Suppose one hosts a web application that does not handle any sensitive data (e.g. passwords, session cookies, etc.), without using HTTPS. What potential security issues arise as a direct consequence from this? Assume that man-in-the-middle attacks are useless, as there is no valuable data to extract from an attackers perspective.
-
A user that otherwise has his browser configured to exclusively browse via secure channels may just for the purpose of visiting your site modify configuration. Which could lead to the browser happily sending data (e.g. other sites cookies) to MitM attackers which without that override would have had no opportunity to request it.– anxOct 22 at 12:16
Add a comment
|
2 Answers
... a web application that does not handle any sensitive data (e.g. passwords, session cookies, etc.)
Sensitive data might be way more than passwords or session cookies. These might involve the specific URL, the content of the returned information etc. Just imagine users browsing sites with information to specific health conditions or sexual preferences - it is sensitive what the user is visiting even if no passwords or sessions are involved. Without HTTPS the ISP or some attacker in the path (like a parent in the local network) can view this kind of traffic.
Apart from that without HTTPS the integrity of the data isn't protected either, i.e. some man in the middle might modify existing content or serve its own content. This might be used to serve wrong information or block specific information. But it might also be used to run attacks against the user, as was done in this recent case in Egypt.
answered Sep 25 at 8:41
-
2Or the page have no sensitive information but an attacker modifies it to ask for sensitive information. Sep 25 at 9:35
HTTPS provides integrity for request and response data (headers and body). If the connection isn't secure, then someone may be able to hijack the connection, and inject unwanted info onto the pages you're browsing. This can make the owner of the website lose reputation if the injected data are harmful contents.
However plaintext HTTP does find some use in operating system updates - Debian use plaintext HTTP (assuming for efficiency reasons) and verify package integrity using digital signatures with public-key embedded into the operating system.
Another point is that, increasingly many Web APIs now require a "secure context" to operate. You can get it using loopback address when testing your website locally, but you need an HTTPS connection when you go online.
-
most of this doesn't answer the questions about risks. The part that does, repeats the other answer.– schroeder ♦Sep 25 at 9:28