-3

Many questions on this topic around here, but didn't find this particular angle

Background: Sending any information of value with HTTP and through HTTPS is a bad idea (in the rare case a respected website would give you that option). The ubiquitous establishment of SSL has unfortunately been a bit slow, in my understanding, as the high prices and mess with certficates for the low/average experienced website admin. (maybe initiatives like this will hurry up that although? https://letsencrypt.org/)

Question: But how insecure is actually the use of HTTP for e.g your personal whole "not-so-important" Wordpress blog, if you are aware that your passwords flows uncryptated and thus only access sensitive parts of it on secure known networks (e.g your home trusted WP2-SPK wifi)? (sitting on a "public" (cryptated or not) wifi/LAN where you don't trust the hotspot and/or the other connected users is a own security story, exclude that the user is unaware of the basic secuirty risk in this case)

Being sure no one snoop of spoof you between your computer and router, how secure can you estimate your data to be over HTTP? I haven't understood what potentially could happen on the way between your router and the server, even if you secure "your end", what stuff could happen on the long travel through the web to the server?

Is having your hobby blog on HTTP "good enough" (considering your generally good at using unique passwords etc), or should a VPN be used at all times in the HTTP+password cases?

closed as primarily opinion-based by Xander, Matthew, Mark Buffalo, John Deters, Ohnana Mar 24 '16 at 11:27

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • "Good enough" is very much a decision for the service provider and service users. HTTP in a closed network is probably not as evil as some believe, but as soon as you bring WiFi in the risk goes up. Probably not an issue on a closed network at a geographically isolated home, but almost certainly an issue in a dorm in a city. HTTPS increases the chance that you're talking to the server you think you are, and that no one is listening in, or impersonating either end. – Phil Lello Mar 23 '16 at 13:21
  • What's the VPN going to do in this use case? You're still accessing a public server and sending plain text data to it. All the VPN is going to do is change where that unencrypted data originates. If you're this worried about security though, you've already thrown it all out the window when you decided to use Wordpress. – user7933 Mar 23 '16 at 16:11
  • Correct, thanks. VPN doesn't help the problem with the "last leg" of the data transport route (VPN Server to the target server) – Cander Mar 23 '16 at 17:52
  • @Phil Lello I'm trying to get a somewhat clear picture of the greatness of each risk. As mentioned in the discussion here the possibly risks are more than can be counted on fingers, many although low and "acceptable" for most (e.g trusting your ISP), I guess. What I was thinking particulary on before I actually started to write the question (and failed and made it kinda broad), was "how big is the risk for uncrypted data between the router-server leg, compared to other things like http-ing on unencrypted airport Wifi:s". – Cander Mar 23 '16 at 18:03
  • What's good enough is ultimately up to one self, but it's hard to make the decision if you're not farily understanding each all those many potential risks – Cander Mar 23 '16 at 18:03
2

It's possible that an attacker could have the ability to watch the wider network or internet - someone at your ISP, or at the datacentre your server is hosted in. Various governments have this ability; one would generally hope that they delete credentials on sight and don't keep or use them unless part of an active investigation, but this probably isn't true.

Do you trust every device on your local network? There are cases of e.g. smart TVs sending home the names of all files shared on the local network - it's not too hard to imagine some unscrupulous or compromised Internet of Things device watching data transmitted over the local network.

The real question is 'what can happen if someone does get your password?'. If the blog has few users and the password isn't used elsewhere, it's probably not the end of the world - just your blog page gets malware/new ads. But if you use the password and email elsewhere, all those accounts may be compromised.

  • Good risk points out for the "last leg" of transportation router-server, "hacked"/untrusted ISPs and webhosts. Any more such possibly attack spots to consider? (that are "out of your control") – Cander Mar 24 '16 at 7:34
  • @Cander Doesn't really apply to this question, but I think there have been occasional instances of malware jumping from one site to another on shared hosting. Beyond that, I think I've got most of the ones that you haven't explicitly ruled out. – Someone Somewhere Mar 24 '16 at 7:36
  • Made a messy/broad/opinion-based question indeed, but interesting stuff pointed out here out to continue to ponder on, thanks – Cander Mar 26 '16 at 10:39
0

I think this question is very broad and cannot be fully answered. But I try to highlight some aspects which should be evaluated by the OP:

  • HTTPS protects only the transport of the data by encrypting the data. Especially it does not protect the web site itself and it does not imply that the site can be trusted in any way.
  • HTTPS gives the user a bit more privacy by partially hiding what data gets accessed. It only hides the contents and the full URL but it does not hide which host the user accesses. Also traffic pattern can often easily be used to find out which parts of the site got accessed. This means even with passive sniffing lots of information about the users behavior can be obtained, but it is harder than just sniffing plain connections.
  • HTTPS protects against tampering with the traffic. This means no active attacker can modify the traffic. Such traffic modification is also done by some ISP to monetize traffic (i.e. inject advertisements). But note that HTTPS does not protect against modifications done at the client side or by using "trusted" proxies like Superfish.
  • HTTPS protects against DNS spoofing or similar attacks and thus also helps in case of a compromised router with maliciously changed DNS settings.
  • HTTPS has some negative effects at the performance mainly due to higher costs in connection setup. This can be partially mitigated with TLS session reuse, keep-alive connections and HTTP/2.

At the end HTTPS can often but not always be easily and also cheaply setup on the server side. The added overhead does not matter much in most cases, especially not for a personal blog. It has some advantages for the user even if you don't transfer sensitive data, like increased (but not full) privacy and protection against traffic manipulation by the ISP. And since it obviously provides advantages for moderate costs it would be nice to offer it even for sites with non-sensitive data (for sensitive data it is a must anyway). But it is not the super secure and privacy preserving technology some claim.

  • 1
    Last paragraph, first sentence, did you mean https, not http? – Neil Smithline Mar 23 '16 at 12:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.