[Clueless anti-s]ecurity quote of the week
[Clueless anti-s]ecurity quote of the week
Posted May 7, 2015 14:05 UTC (Thu) by cesarb (subscriber, #6266)In reply to: [Clueless anti-s]ecurity quote of the week by jschrod
Parent article: Security quote of the week
You forgot JavaScript and Flash (and Java if you still have it installed because your bank's online banking depends on it). HTTP _is_ used to issue commands on a remote system, that remote system being your browser. Yes, it's supposed to be sandboxed, but we all know from reading security advisories how porous that sandbox can be.
Your site might have only static pages and images, but a MITM attacker (which is what TLS protects against) can easily "fix" that by injecting a few elements into your HTML.
