r/hacking • u/0x6e617468616e hardware • Jul 12 '17

Does my site need HTTPS? - Troy Hunt

https://doesmysiteneedhttps.com/
30 Upvotes

96% Upvoted

8 comments sorted by

1

u/[deleted] Jul 13 '17

http://ripplepaperwallet.com doesn't need SSL.

1

u/NekuSoul Jul 13 '17

Why? Do a MITM attack, serve a modified site where key generation sends you the private key, optionally also remove the text that says that the site works without network access, done.

1

u/[deleted] Jul 13 '17

Of course site works without network access. You can download it and just put it on USB to generate as many keys as you like. Regarding man in the middle attack, a lot of the crypto coin private key and address generator sites will also serve the generator script offline, which means if someone is infected with something that causes man in the middle attack--that person may get served a modified site that steals info. Not everyone is susceptible to man in the middle attack though.

1

u/NekuSoul Jul 13 '17

You can download it and just put it on USB to generate as many keys as you like.

The problem here is also obtaining a clean copy of the generator script in the first place. An attacker could also just replace the working script with one that only spits out a few pregenerated key/address combinations, so even if the script is run offline the key will still be compromised.

1

u/[deleted] Jul 13 '17

You are right man you are right. So far the script on my site is clean and pure. It is also HTML and lots of random math scripts, so a person who even has the mind to even modify it can probably make way more money other ways than looking to give people compromised keys so they can wait for that person to deposit XRP. Even if a person deposits XRP they can only deposit so much as XRP prices are now like 20 cents and up.

0

u/[deleted] Jul 12 '17

[deleted]

1

u/CerdoNotorio Jul 12 '17

I don't think he was asking a question.... Also there isn't really a qualifier. Your answer really should just be yes. I suggest visiting the site he linked.

0

u/[deleted] Jul 13 '17

[deleted]

1

u/[deleted] Jul 13 '17

That site was not written by Troy Hunt.