I took a look at a Fullscreen API attack ( http://feross.org/html5-fullscreen-api-attack/ ) and found it pretty creepy even though I knew exactly what to expect and what to look for. Tighter controls over that sort of thing seem like a great idea to me.
Besides, a similar attack could be carried out even without the fullscreen API - just replace the page contents when the link is clicked, and the same people who don't notice the changes in UI will probably not notice the address bar either (it also doesn't help that browsers are attempting to deemphasise/hide the URL...)
If they wanted "tighter controls", they should just remove the fullscreen API. I guess a lot of web developers won't like it, but the user has always had the ability to fullscreen the browser if he/she wanted to.
2) If HTTPS is required, MITMing can't be used to take advantage of permissions you've granted to existing sites
They don't want to prevent you from fullscreening on HTTP. They want to prevent websites from fullscreening your browser on their own accord using the Fullscreen API, which is quite different.
HTTPS might be expensive for 80% of the sites, but 80% of sites don't use the Fullscreen API anyway.
Frankly, I think people here should read and understand more carefully what the Chrome team is actually saying before accusing them of nefarious intent (it's fine to accuse them after carefully understanding, of course).
That said, I've gone back reread the mail and you're right, I probably jumped the gun a bit here. I did understood "migrate these features to secure-only" as disabling those features on non-HTTPS at mid/long term.
I think HTTPS "all-the-thing" trend is not necessarily a good thing. It is not _always_ needed, it can had complexity, it has a cost a it leads to an over simplification of security in general. It is a trend that annoys me a bit and I sometimes overreact about it.
Note that I distinguish HTTPS "all-the-thing" from HTTPS "when and where it is needed" for security concerns.
If I click on http://foobarbaz.com anyone who can successfully mess with that HTTP connection (a much wider universe of attackers that I have less visibility into, especially if I frequently use different networks [home, work, mobile, etc.]) could have been responsible.
1. Bob often views videos on YouTube, so he grants youtube.com permanent access to the fullscreen API.
2. Eve runs an open wifi AP near a coffee shop. The AP includes a proxy server that redirects youtube.com requests to Eve's own server.
3. Bob connects to Eve's AP. When he goes to youtube.com, he instead gets a response from Eve's server, which is designed to imitate a full desktop environment. Since Bob has already given youtube.com access to the fullscreen API, the browser grants Eve's site fullscreen rights without notifying Bob.
My point is HTTPS has a cost and is a barrier of entry, the trade off isn't always worth it, IMHO.
And the cost of HTTPS is pretty low nowadays. Cloudflare even offers it on their free plan, and it doesn't require you to set it up on your own server.
So you're suggesting trading a potential MitM but an official Cloudflare MitM ? :)
It is not only about a money cost, it is also about a complexity cost and false sense of security. HTTPS is not the be-all and the end-all of security. Just a step to security, if/when you need it.
I'm not arguing HTTPS is not needed. I'm the first to push for when needed. But it is not needed for watching cat videos, sorry.
This suggests you did not, in fact, see the problem. The attacker in this scenario is not limited to replacing YouTube videos. They can make anything they want appear on the user's screen, including things like a Google login page, or even a bank login page.
I do not care about the downvote, my opinion is what it is and I maintain my position. As I see it (me not been a field expert), HTTPS Everywhere will not save the world. You will still have people connecting to the wrongly spelled site (HTTPS or not). Some will even have a false sense of security which would be counter-productive.
I access my through HTTPS explicitly typing the URL. My bank ask confirmation out of band for every dangerous action (by SMS). IMHO, one should be educated to take necessary precautions. In Europe, banks have to cover frauds, the positive side effect is that some banks started to educated user on security (it's cheaper !). I don't know how it is in the rest of the world.
Just to be clear, I am not against HTTPS where it makes sense. I am against HTTPS everywhere as the only security measure. Because, that's what it will come to, "We have HTTPS so we're good, security checkbox ticked". That is not, IMHO, not a good way of thinking about security.
I guess my point is HTTPS everywhere is not the solution and should rather/also educated better/more on the risks of Internet.
That said, I wouldn't mind being pointed at a screencast/viedo (on youtube ;-)) showing how the scenario you refer to would unfold.
Of course there are still issues. The certification process has plenty of flaws (such as the fact that an attack on a single one of the multitude trusted in most browsers is just as good as attacking all of them), and there are still other vectors (such as the mistyped URL example you provide). However, HTTPS still provides a clear—and increasingly low-cost—advantage over HTTP.
Many people do that, and it's quite safe to do so with a modern browser. Were it not, it would not be safe to do so in any context, because man-in-the-middle attacks are possible on any connection, just extra easy on wifi.
> I think there is a point where you have to apply common sense.
As you are demonstrating quite well here, "common" sense is not good sense. It is stopping you from doing things which are safe, and making you advocate for things which are unsafe.
> I access my through HTTPS explicitly typing the URL.
You would be typing the URL into the equivalent of a remote desktop session. That is what you're not understanding.
> My bank ask confirmation out of band for every dangerous action (by SMS).
1) Most banks do not do that.
2) SMS is not a secure channel.
3) Banks are not the only target (again, google/gmail accounts are another good example).
4) Even if they could not transfer funds, they would now have a great deal of information about your finances right on their screen.
> In Europe, banks have to cover frauds
They mostly do in the US, too. This makes consumers less likely to care about security.
> I am against HTTPS everywhere as the only security measure.
No one has advocated that. If you think they have, you have become very confused.
Now you're misrepresenting what I'm saying. I'm not saying to not use HTTPS when it is needed. I am saying it is not enough. That you argue that HTTPS is mandatory because you want to do your banking on open wifi hotspot baffles me. You should not be doing banking on open WiFi hotspot. PERIOD. I also say putting HTTPS everywhere does not help as much as you think. I am _not_ saying HTTPS is a bad thing. HTTPS is not a substitute for caution.
> You would be typing the URL into the equivalent of a remote desktop session. That is what you're not understanding.
For that to happen the phishing server would have to draw a browser shell (ok, feasable), my list of tabs (still doable) and my "OS" taskbar/menubar, that, is not possible today. I would even argue it would be harder to mimic the 'outsides' of the browser then to present a fake a website. Website change all the time and people don't pay as much attention. Robbers prefer easy targets.
I'm not saying there are not such phising sites but I have yet to see one crafted with such attention to detail (which I think is not possible anyway). Most of those I have seen are not very elaborated. And it does not matter. They feel/look secure enough. HTTPS or not.
>> My bank ask confirmation out of band for every dangerous action (by SMS).
> 1) Most banks do not do that.
> 2) SMS is not a secure channel.
SMS is not a secured channel. True. But it is a _different_ channel and that is the point. Most bank dont do that but they should.
> 3) Banks are not the only target (again, google/gmail accounts are another good example).
Yes, and not connecting to those site on an open WiFi hotspot is still a good practice. Again, HTTPS or not.
Please articulate why you do not believe that is possible.
> Yes, and not connecting to those site on an open WiFi hotspot is still a good practice. Again, HTTPS or not.
Please articulate why you believe that is good practice.
Don't say "common sense". State the underlying basis of your belief.
And finally, please explain why, even if everything you believe is accurate, it is somehow a negative thing to prevent attacks from being carried out on users who do not share your beliefs and paranoia. Social darwinism?
Actually, one more: Even if no one did any of these things on open wifi, they would still be vulnerable to these attacks, since every internet connection is vulnerable, so please explain why protecting people who do share your beliefs is a bad idea.
Nope, still got another: I travel for work with some frequency, including internationally. When doing so, frequently my only available option is open wifi. Please explain why my livelihood should be destroyed because you, an admitted non-expert, believe using open wifi is a bad idea?
Oh, hey, yet another: Please explain why, even if doing these things were unsafe now, you oppose efforts to make them safe!
http://en.wikipedia.org/wiki/Bank_of_America
Anyone in the middle between you and Wikipedia servers can apply the phishing attack.
If you go here:
https://en.wikipedia.org/wiki/Bank_of_America
Only Wikipedia editors/admins can perform the attack.
There is so much you can do to help with phising. HTTPS everywhere is not IMHO a solution. It could even lead to a false sense of security. It's more, HTTPS is the tip of the iceberg. Your bank should send a SMS to confirm any potentially litigious action (mine does).
Security is a trade off. Some sites that really need high levels of security (and they are not that many) could say, look, I have HTTPS, you're safe. Errr ... no ... they are some much more you could/should do.
Which isn't to say there's no reason to only allow fullscreen over SSL, but I can't offhand think of one.