Hacker News new | ask | show | jobs
by mikeash 3597 days ago
Should J Random Hacker be able to alter your news feed to feed you fake information?

I think one reason they insist on TLS is because the need for privacy and integrity is a lot bigger than most people realize, and historically server folks have not reliably made the right choice.
1 comments
ashray 3597 days ago
No, of course not. What would be the economic incentive towards carrying out a sufficiently complex MITM attack on a blog or a newsfeed?

In my experience the times that I've had users complain about "injected" information or weird ads, it's usually come from malware that resides ON their system. There's no MITM required for this. The injection happens client side through a browser plugin or some other resource that gets loaded up along with the page. TLS wouldn't fix this in any way as far as I am aware.

link
halomru 3597 days ago
>What would be the economic incentive towards carrying out a sufficiently complex MITM attack on a blog or a newsfeed?

Injecting ads is a relatively harmless but hugely profitable application we are already seeing.

On the more serious side, changing news feeds has huge potential for governments. It's the perfect propaganda tool, and with advances in machine learning the cost of doing this on a gigantic scale shrinks every day.

link
mholt 3597 days ago
> What would be the economic incentive towards carrying out a sufficiently complex MITM attack on a blog or a newsfeed?

Gee, I don't know, imagine plastering your brand all over the NYT homepage or libelously accusing your political opponent of some heinous crime or behavior or injecting your malicious script onto millions of visitors' machines.

> There's no MITM required for this.

Um, local scripts injecting ads are still MITM by definition.

> TLS wouldn't fix this in any way as far as I am aware.

Yes it would. That's why pesky "antivirus" software MITMs TLS connections on your local computer.

link
ashray 3597 days ago
The context of this discussion is smaller publishers/bloggers/etc. If you see the grandparent post it's clear that industry leaders will not find it technically challenging to get on board with both TLS and HTTP/2. The question I asked about economic incentive is not in the context of the NYT homepage but thank you for the unnecessary snark.

A local script injecting an ad is not the same kind of MITM attack and is no way mitigated by enabling TLS.

The discussion here is not about whether encryption is bad. My aim was to ask about whether no encryption = no HTTP/2 for you and why this is the case. I understand that the technical reason at the protocol level is because of obsolete proxies often sitting on port 80 and also the protocol negotiation that needs to take place.

link
ctz 3597 days ago
> What would be the economic incentive towards carrying out a sufficiently complex MITM attack on a blog or a newsfeed?

We've already seen large scale MITM be used for political reasons: to DDOS github off the internet in retaliation hosting anti-censorship technologies.

link
niftich 3597 days ago
It's an integrity issue for sites that you trust. Some people's personal trust model is such that they trust no one and nothing published on the web sways their opinion; if that's indeed true then no amount of MitM content injection is going to influence them one way or the other -- but neither is truthful content. For these people, everything on the web is 'entertainment', and none of it is 'staying informed'.

For people who do use the web to stay informed, reputation, ie. trust, matters. I might think that CNN publishes clickbait alonside real news, but I trust that CNN won't put blantaly false breaking news warnings above the fold about made-up events. Or, if I don't trust a single source in isolation, I trust that if several news outlets are posting breaking news warnings about the same event at the same time, that event must be real. How else would you find out?

In this day and age, refusing HTTPS means that the site author has done a cost-benefit analysis and decided that their content is not important enough to be verifiably originating from them, and that their reputation is not valuable enough to be protected from malicious tampering. In that case, why host a self-hosted website at all?

link
cmdrfred 3597 days ago
>What would be the economic incentive towards carrying out a sufficiently complex MITM attack on a blog or a newsfeed?

This is what you can do with a single fake tweet: http://business.time.com/2013/04/24/how-does-one-fake-tweet-...

link