0

The websites that serve files over https, can it be considered overkill? or is it a best practice everyone has to follow?

The downside to serving files over HTTPS is that you will lose the caching as far as I've read. But apart from that, the attack scenario I have in mind is either someone accessing the server and manipulating the file which HTTPS doesn't help much to prevent, or someone replacing the file with a malicious one over the air in a MITM scenario which HTTPS can mitigate.

How probable is it to have a MITM scenario where the client goes about downloading a specific executable?

Are there other attacks which HTTPS can prevent?

One other solution some websites use is that they put the checksum of the executable on the website, but most users won't bother to check that or won't even know how to do it.

So to sum it up, is there much gain in serving files over HTTPS (whether a checksum is put on the website along with the file or not) and can serving files over HTTP be considered a huge security flaw?

(The exact scenario in my mind is that a bank is letting the customers download its mobile banking app via its website over http)

  • “The downside to serving files over HTTPS is that you will lose the caching as far as I've read.” That doesn’t sound right. Plus, in this situation – downloads of large executables rather than, say, website resources – the files aren’t often in browser cache anyway. (If this is caching at a different level, well, CloudFlare MITMs HTTPS connections just fine, and proxy caching is exactly the type of MITM you would want to avoid for a secure download, because someone could very easily just overwrite the file on most caches, among other things.) – Ry- Jan 30 '16 at 9:08
  • @RyanO'Hara I was referring to (security.stackexchange.com/a/18861/81374) which says: "HTTPS uses more bandwidth. The overhead per download is minimal if you don't take caching into account. This is the spherical cow of “HTTPS doesn't cost more”: if you use SSL, you can't cache data. Application downloads are cachable in the extreme: they're large files that many people download." – Silverfox Jan 30 '16 at 9:21
  • I would ask the answerer about that; it doesn’t seem to be backed up by anything. – Ry- Jan 30 '16 at 9:25
  • While I do not think this is applicable to your exact scenario, the threat of getting your files modified in transit is real, especially if you expect some of your users to be using anonymisers/VPNs (see leviathansecurity.com/blog/the-case-of-the-modified-binaries for a specific example involving Tor). – Nasrus Jan 30 '16 at 14:09
1

It highly depends on the kind of data you offer for downloading and what kind of trust relationship there is between the user and your site. Just take a closer look at what HTTPS offers and what not:

  • It offers some kind of privacy through encryption. If the data are already encrypted by other means then you don't need another layer of encryption. If the data are for public consumption anyway you also don't need to hide the data using encryption.
  • It offers tamper resistance. If the data are signed somehow and the signature gets definitely checked then you don't need to add another layer for tamper resistance. Often firmware or software updates are already protected this way.
  • It offers some kind of authentication of the site which protects against man in the middle attacks. But it offers no protection if the user takes the wrong URL, like a similar or trusted looking URL during a phishing attack.
  • It offers some kind of privacy to hide which file gets downloaded. But it does not hide the access to the site itself, but hides only the specific URL visited on this site. And it is often possible to find out which file was loaded from the site because of meta data like the amount of transferred bytes.

Which means that depending on the use case HTTPS can help, but it does not offer more protection in all cases. And it offers less protection one might assume. Especially it is still possible to download malware using HTTPS because on either used the wrong URL (phishing) or the server itself was compromised and serves the malware.

Apart from that it usually does not harm to add HTTPS if you have the resources, no matter if your use case really profits from it. Most users don't really understand the complexities of what https offers and what not but they feel safer with https. Thus you might just give them some illusion of safety, i.e. security theater.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.