HTTPS Only 3.1 (Request For Comment And Sponsor, Browser Security, Open Source, Python)
Hi there!
The Problem: When was the last month without browser vulnerability? Ah, never.
This tiny tool can secure users' most important online assets: browser is only able to access HTTPS of whitelist domains.
Details:
(http://seclists.org/fulldisclosure/2016/Mar/1)
When we browse the web, top threats are:
1. Remote code execution - everything is lost
2. Man in the middle - sniffing, and tampering
3. Phishing - simple, old, and still quite useful
4. Cross site scripting - data of the vulnerable domain is lost
5. CSRF - unauthorized action
So, what if the browser can only access HTTPS of whitelist domains? With HTTPS, "man in the middle" is fixed. And with the whitelist, other attacks become very difficult, some even become impossible(such as phishing). Phishing is a huge headache in this era, because URLs can be hidden in legitimate redirection(such as t.co).
URLs:
Project Home Page - https://www.httpsonly.net/
Source Code - https://github.com/httpsonly/httpsonly
Request:
Could you please help add this tool to Debian?
Kind Regards,
Reply to: