| |||||||||||||
An alleged SSL/TLS protocol vulnerabilityAn alleged SSL/TLS protocol vulnerabilityPosted Sep 21, 2011 0:43 UTC (Wed) by JoeBuck (subscriber, #2330)In reply to: An alleged SSL/TLS protocol vulnerability by rickmoen Parent article: An alleged SSL/TLS protocol vulnerability "You know that 'This page contains both secure and nonsecure items' warning you keep ignoring? Stop doing that." And if the site issues unencrypted ads when the user asks for https (as LWN itself did for quite a while), then what? The only options are either to stop using the site or to assume that everything is insecure. We've done a very good job of training users to ignore warnings related to https, because those warnings appear so often during normal operation (because misconfigurations that generate the messages occur so often).
(Log in to post comments)
An alleged SSL/TLS protocol vulnerability Posted Sep 21, 2011 1:22 UTC (Wed) by ewen (subscriber, #4772) [Link]
Assume everything is insecure if you're getting mixed HTTP/HTTPS. Because, well, it is, given that the HTTP portion could be replaced in transit with anything. As I saw pointed out a little while back, intercepting and replacing the Javascript loaded for, eg, the central copy of JQuery or Google Analytics, on the wire, would give a surprising amount of exploitation reach for not much effort once you're a MITM.
IIRC from a recent security conference talk, browser vendors are already leaning towards just blocking mixed HTTP/HTTPS content. (AFAICR the next Internet Explorer is going to block it, and Chrome/Mozilla are leaning that way once some of the more user-affecting breakage can be cleaned up.) Possibly things like this will push that a step closer. At which point sites with mixed content will have a stronger incentive to Not Do That (tm) -- their site will just not be loadable by more and more modern browsers.
Ewen
An alleged SSL/TLS protocol vulnerability Posted Sep 21, 2011 4:32 UTC (Wed) by lindahl (subscriber, #15266) [Link]
I would love this solution -- our big problem at blekko with mixed content on our own website is that the 3rd parties that we work with don't have HTTPS for all of their stuff that we use. A browser ban would be perfect for helping us get the point across.
I surveyed a lot of HTTPS websites as part of our HTTPSPreferred(R) feature (mostly banks), and almost half of them threw a mixed http/https warning.
An alleged SSL/TLS protocol vulnerability Posted Sep 21, 2011 7:10 UTC (Wed) by hpro (subscriber, #74751) [Link]
Would an initial approach with the browser declining to fetch any content over HTTP when the page itself is HTTPS not work? Like if an ad image is served HTTP on a HTTPS page, it would just not be loaded.
An alleged SSL/TLS protocol vulnerability Posted Sep 21, 2011 1:28 UTC (Wed) by rickmoen (subscriber, #6943) [Link] Joe --Figuring out the occasional anomaly and understanding why it's there differs significantly from ignoring it, in my perhaps limited experience. Please note that I merely said 'stop ignoring'; I didn't say 'refuse to ever, under any circumstances, tolerate'. Other alternatives to 'ignoring' are probably also possible. Rick Moen
An alleged SSL/TLS protocol vulnerability Posted Sep 21, 2011 16:33 UTC (Wed) by JoeBuck (subscriber, #2330) [Link] In my case I do attempt to figure it out, but most users don't have multiple decades of experience on computer networks. Ideally the browsers should do more to help users distinguish cases that are likely to be misconfiguration from cases that are likely to be fraud. A security system that gives too many false positive warnings tends to be ignored.
An alleged SSL/TLS protocol vulnerability Posted Sep 21, 2011 16:46 UTC (Wed) by rickmoen (subscriber, #6943) [Link]
Joe --
Personally, I have the great and good fortune that the unending travails, hapless fate, and proverbial helplessness of 'most users' is simply not my problem. In my experience, concentrating on assisting people willing to take at least a very minimal amount of initiative increases the quality of my life, and enhances my satisfaction and ability to get things done, immensely. That is one of the advantages of Linux itself, for example.
I do wish you the very best of luck in your effort to make the Internet safe for 'most users'.
Rick Moen
An alleged SSL/TLS protocol vulnerability Posted Sep 22, 2011 12:16 UTC (Thu) by mpr22 (subscriber, #60784) [Link] Someone who has installed a non-default browser has probably already taken "at least a very minimal amount of initiative". However, even highly self-starting people are not immune to warning fatigue, and the more intrusive the false positives get, the less likely even highly competent people are to leave the warnings enabled. And remember: J. Random Luser's incapability, ineptitude, and inability to self-motivate is, in fact, your problem. It's not directly your problem, but it is your problem.
An alleged SSL/TLS protocol vulnerability Posted Sep 22, 2011 17:48 UTC (Thu) by rickmoen (subscriber, #6943) [Link] mpr22 wrote:...even highly self-starting people are not immune to warning fatigue, and the more intrusive the false positives get, the less likely even highly competent people are to leave the warnings enabled. Let me tell you how the world of https looks, as I encounter it: The number of https sites I use that are meaningfully security-sensitive is about 20 or 30. (I don't reuse passwords among sites. I run the HTTPS Everywhere extension, NoScript, AdBlock Plus.) Number of https sites, from among those 20 or 30, that generate warnings about mixed http/https content: literally zero, as it happens. If I did encounter warnings on, say, some banking or similar sites among the 20 or 30 prior to a few days ago, I would 'stop ignoring' them by finding out why they were occuring and fixing them if possible. There would have been no 'warning fatigue'. As it happens, a few days ago I decided to add RequestPolicy as a general XSS/CSRF preventative, and it make the entire problem discussed here go away completely. Now, certainly I would appreciate seeing a general cleanup where Same Site policies are enforced without needing RequestPolicy, NoScript, etc. as bandaids. It strikes me that making browsers back off to http any time there's mixed content might be a logical next step, but the exact general implementation is, thankfully, not my problem either. Your assertion that someone in a situation like mine inevitably will make some ghastly error on account of 'warning fatigue' is simply factually incorrect. Which brings me to your other contention: J. Random Luser's incapability, ineptitude, and inability to self-motivate is, in fact, your problem. It's not directly your problem, but it is your problem. I prefer to think of it as a 'consulting opportunity'. Anyway, is this some sort of fatuous ideological advocacy? It sounds very much like the corporate-exhoratation genre, such as when one-time Blyth Software CEO and self-promoting dullard Michael Minor told all of us 1980s technical employees that we were 'all salesmen'. (The same logic suggested that we were also all janitors, all accounting clerks, and all receptionists.) Rick Moen
An alleged SSL/TLS protocol vulnerability Posted Sep 22, 2011 17:55 UTC (Thu) by rickmoen (subscriber, #6943) [Link] By 'Same Site policies", I meant Same Origin policy, but just could not remember the correct name off the top of my head.Rick Moen
An alleged SSL/TLS protocol vulnerability Posted Sep 23, 2011 9:44 UTC (Fri) by mpr22 (subscriber, #60784) [Link] J. Random Luser's ineptitude is your problem because his computer is a botnet zombie generating negative utility for everyone who has systems facing or nearly-facing the public Internet.
An alleged SSL/TLS protocol vulnerability Posted Sep 24, 2011 2:22 UTC (Sat) by rickmoen (subscriber, #6943) [Link]
Ah, so it's 'my problem' to roughly the same extent that rabies in the critter population above my town is 'my problem'. And this news flash merited your injecting a public service announcement into an LWN thread about technology. Well, as they say in the American South, 'Bless your heart.'
Rick Moen
An alleged SSL/TLS protocol vulnerability Posted Sep 24, 2011 3:01 UTC (Sat) by thedevil (subscriber, #32913) [Link]
So, how do you figure this out? Educate me. I know that (some of) you view it as a consulting opportunity, well I promise to advertise diligently for you if you help me :-)
I just opened a newspaper site because I'm flying 2 days from now and an airline strike was brewing, and I got the mixed content warning. I don't have weeks to do the investigation, or even hours. I need the information now.
How can I get at this? I have these extensions: Perspectives, Error console, DOM inspector, Web console, Live HTTP headers. None of these seem to give a simple way to trace and list connections without a huge load of extra junk that needs filtering.
|
|||||||||||||