4,333 reputation
1226
bio website apsillers.github.io
location United States
age 26
visits member for 2 years, 8 months
seen yesterday

"The problem, when solved, will be simple."

  Conway's Game of Life
  Click any cell to toggle

  Controls:
  Step! Random Noise
  Clear New Pattern
  View source


Nov
10
awarded  Mortarboard
Nov
10
revised How to be sure that downloaded file is correct?
added 43 characters in body
Nov
10
answered How to be sure that downloaded file is correct?
Nov
10
awarded  Nice Answer
Nov
10
comment JavaScript Injection using Man in the Middle Attack
@Curious I've edited to add one final attempt at explanation, where we consider a single flipped bit, changed by honest mistake by the ISP.
Nov
10
revised JavaScript Injection using Man in the Middle Attack
added 799 characters in body
Nov
10
revised JavaScript Injection using Man in the Middle Attack
deleted 1 character in body
Nov
10
comment JavaScript Injection using Man in the Middle Attack
@Curious Injection is done at the network layer, with possibly some changes to the application layer (e.g., modifying the Content-Length header to reflect the length of the modified document).
Nov
10
revised JavaScript Injection using Man in the Middle Attack
added 476 characters in body
Nov
10
comment JavaScript Injection using Man in the Middle Attack
@Curious I've edited my based on your comments. I think you believe that a modification requires some kind of HTTP redirect. This is not correct.
Nov
10
revised JavaScript Injection using Man in the Middle Attack
added 1456 characters in body
Nov
10
comment JavaScript Injection using Man in the Middle Attack
@Curious "Because the html file is already received.." -- we perform the modification on the HTML resource before the HTML resource is received. The ISP can modify any non-HTTPS traffic: HTML, JS, CSS, office documents, binary executable, etc., etc. There's no difference between modifying a JS file and modifying an HTML file. I don't entirely understand why you're treating the cases of a JS file and an HTML file differently. They're all insecure resources being processed by the ISP.
Nov
10
comment JavaScript Injection using Man in the Middle Attack
If the HTML page is protected by HTTPS, no. If the HTML page is not protected by HTTPS, yes. If the HTML page is not protected by HTTPS, the ISP can directly change anything about the page and can sniff credentials directly off the wire as in my first diagram. (If the log-in page is unsecured, but sends the credentials through a secure unsniffable channel, it's trivial to change the behavior of the unsecured page to use an insecure channel instead.)
Nov
10
revised JavaScript Injection using Man in the Middle Attack
added 73 characters in body
Nov
10
answered JavaScript Injection using Man in the Middle Attack
Nov
5
revised What are the dangers of allowing “less secure apps” to access my Google account?
added 104 characters in body
Nov
5
answered What are the dangers of allowing “less secure apps” to access my Google account?
Nov
3
revised How to prove to friend I have solution to puzzle (without revealing it)?
added 126 characters in body
Nov
3
revised Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
added 4 characters in body
Nov
3
revised How to prove to friend I have solution to puzzle (without revealing it)?
deleted 2 characters in body