate is not necessarily fraudulent (though it does expire on the 28th of March) as much as it is that the name being used to access the resource doesn't match what is on the certificate. It's common for companies to have aliases or CNAMES for services/hosts. The problem is that unless you generate a UCG or SANS cert to handle all the names then ...


1

THE THREAD-STARTER WROTE: But what if I'm just reading a news site? Everyone has access to that, it's all over newspapers even. What's the point of encrypting such easily accessible information? MY RESPONSE: Yes, everything on the news site is public; but would you feel comfortable with someone standing over your shoulder while your with your computer at a ...


1

All the main points have been covered but I thought it's worth covering this particular scenario: It was/is popular to encrypt a login page, then allow the authenticated user to continue browsing the site on an unencrypted connection (to save CPU cycles on the server). This seemingly efficient and parsimonious use of encryption is actually next to useless. ...


1

The theory, as exposed in the standard is that: server_version This field will contain the lower of that suggested by the client in the client hello and the highest supported by the server. In the ClientHello message, the client announces a single version, and this means "I support all versions up to that version". For instance, if the client says ...



Only top voted, non community-wiki answers of a minimum length are eligible