2

I have a REST HTTP server listen on localhost port and a HTTP client runs locally and talks with the server. The client could send sensitive info (credential etc) to server and the credential is encrypted/decrypted by Windows API.

In this case, do I need to wrap the HTTP server with SSL (to be HTTPS server)?

  • https protects the transport of data, which should not be a problem, unless you have bigger problems in the way of data making it the few inches from one net to the other on the same machine. That said, it can't hurt security, it will hurt performance, but could protect against a couple attacks of many. – dandavis Aug 1 '16 at 21:54
  • Without SSL, would it be possible that somebody else remotely login with different account and modify the communication between the client and server? – Lee Aug 1 '16 at 22:01
  • @Lee: No, unless the "somebody else" also is a administrator. Packet capturing requires UAC confirmation. But as administrator, you can aswell modify the communication in-RAM, before its encrypted/after its decrypted by the SSL layer. – sebastian nielsen Aug 1 '16 at 22:13
4

No. Its not neccessary at all. First, because packet capturing/modifying requires administrator rights. But second, with administrator rights, you are aswell able to modify other processes that you don't own, thus can modify/read the RAM for the client or server before the data is encrypted by the SSL layer, or after its decrypted by the SSL layer.

Thus SSL will neither contribute or compromise anything security-wise, it will have zero effect. It may have effect on performance.

Also, since the private key for the certificate needs to be stored on the very same machine, the attacker could steal that key and use it to read/modify the local traffic.

So SSL will just only make debugging harder and add nothing.

1

It's worth keeping in mind that just because a server is bound to the loopback interface does not preclude malicious code from making requests of the server from elsewhere on your computer even without administrative access to sniff the traffic of other clients interacting with the server. See the round of vulnerabilities called out late last year: http://www.pcworld.com/article/3012061/security/vulnerabilities-found-in-lenovo-toshiba-dell-support-software.html

This doesn't mean you need SSL/TLS; it means you should keep this in mind when designing the local server.

  • Thanks for this update and good to know that we should not assume non-administrator could not sniff the traffic in administrator account. In my case it's a Windows Server 2012 VM. – Lee Aug 2 '16 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.