full-disclosure - [FD] Browser Security Tool: HTTPS Only 2.1 (Major Release, Open Source, Python)

Open Source and information security mailing list archives

Date: Mon, 29 Feb 2016 19:31:39 -0800
From: David Leo <david.leo@...psonly.net>
To: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>, 
 "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] Browser Security Tool: HTTPS Only 2.1 (Major Release,
 Open Source, Python)

When we browse the web, top threats are:
1. Remote code execution - everything is lost
2. Man in the middle - sniffing, and tampering
3. Phishing - simple, old, and still quite useful
4. Cross site scripting - data of the vulnerable domain is lost
5. CSRF - unauthorized action

So, what if the browser can only access HTTPS of whitelist domains? With HTTPS, "man in the middle" is fixed. And with the whitelist, other attacks become very difficult, some even become impossible(such as phishing). Phishing is a huge headache in this era, because URLs can be hidden in legitimate redirection(such as t.co).

That's why we made this simple tool(really simple - less than 200 lines of Python and JavaScript):
Project Home Page - https://www.httpsonly.net/
Source Code - https://github.com/httpsonly/httpsonly

Kind Regards,

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives