Good morning.
So to…
you are showing, so you all should be able to see my web browser. Good.
I'm back on back at home, so I've got my
big monitor here, so I'm sharing specific windows
And for some reason, oh, it is cut off.
Darn it.
Why is…
so bad at doing this.
Is it cut off now?
I think it's…
You can see the whole window now, right?
Oh, okay. Oh, okay. So…
Oh, okay. Anyway, so we're now at lecture 16.
Just to review where we are.
we don't have lecture 16, we don't really have, you know, we're most of the way semester there's
You know, go till December 5th
Tutorial wise, we're doing tutorial seven as we finish up that
Tutorial 8 and Tutorial 9 is all that's left.
We will start talking about the material that's going to be on tutorial 8 today.
And assignment three is out. You have till November 20th, and then there'll be a last assignment, assignment four.
So…
So, uh.
So I have some questions here in the chat privately about the assignment.
So I will…
try to explain that since it didn't go to everyone.
So the question is, is
Question one.
It's about um
Do you change the program to accept the given name
And just exactly the phone and give them or any name with a normal difference or sub submissions have.
So I revised the wording of this to say name for a company that signed three or similarly for other usernames
So yes, it should be exactly the same as
As it is i
So as I mentioned in the Teams chat.
In the past, I put like angle brackets to denote this and
people have gotten confused so i tried being
concrete, but no, I do not want that exact file name.
That's just very, very silly.
And then for question six.
one upload per student id
So the question, I don't quite understand the question. It's meant for use to update the same page status
Now you submit the template.
uh…
When we say the status here.
Remember, there's a status line in the validator page.
that status, it says upload success and other things that has things, that's what should be changed. There's a tag for the status there.
And then this is talking about the HTP level
that's what's returned the thing so
So, uh.
So in terms of like the code here for submit demo
uh…
There's a few files now in submit demo part of
this assignment is figuring out which files to change.
Some things may require changes to
the server side submit demo.js. Some of them may require other files such as the validator.js.
part of this is which it is, which is why I refer to submit demo as the
whole program.
Please, don't ask questions by direct message.
Unless it's something really private.
Because…
It's better for everyone to know it. We don't publish the chat logs.
on the you know on the web.
And it's useful for the people in the classroom to know, like to be able to see the question.
So a good question about the midterm. So I said last night for assignment to
things. I just I flew in back from Ottawa yesterday so
I did not manage to do that, but that is my top of my agenda after this the
the midterm exam
Questions are…
TAs are grading. Currently, they should have it
done by the end of the week.
And so then next week we can start doing interviews.
Sorry, I've been slow on this. This is me dropping the ball, so…
But I've been prioritizing, making sure I have material to actually teach you.
questions or other things. So assignment three
Any other questions on the assignment?
If not, then I'm going to…
Get rid of this window.
Okay.
Sorry about that. Did that actually
Sorry, that was very…
disconcerting. So what I want to do today
Assignment 2 marks should be hopefully by the end of today.
I don't see it. My afternoon I have available for doing this, so.
So let's…
Stop sharing. Oh God, please stop doing that to me. Do.
killing me here on Zoom.
So that's…
these things there.
So today, what I want to do is talk about
cookies and TLS because this is now we're getting into some of the more
a little more advanced topics
the web stuff. We've kind of covered the basics of how web applications work.
With the client-side JavaScript, server-side JavaScript, we talk about HTTP, you've seen Git, you've seen POST.
which are the main requests that are used. You've seen the requests, you've seen the responses.
But now we're going to, you know.
question on assignment three and then I'll have to do things at the end because
can't keep switching back and forth so
If you've got questions about assignment three, ask them now.
So for questions seven of the assignment.
is it that we are meant to tell the user how many empty questions is for each question or the amount of empty questions each user has in their submissions?
Okay.
So remember, if one of the earlier questions asks you to add a sixth question.
If you want your analysis page to work with the six question version.
that's fine. Shouldn't really change as much except a little bit
but for working on it, you can do it either way.
But your analysis patients are five or six extra numbers.
So like Q3.
This is what I mean by question seven.
Does this make sense?
Good, good.
Thank you for asking that. Even one of the TAs had questions, although I don't it's like
The whole point of the analysis
is to analyze properties
of the database in aggregate.
it's not supposed to list individual things.
So.
Don't need my phone distracting me.
So going back to what I was saying.
We talk cookies and TLS, previously discussed how HTTP is a stateless protocol.
We need state to tie
things together.
Okay.
I'm sure you all have heard of cookies.
you work on the, you know, you live on the web, you've seen this happening.
But what is it?
is the question.
So what is a cookie?
I'm going to switch over to the browser. We're going to look at different ways of seeing what a cookie is.
Do not go full screen.
Okay, so…
Sorry about that.
Okay, it didn't crash.
That is good.
So first off, let's go
So I'm going to use Cloud. I have subscription to Cloud. And let's say
let's ask it what it is.
How does it work?
Okay, so…
When you visit a website, it can send a small text file, a cookie, to your browser. This file typically contains a unique identifier.
Some basic information about your visit preferences you see on the site. For example.
you know, visit a website like this
And we said, would you like to explain more
the phone details.
Let's see what it says. Setting cookies
Response header. Okay, so this is here
Just giving this JavaScript version
Really, Claude?
This is the answer you gave me.
I'm not saying a lot of this stuff isn't useful.
This is irritating.
I want to contrast this with.
HTTP cooking.
So this is the Wikipedia version of this.
And it says, you know, tracking tea, often cookies origin
The origin is very nice.
it talks about
mosaic and stuff, this is all kind of fun
you know terminology.
super cookies and stuff
Implementation.
this is what I want. Notice this was at the top. I could have just gone to
Well, there's the left here they have.
privacy too.
Selling a cookie so
what do we have to do here to set a cookie?
So to set a cookie, we spec a header set cookie.
header field set in the HP response from the web server.
The header instructs the web browser to store a cookie.
So when the server
sends a response object, we add a header
set cookie
to it and then um
And then we go, you know, then, you know, it's there. And so browser first, you know, the browser sends a request
the server responds with this content type, set cookie and it's setting two cookies.
These are the cookies that are set.
And then next time.
you do a request to the same website
In the headers, it's going to respond
with this cookie.
So the server now will get basically the server sent data
to the browser with set cookie
And it got back the information
cookie
on subsequent requests.
to the domain. Now, you can actually specify as part of defining cookie by fault, when you set the cookie.
it's going to go back to the server that set it.
But you can actually have it set across a domain and other things. You can have it be more
general and you can, and of course some of these can see set to expire as opposed to expiring
just when the browser closes.
There's a lot of things to look at these, but you see this basic idea
And how that works.
you can see how this can be used for tracking
Of course, because now
Google now places a cookie in your browser and if they set the thing to be general enough.
every time someone else visits it, they'll get the cookie or maybe Google will get it when the code gets called and gets back.
I don't want to tell them exactly how that works right now but basically
this is a very much of a tracking mechanism can be but
It's also super useful for just doing basic like logging into a website.
But you see that the mechanism isn't that complicated is essentially we have all the pieces necessary.
It's all done with um
added headers. So we have to add a header to the response we send back from the server.
And then when we have an incoming request.
We need to look at the headers and see if there's a cookie header. And if it is, analyze it.
And there can be multiple and so
This one's actually the cookie. It's actually incorporating it as
all the cookies are there um
in one thing. So they're separated by semicolons.
And the value of the cookie can say any printable ASCII character
And white space care. So the name of the cookie includes characters as well as equals that delivers a name of the value.
So when we say, so fetch, remember, fetch is just, so the question is, do requests always automatically send cookies, even in things like fetch requests?
fetch request is just an HTTP
request, but done from JavaScript.
That's all fetch is. So yes, fetch will send any appropriate cookies
Along with it.
Now that's a question. I actually don't know whether you can, I think you might be able to set cookies
So the fetch api
So with the fetch API, you can
You can set the methods, you can set the body.
You can set headers.
Since you can set headers
with a fetch request.
you can set a cookie header.
So you could send a cookie
As part of this.
So there's the cross origin request. I don't want to discuss that yet
what i'm…
I'm not sure.
I think, actually, I'm pretty sure it does. It should send the cookie along with it.
But I'm not sure if you can get it to not send the cookies.
So anyway, to answer the question.
Yes, I think they send cookies by default when you do the fetch.
But I think there might be some options for um
So let's fine.
Oh.
What's it saying?
After a successful long, there's a cookie header in the feature request, but fetch seems to ignore the headers and header request may fetch
is unauthorized.
Oh, it does not use cookies.
Okay, fetch does not use cookies by default. Naoku do this.
credentials, just say credentials same origin
Oh, okay, so it doesn't
Okay.
basic fetch request.
What's metadata?
To make a fetch request with credentials such as cookies, set the request credentials value to include.
No, it was the reason why it was outdate was
So same origin doesn't work anymore, include does.
Include only works for cross origin cards, but not for same origin requests.
If you say same words, it means that more headers will be respected cookies there, but your code will have limited access to the response.
Yeah.
That was actually a very good question.
But yeah, fetch is
Fetch does its own thing with cookies and stuff.
Which actually makes sense because you're doing it on a programmatic control.
really when you do a request from the browser, it's coming from the browser, fetch is coming from
JavaScript. And the big reason you don't want those two to be the same thing is because it could allow for
various shenanigans.
And it's probably a reason to limit cookie theft.
Anyway, we're going to talk more about the security implications of all this
Later, but first I wanted to
talk about how this works.
So I did a little something here. I put a little question. So I uploaded our old code, SimpleServer 2 before class.
to clone. And I asked it a question. How can I change simple server two so it has a private web area
called private that can be accessed when the cookie secret has the value open sesame.
And so Claude went and kind of changed my code
Ah.
And it did things in a bit of a funny way that I didn't anticipate but
Anyway, so what happens is
First, you have this handler here.
Check the secret cookie so you know
crash get cookie. So we can get the cookie from the header
And then see your cookies get cookie
cookie header secret
And then secret cookie equals open sesame.
So this whole get cookie
to actually
So that's very interesting because
I don't think Denno has access
I don't think get cookie is a
default API in
Denno.
Oh, here.
Yep.
So let's, I just checked in um
I just checked in Denno just to see if it was. I just typed in, I'll show them our window in a second. It says.
Yeah.
get cookie is not defined.
So yeah, and the version of my code didn't incorporate anything so it
my mouse now aligned.
Huh.
Okay, right now I'm putting it on top of handler.
Is it on top of handler?
You're right, it isn't. Oh, Lord, that's really bad.
I have no idea that's being very stupid.
Anyway.
Okay.
Really? Kind of a totally stupid Zoom bug.
Actually, I think I know what it is.
Was it that way? Was the mouse, was the cursor aligned when I was sharing the whole desktop?
probably works that when I had my whole desktop being shared, it probably was
Okay.
I may do some experiments to see that, but that's just really
What if I highlight this? Do you see the highlights?
Okay. Anyway.
Yes, I mentioned you can use a but
So the reason why I brought up Cloud this time was
to show you
that you can use ai
But you probably shouldn'
I mean, you can't use it on midterm and final. That's forbidden.
On assignments if you want to like
you know, do it, but it has to still be your work so
What you should not be doing
is putting in your question
like a question I give you and put it directly into AI.
And the reason why you shouldn't is because it's probably not going to get you the right answer. And more importantly, you won't have a process
you'll have to now debug it and it'll actually cause you more problems.
So.
If I had done this.
And I asked me, what's my process for developing it? And you're getting this. If you look through this.
it gives you all this stuff and test it and things like this, but this code is wrong.
this code isn't right and it actually doesn't even make sense.
If you think about it.
Because first of all.
how is the cookie going to get set?
I haven't run this code yet, but I can just tell you it's broken.
right now. And the reason I can tell you it's broken
is first of all.
it's just asking for, it's doing this right here get cookie
See this function right here, get cookie
it's not defined.
No, it isn't. Are you around the code? It's higher up
Oh, they did define it. Oh, okay. It's not completely broken.
Okay, if not cookie string, cookies or cookies string splits
That's semicolon cookies
Yeah, that's a good point.
Anyway, I was thinking that was something else, but you're right. No, I was thinking it was using a built-in one. No, it defined its own get cookie.
Let's try…
I mean, the problem I find when I have
Whenever I find it does things, it does things that it's like
For simple ones, it actually does a pretty good job mostly. One thing I was not, when I said a private directory.
it's now like having the private directory inside the W directory. I wanted it outside but
This is actually a reasonable decision here.
status forbidden.
Did we…
Do we have a forbidden? Yeah, we did have a forbidden 403.
Yeah, actually, this looks pretty good.
This is kind of funny, though.
And this is kind of
Well, no, it's fine. This is basically what I asked for.
But when you start using these AI things and stuff like that, what you find out is you have to read the code
And you have to understand what it did.
And then you have to
build debug it for the subtle errors that we'll have.
Because that's the problem with this. It'll be mostly right.
But it'll have glitches.
Anyway, let's play with this.
And let's try doing our own version of this.
And let's try to make it actually work.
And so let's…
And let's take this.
secure server time.
Okay.
Okay, so now let's…
Move as well.
Okay, let's look at clothes.
So this is its code. Let's go ahead and
My favorite room.
And Watkins.
Emirac's good.
And let's…
Here, we're going to go here, we're going to go
Okay.
This is going to work very well.
Well, I can do that. I can just do my desktop. I can just do
So it wants
the directory is supposed to be here, get index
public file
Okay. So we've got our private
Which has got a secret file in it.
We have our public, which is this.
And then we've got our web server and we say Denna, and then we say
There we go.
on.
Right?
Good. This file is public.
That works.
And we now need to figure out
What cookie do we want to set?
So now let's…
Save cookies.
keep session cookies
txt file.
We can just send the header.
Okay.
Yeah, we got error forbidden.
that's what we expect.
But now let's say
the code works. How about that?
You don't understand what I did to make the file show? You mean the cat
Is that what you're asking about? What was this cat command?
So…
cat just concatenates the file to standard out.
it just loads it.
So I could have done a find and, you know, visited secret.txt.
And it's there but it's there
I was working in a terminal, so that's what I was doing so
I more mean the W again. Okay, the W again.
what happened here with the w get? So the first w get
I just say w get and I gave it the url
And the URL, it then returned an error forbidden. So we didn't get anything.
Then with this one, I set the cookie.
I set the cookie by just manually specifying, here's an HTTP header
And the header is cookie colon secret equals open sesame this.
And so then when I did this, it saved the file. I mean, w get by default, if it gets data back, it will use the name
of the last bit here, you can actually specify the name, but it just created the file secret.txt.
And so it said saving to secret.txt.
And it downloaded it.
And so that's where the file's here.
So, um.
Are you still confused?
okay so um
If you want, you can even speak up and have a voice if you're curious about it but
So the data set by the server
Really, cookies are a way to make these requests unique.
using data supplied by the server.
Cooking is set during the handshake or after the handshake?
The cookie is part of the HTTP headers
that are included so if you're
We know when you talk about a handshake.
you're talking about at the level of TCP
That's where you do the three-way handshake to actually say that both sides are talking to each other.
here when we're talking about a cookie
it's already been
set. So the connection's already been established
And when we say a request has
headers, the entire request goes
you know from the client to the server. And part of that request is the get
HTTP, whatever, but then it's also all the
headers that come along with that request.
Those are bundled in with the request.
those all go to the server and the server gets to parse them. We've already seen one header that we've used
content type. This is just another header. And there are all kinds of headers that are included.
But it's just metadata associated with that separate from the actual request.
So…
It's done on one request to the server sets the cookie
the response to the browser sets cookie
And then later requests from the browser.
Maybe I should make a little diagram here so
So.
So initially we have
later go.
So.
Yeah.
So this is the basic process of cookies.
is this back?
It's just back and forth.
So…
Do you all understand this?
please try to ask questions like related to what I'm talking about now.
because it's like i'm like
trying to, you know, trying to kind of like, you know, cover something here
So if you can steal the cookie, you have some sort of hijacking attack.
How did they get the name for a cookie?
That's actually a good question.
Check something.
Yes, I'm going to show you something.
So…
What I was showing here is…
if you know for you, that predates the web, it's using other things it's
Why is it called cookies? Now I'm actually kind of curious.
Let's go look at the
Can a browser um
I want to check that Wikipedia article.
real quick here.
But there's a question of can a browser forget a cookie and make the user lose access to something?
Ah, so browse jelly shouldn't modify cookies, but they can easily forget them.
So, uh.
Before I do this, I want to see if I can find that uh
Does it actually disclaim the history
The Wikipedia page for cookies
uh…
Okay, in computing a magic cookie or just cookie for short is a token or short packet of data
passed between communicating programs. A cookie is often used to identify
particular event as a handle transaction ID or other
between cooperating systems.
Oh, that's fine. The Wikipedia page, and let me just show you this this is
This is kind of fun. And then we will start talking security
Because this segues nicely into the other thing I was wanting to talk about.
So if you go here, the Wikipedia page on cookies.
It says the origin of the name, the term cookie goes coined by web browser programmer Aloo.
Montley. It was derived from the term magic cookie, which is a packet of data program a season sends back unchanged.
used by Unix programmers.
So…
Yeah, so that's what I'm saying, this magic cookie idea
Cooking data is typically not meaningful to the recipient program.
Contents are opaque and not usually interpreted until the recipient passes the cookie back to the sender. Perhaps another program at a later time.
you know, science regime mainly compare two cookies only for quality
So a query can be used like a ticket.
So…
early use. FTEL returns the current value of the offset relative to the beginning of the final stage with a named stream.
measured in bytes and Unix on Simpson, it is a magic cookie and the only foolproof way
to obtain an offset for F-SEQ.
So…
Yeah. Yeah, I think the analogy is like cookie is a token like a things, but like
All I can think is the people who are playing with this initially were just hungry and were thinking about cookies.
Thank you.
patients so um
Anyway, so there's now a question about how do we
Let's go back to
That's…
So going back here so
Okay, so…
So what the typical process is when you log into a website
is you log in
You enter some username, password, or some other way of authenticating yourself. Once you've authenticated yourself.
That data goes to the server. The server then sets a cookie in the browser.
that that cookie is your session cookie.
And now…
that cookie will be shown on subsequent requests, so the server can identify you as that user.
to like if you log into your banking app.
If someone wants to
basically get into your bank account. I mean, if they know your username and password.
Yes, they let you log in. But if you manage to grab that session cookie somehow.
You can also get access to everything.
but bypass the login screen. You just do that.
That's why you might notice with so many secure websites, they constantly ask you to log in again.
And again, and again, it's because the session cookies they use
that's what it's really about. The cookies are paranoid because they might
stolen, so it's only valid for a limited period of time.
But even if
the cookies are secure.
skill cookies and like they're not guessable cookies
if someone's listening on the network and you're doing things over HTTP,
you know.
anyone can, you know, it's it's
And listen.
Yes, sir.
Exactly. That's why everything is HBS.
It's just HV over TLS.
So when we talk about TLS,
TLS is this
way to basically make the transport layer
secure. And so what we're doing is we're doing HTTP over TLS. So you have TLS and HP happening on top of it. So all the normal semantics of HTTP
work. Now, there are different versions of HCTP, and we're really talking about like HP 1.1 right here but
At the level of application developers, it's all the same. It's only matters if you're actually implementing the underlying things like Deno supports
HTTP2, and I'm pretty sure there's probably some other ways to implement HB3, like at an application developer level, you're still doing gets and posts and
who cares about the low level stuff?
for the purposes of this class.
They're really the reason the newer versions are all about
making things more efficient.
But TLS is added on top of that.
well underneath it. So you have TLS, you establish a secure connection and
And then you do your HTTP over that.
And it's used for other protocols as well, because there's lots of older protocols, particularly for email and stuff, but there's all kinds of
weird things that are now done over TLS.
But to understand TLS,
you have to understand what is actually being secured and to understand that
So let's talk the guarantees are.
No eavesdropping, no undetectable tampering.
Do you either know who the server is or you know who the server and client are? Now you notice that
So username, password, two-factor authentication are used the other direction
TLS is used for authenticating the server to the client.
there's a lot of cryptography that's way outside the scope of
this class, exactly how that works
it's very cool stuff.
my big criticism of it is it's very brittle.
It's very fragile.
But if the assumptions of TLS hold, basically no one can listen in on this.
So…
What's really cool is even if you do things right with things like TLS,
You have secure communications between two parties. They send data back and forth.
someone could record all that data and then say, I can't read it now, but maybe I'll get the key later.
So they later go in and break in to maybe one side or the other side during the communication.
If you do things right.
Even if you broke into those, that past communication
is still unreadable.
Because the data necessary to understand it
was actually forgotten. So neither side knows it so
doesn't matter if you compromise it later.
So, yeah, so that's confidentiality, but so eavesdropping
Yes, that is confidentiality. Confidentiality
All right, so this is
So that's integrity. Normally we talk about security as confidentiality, integrity, and availability
There's also the entity authentication.
TLS does not do availability
It can do confidentiality, integrity.
And can do entity authentication.
that's all, you know, this sounds wonderful. This sounds amazingly, you know, secure, right?
But there's a big
big problem with it.
And I'm going to try showing you
So let me give you some basic ideas so uh
So a certificate has two things, a public key for the entity
And that's so…
So there's a lot to go around with publicly cryptography. I'm just giving you the very
tiny version of it, but a public key is used to encrypt or sign data
And a public key is used to decrypt or verify signatures.
Now, you can say
like what you're really, you know, a signature is um
you can call signing as encrypting
And…
verifying is decrypting so you can um
Oh my goodness, I'm making this wrong.
Digital signatures are a really cool concept.
Public key encryption is also a cool concept.
Again, these are weighed beyond the scope of this course.
But they do, I have a cat coming in wanting attention, but now she's walking away.
okay, I was going to show, I was going to bring up to show you guys but
Sorry, I'm busy.
Okay, I guess she saw that I'm busy as
We'll come back later for attention.
That's too funny. No, no, she's back.
Come here. Come here.
Okay.
You want to say hi to everyone?
This is shift.
hello okay yes okay yeah you want to look around. Okay. Okay. I will play with you in a little bit.
Anyway, we're talking about this. I want to show you, we've got a couple of minutes left.
I want to show you how certificates work in the browser.
I can talk more about these concepts and stuff but
I think the problem with certificates once you see this is
pretty clear.
Oh, goodness. Hi.
Nope, nope, nope. He shoots.
Sorry, my cat might try turning off my computer.
Come on. Now you have to go.
Come on, come on out. There you go.
Anyway.
So we're now looking at a web browser here.
You've all seen this little lock icon.
Let's click on this.
So site information for en.wikipedia.org. Connection secure.
You can clear cookies and site data.
you are securely connected to the site.
Verified by Let's Encrypt.
This is all true. This is all the TLS information.
Now, I don't think you can see that. Let's share.
So this is a little pop-up window
Okay, so this is the little thing that says about
the security of this page.
This website does not supply ownership information verified by Lust Encrypt.
Claire cookies, see a password. But now if I say view certificate
Oh, that it goes over back to the browser, sorry.
This is annoying.
some window capture.
My screen sharing decided to flake out on me.
Let's try that one more time.
Okay.
Okay, so here is the certificate.
So remember, we were looking at this site here
We're looking at here. There's a Wikipedia and so here is
And now it's saying this whole thing, certificate here.
what is this?
what is this whole thing? So this is saying
The certificate is valid not before
you know, October 15th and it's good till january
13th, 2025. So it's good for a few months.
It applies to all these domains.
here's the algorithm that's used for the public key algorithm.
Fingerprints are basically saying what
identifying it using a secure hash.
But notice this hierarchy.
at this and then you got this thing, and then you've got this.
So what it's saying is Wikipedia certificate is vouched by this certificate.
When the Internet Security Research Group, X1, and this one, you know.
So that's the issuer name. So that's this.
So the reason you trust this is Wikipedia is because
This certificate says so, and this certificate says so.
going back up to this.
Why is this trusted?
why is this certificate actually
worth anything.
Well…
Let's stop sharing here.
that hopefully this will not crash
Settings.
Okay, good.
I can still share here.
I guess it's now doing the solace in the browser. That's good.
So if you see in my settings here, we go to privacy and security
And you look here and then you go to
Let's try and that's cookies
Passwords are filled.
security certificates.
few certificates.
Can you see that?
Well, you can see this. Good.
I wasn't sure if you can see this modal dialogue.
These are the authorities that are allowed to sign certificates. So basically, if any of these guys say.
that a website is who it says it is
your browser believes it.
you should look through this list sometime.
And just scroll.
There's a lot of organizations in here.
And any of these organizations
can vouch for the domain of any
website. Now, there are various projects to try to limit this and do other things but
it's still, I mean, there's been progress in trying to make sure it's there and people are
to make sure certificates don't get issued and stuff but
If someone wants to do a targeted attack and like has a
has gotten, say.
talk to Swiss sign AG.
here and convince them that, oh, I'm Microsoft.
Issue me a certificate from Microsoft and then you go around and set up a malicious website that pretends to be Microsoft.com.
the world's browsers will believe it's Microsoft.com because Swiss sign AG said so.
And everything will work fine. I mean, you have to do potentially some network level attacks but
Those are completely doable, like if you're on an insecure
Wi-Fi network or something.
And then they can just be impersonate a website.
it's not great.
what's the lesson here of saying we're going to look and see how you do these certificates, how you generate
Just because you see this lock icon and things.
does not mean that every security problem is there. It means that you have some assurance that data over the network is not being messed with and not being eavesdropped on.
But you can't be sure you're talking to the website you think you are talking to.
how do you make sure it's that and not an imposter?
TLS does very little to help you with that.
there are ways to attack it at the certificate level. And then also a lot of people don't understand like the difference with like
what does this actually mean, this domain name? Because you actually have to look to say, is this the site I expected it to be?
like what's the right domain name associated with your bank?
Funnily enough, banks often use really weird domains, especially when you're logging in.
It can be a problem.
Anyway, I'm out of time.
We'll continue with this on Thursday when we talk about
tutorial wait.
So up.
Have a good day, everyone, and I will see you then.
Good luck with the assignment three.