Hacker News Reader

Comment by Erwin | Hacker News Reader

I'm unclear on what you mean by "MITM... serving Javascript to EVERYONE". In a typical MITM scenario, you've logged into your coffee shop with an insecure network, or you are in some Middle Eastern country where all traffic is under control of the government.

Unless you are somehow able to route all traffic through your network, you cannot MITM "everyone", no matter even you have the private certificate for lastpass.com.

View on HN

Of course you can -- for example, if you are NSA and in position to apply pressure to whoever hosts lastpass SSL frontends.

If you're the NSA, you can probably get a CA to sign a cert for you, no need to steal theirs.

But MITM can still affect a lot of people if the attacker can get into a big gateway (e.g. large company, ISP, university, etc).

> If you're the NSA, you can probably get a CA to sign a cert for you, no need to steal theirs.

That would leave a trace (at least the person issuing the cert would know) while heartbleed doesn't.

Everyone who they were MITMing. I thought that was implied in the context.

Yes, I'd say most MITM scenarios are at the client end.

But you could, for example, be an evil network admin near the LastPass servers. That would let you MITM almost everyone who connects.

You don't get very much by MITM of LastPass compared to other targets -- the extensions aren't going to pull down Javascript, the update process only uses signed binaries... You might be able to put people utilizing LastPass.com to login which we don't recommend and isn't done by the vast majority of people.

The vast majority of people haven't logged in to LastPass.com in the last two years, since OpenSSL has been vulnerable?

(Frequency of LastPass.com login via web page on insecure network) * ( odds of MITM attack on that network) = scary low odds

Reply on news.ycombinator.com