We seem to spend a lot of time guarding against Man-In-The-Middle (MITM) attacks without discussing who we are actually guarding against.
This is important because if these individuals are unlikely to attack our website or the cost of them doing so is minimal then we can afford to spend less resources guarding against such attacks. For example: https://security.stackexchange.com/a/58729/5002
My understanding is that there are only two ways to intercept internet packets:
- Tap into the physical layer (i.e. the phone/cable lines outside my house or WiFi connection).
- Tap into ISP infrastructure (the hops between my computer and the destination website).
There are only 3 kinds of people who can carry out these taps:
- Anyone with technical knowledge to tap into the physical layer, or hack an ISP.
- Anyone with legal power to compel ISPs to intercept the packets.
This leads to three kinds of attackers:
- Rogue individuals.
- Corporate spies.
- The government.
The point I'm trying to make is that if your website is not financially or politically significant (i.e. Stackoverflow) then it is unlikely that MITM attacks are all that relevant. The most an attacker can do is vandalize the site, the probability that anyone would want to do so is low, and the cost of recovery is relatively low. Your average script kiddie might have the motivation, but lacks the technical ability to do so.
Am I missing anything? :)