3 added 182 characters in body
source | link

It's because computers we own do many things at the same time.

If you just connect to your bank website in incognito mode, verify that your are using HTTPS connection and the certificate the website is using was issued by trusted party to the bank you are safe.

However regular user could fail at any of these steps. He for sure does not understand the meaning of https, so could be tricked into using http to connect to some MiTM website that looks like his bank. He could have outdated browser with some old certificate that was stolen. His system could be already compromised and contain false certificates.

There are many other things that could go wrong. You have many application installed on your device, you don't know how do they exchange information with remote servers. You don't know what information are actively being sent. You can probably trust you bank is up to date with security trends, but what about other websites? Security may not be their top concern, how many passwords were stored somewhere in a plain text and leaked? Maybe some application performs update in a background. How can you know if it is doing that in a secure way and the update is signed? Maybe their certificate leaked. You don't know.

A regular user could also download some application from the internet over http, which instead could be an injected malware. He then opens the file prompted to give admin rights and whole system is compromised.

There could be some 0-day vulnerability in your browser, of course you think you are visiting only trusted websites so you are safe, but you can be redirected to a website with exploit.

What about if the time of your trip will leak over http? Some people maybe interested into knowing when your house is empty. Is this extreme case?

It's because computers we own do many things at the same time.

If you just connect to your bank website in incognito mode, verify that your are using HTTPS connection and the certificate the website is using was issued by trusted party to the bank you are safe.

However regular user could fail at any of these steps. He for sure does not understand the meaning of https, so could be tricked into using http to connect to some MiTM website that looks like his bank. He could have outdated browser with some old certificate that was stolen. His system could be already compromised and contain false certificates.

There are many other things that could go wrong. You have many application installed on your device, you don't know how do they exchange information with remote servers. You don't know what information are actively being sent. You can probably trust you bank is up to date with security trends, but what about other websites? Security may not be their top concern, how many passwords were stored somewhere in a plain text and leaked?

A regular user could also download some application from the internet over http, which instead could be an injected malware. He then opens the file prompted to give admin rights and whole system is compromised.

There could be some 0-day vulnerability in your browser, of course you think you are visiting only trusted websites so you are safe, but you can be redirected to a website with exploit.

What about if the time of your trip will leak over http? Some people maybe interested into knowing when your house is empty. Is this extreme case?

It's because computers we own do many things at the same time.

If you just connect to your bank website in incognito mode, verify that your are using HTTPS connection and the certificate the website is using was issued by trusted party to the bank you are safe.

However regular user could fail at any of these steps. He for sure does not understand the meaning of https, so could be tricked into using http to connect to some MiTM website that looks like his bank. He could have outdated browser with some old certificate that was stolen. His system could be already compromised and contain false certificates.

There are many other things that could go wrong. You have many application installed on your device, you don't know how do they exchange information with remote servers. You don't know what information are actively being sent. You can probably trust you bank is up to date with security trends, but what about other websites? Security may not be their top concern, how many passwords were stored somewhere in a plain text and leaked? Maybe some application performs update in a background. How can you know if it is doing that in a secure way and the update is signed? Maybe their certificate leaked. You don't know.

A regular user could also download some application from the internet over http, which instead could be an injected malware. He then opens the file prompted to give admin rights and whole system is compromised.

There could be some 0-day vulnerability in your browser, of course you think you are visiting only trusted websites so you are safe, but you can be redirected to a website with exploit.

What about if the time of your trip will leak over http? Some people maybe interested into knowing when your house is empty. Is this extreme case?

2 added 18 characters in body
source | link

It's because computers we own do many things at the same time.

If you just connect to your bank website in incognito mode, verify that your are using HTTPS connection and the certificate the website is using was issued by trusted party to the bank you are safe.

However regular user could fail at any of these steps. He for sure does not understand the meaning of https, so could be tricked into using http to connect to some MiTM website that looks like his bank. He could have outdated browser with some old certificate that was stolen. His system could be already compromised and contain false certificates.

There are many other things that could go wrong. You have many application installed on your device, you don't know how do they exchange information with remote servers. You don't know what information are actively being sent. You can probably trust you bank is up to date with security trends, but what about other websites? Security may not be their top concern, how many passwords were stored somewhere in a plain text and leaked?

A regular user could also download some application from the internet over http, which instead could be an injected malware. He then opens the file prompted to give admin rights and whole system is compromised.

There could be some 0-day vulnerability in your browser, of course you think you are visiting only trusted websites so you are safe, but you can be redirected to thea website with exploit.

What about if the time of your trip will leak over http? Some people maybe interested into knowing when youyour house is empty. Is this extreme case?

It's because computers we own do many things at the same time.

If you just connect to your bank website, verify that your are using HTTPS connection and the certificate the website is using was issued by trusted party to the bank you are safe.

However regular user could fail at any of these steps. He for sure does not understand the meaning of https, so could be tricked into using http to connect to some MiTM website that looks like his bank. He could have outdated browser with some old certificate that was stolen. His system could be already compromised and contain false certificates.

There are many other things that could go wrong. You have many application installed on your device, you don't know how do they exchange information with remote servers. You don't know what information are actively being sent. You can probably trust you bank is up to date with security trends, but what about other websites? Security may not be their top concern, how many passwords were stored somewhere in a plain text and leaked?

A regular user could also download some application from the internet over http, which instead could be an injected malware. He then opens the file prompted to give admin rights and whole system is compromised.

There could be some 0-day vulnerability in your browser, of course you think you are visiting only trusted websites so you are safe, but you can be redirected to the website with exploit.

What about if the time of your trip will leak over http? Some people maybe interested into knowing when you house is empty. Is this extreme case?

It's because computers we own do many things at the same time.

If you just connect to your bank website in incognito mode, verify that your are using HTTPS connection and the certificate the website is using was issued by trusted party to the bank you are safe.

However regular user could fail at any of these steps. He for sure does not understand the meaning of https, so could be tricked into using http to connect to some MiTM website that looks like his bank. He could have outdated browser with some old certificate that was stolen. His system could be already compromised and contain false certificates.

There are many other things that could go wrong. You have many application installed on your device, you don't know how do they exchange information with remote servers. You don't know what information are actively being sent. You can probably trust you bank is up to date with security trends, but what about other websites? Security may not be their top concern, how many passwords were stored somewhere in a plain text and leaked?

A regular user could also download some application from the internet over http, which instead could be an injected malware. He then opens the file prompted to give admin rights and whole system is compromised.

There could be some 0-day vulnerability in your browser, of course you think you are visiting only trusted websites so you are safe, but you can be redirected to a website with exploit.

What about if the time of your trip will leak over http? Some people maybe interested into knowing when your house is empty. Is this extreme case?

1
source | link

It's because computers we own do many things at the same time.

If you just connect to your bank website, verify that your are using HTTPS connection and the certificate the website is using was issued by trusted party to the bank you are safe.

However regular user could fail at any of these steps. He for sure does not understand the meaning of https, so could be tricked into using http to connect to some MiTM website that looks like his bank. He could have outdated browser with some old certificate that was stolen. His system could be already compromised and contain false certificates.

There are many other things that could go wrong. You have many application installed on your device, you don't know how do they exchange information with remote servers. You don't know what information are actively being sent. You can probably trust you bank is up to date with security trends, but what about other websites? Security may not be their top concern, how many passwords were stored somewhere in a plain text and leaked?

A regular user could also download some application from the internet over http, which instead could be an injected malware. He then opens the file prompted to give admin rights and whole system is compromised.

There could be some 0-day vulnerability in your browser, of course you think you are visiting only trusted websites so you are safe, but you can be redirected to the website with exploit.

What about if the time of your trip will leak over http? Some people maybe interested into knowing when you house is empty. Is this extreme case?