Skip to content

Add MITM guide #39604

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 9 commits into from
May 30, 2025
Merged

Add MITM guide #39604

merged 9 commits into from
May 30, 2025
+56 −0

Conversation

wbamberg
Copy link
Collaborator

Add a page on Manipulator in the Middle attacks.

wbamberg added 4 commits May 13, 2025 10:18
@wbamberg
Getting started
f9717c4
@wbamberg
Merge remote-tracking branch 'upstream/main' into add-mitm-guide
12d8ac7 
* upstream/main: (40 commits)
  Add a guide on xs-leaks (mdn#38977)
  chore: Link to child pages in SVG, URI section (mdn#39470)
  Correct page title for `Uint8Array.prototype.setFromHex()` (mdn#39494)
  Bump markdownlint-cli2 from 0.17.2 to 0.18.0 (mdn#39488)
  Add more documentation for sizes=auto (mdn#39464)
  css(fix): update 'shape()' page (mdn#39454)
  Expand Compression Dictionary format description (mdn#39441)
  Add username/password section to URLs guide (mdn#39487)
  Fix typos (mdn#39481)
  CSS: mask-position property description (mdn#39449)
  Adding @starting-style to CSS nesting at-rules (mdn#39473)
  feat(aria): Add short titles, format titles for roles (mdn#39472)
  Fix Circle Collision detection algorithm (mdn#39484)
  Add warning against using element IDs as global properties. (mdn#39422)
  Fix typos in web audio spatialization basics (mdn#39476)
  More Error Messages (mdn#39419)
  Add links to CSS sidebar (mdn#39445)
  css: add 'stretch' value examples (mdn#39451)
  chore: link to unlinked child pages (mdn#39469)
  Fix typos (mdn#39465)
  ...
@wbamberg
Fix slug
172aa38
@wbamberg
Add a guide on MITM attacks
93177ce
@wbamberg wbamberg requested a review from a team as a code owner May 21, 2025 19:01
@wbamberg wbamberg requested review from pepelsbey and removed request for a team May 21, 2025 19:01
@github-actions github-actions bot added Content:Security Security docs size/m [PR only] 51-500 LoC changed labels May 21, 2025
@wbamberg wbamberg requested review from hamishwillee and removed request for pepelsbey May 21, 2025 19:02
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented May 21, 2025 •
edited
Loading

Preview URLs

External URLs (5)

URL: /en-US/docs/Web/Security/Attacks/MITM
Title: Manipulator in the Middle (MITM)

(comment last updated: 2025-05-28 21:26:52)

hamishwillee
hamishwillee reviewed May 26, 2025
View reviewed changes
hamishwillee
hamishwillee reviewed May 26, 2025
View reviewed changes
hamishwillee
hamishwillee reviewed May 26, 2025
View reviewed changes
hamishwillee
hamishwillee approved these changes May 26, 2025
View reviewed changes
Copy link
Collaborator

@hamishwillee hamishwillee left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks good.

I'm no expert, and this covers "what I know".

  1. A quick AI query mentions other vectors such as:

    • DNS Spoofing/Cache Poisoning: The attacker manipulates DNS resolution, so when a user tries to access a legitimate website, their request is redirected to the attacker's controlled server instead.
    • Malware on the Client: Malware can install malicious root certificates, modify browser settings, or directly intercept and manipulate traffic on the client's machine, effectively bypassing many HTTPS protections.

    I don't know if those are relevant to mention here.

  2. Is there a need for a summary checklist?

  3. Is there a need to talk about what the browser always does for you, such as showing the secure icon - or to put it another way, end user best practices. Not advocating - stream of thought review.

@wbamberg
Copy link
Collaborator Author

wbamberg commented May 26, 2025 •
edited
Loading

This looks good.

I'm no expert, and this covers "what I know".

  1. A quick AI query mentions other vectors such as:
  • DNS Spoofing/Cache Poisoning: The attacker manipulates DNS resolution, so when a user tries to access a legitimate website, their request is redirected to the attacker's controlled server instead.
  • Malware on the Client: Malware can install malicious root certificates, modify browser settings, or directly intercept and manipulate traffic on the client's machine, effectively bypassing many HTTPS protections.

I wouldn't have called either of these MITM. Certainly the second, by definition, isn't, is it?

@wbamberg
Copy link
Collaborator Author

wbamberg commented May 26, 2025 •
edited
Loading

  1. Is there a need for a summary checklist?

-> 94cfef9

  1. Is there a need to talk about what the browser always does for you, such as showing the secure icon - or to put it another way, end user best practices. Not advocating - stream of thought review.

I'm not sure. This doesn't seem that relevant to web developers. I suppose we could have something in the preamble at https://pr39604.review.mdn.allizom.net/en-US/docs/Web/Security/Attacks/MITM#defenses_against_mitm that if you do serve pages over HTTPS, users will get the padlock. But I'm not sure it's worth it, and I think it distracts a bit from the framing of this as a defense against MITM. TBH I think HTTPS is so widespread now that this whole guide is of limited usefulness.

@hamishwillee
Copy link
Collaborator

I wouldn't have called either of these MITM. Certainly the second, by definition, isn't, is it?

Yea, not the second. Maybe the first, but it feels like a different flavour of attack

hamishwillee
hamishwillee reviewed May 26, 2025
View reviewed changes
@hamishwillee
Copy link
Collaborator

  1. Is there a need to talk about what the browser always does for you, such as showing the secure icon - or to put it another way, end user best practices. Not advocating - stream of thought review.

I'm not sure. This doesn't seem that relevant to web developers. I suppose we could have something in the preamble at https://pr39604.review.mdn.allizom.net/en-US/docs/Web/Security/Attacks/MITM#defenses_against_mitm that if you do serve pages over HTTPS, users will get the padlock. But I'm not sure it's worth it,

Don't bother.
I think my hesitation was in some cases that you refer to "you do this" meaning "the site", "the server" "your site".
That made me think who is "you". Not needed.

@wbamberg @hamishwillee
Update files/en-us/web/security/attacks/mitm/index.md
e141062 
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
hamishwillee
hamishwillee reviewed May 27, 2025
View reviewed changes
hamishwillee
hamishwillee approved these changes May 27, 2025
View reviewed changes
Copy link
Collaborator

@hamishwillee hamishwillee left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @wbamberg
I'm proposing a tiny suggestion here https://github.com/mdn/content/pull/39604/files#r2108151140 for your consideration.

Also perhaps consider rewording the defense topic headings as defenses

## Defenses against MITM
### TLS configuration
### Securely load subresources
### HSTS when upgrading HTTP requests

Approve though, as these are tweaks.

wbamberg and others added 2 commits May 26, 2025 22:16
@wbamberg @hamishwillee
Update files/en-us/web/security/attacks/mitm/index.md
02d19d6 
Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
@wbamberg
Updated headings
922e36c
@wbamberg
Copy link
Collaborator Author

Thanks @wbamberg I'm proposing a tiny suggestion here https://github.com/mdn/content/pull/39604/files#r2108151140 for your consideration.

Also perhaps consider rewording the defense topic headings as defenses

## Defenses against MITM
### TLS configuration
### Securely load subresources
### HSTS when upgrading HTTP requests

Approve though, as these are tweaks.

Thanks! I agree with the general spirit of these heading updates, but chose slightly different wording: 922e36c.

I'll let this PR sit for a couple if days and then merge if I don't get any other comments.

@wbamberg wbamberg merged commit 3a85d69 into mdn:main May 30, 2025
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@hamishwillee hamishwillee hamishwillee approved these changes

Assignees
No one assigned
Labels
Content:Security Security docs size/m [PR only] 51-500 LoC changed
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@wbamberg @hamishwillee