WingNews logo WingNews
top | item 38837975

The Bureau of Meteorology website does not support connections via HTTPS

40 points| timetoogo | 2 years ago |bom.gov.au

56 comments

order

kspacewalk2|2 years ago

What practical difference does it make if I connect to an Australian weather forecast site via HTTP or HTTPS? Is the NZ secret police gonna MITM a rain forecast my way when it's actually gonna be a very sunny day?

Strilanc|2 years ago

A government site has implicit authority. You could use that implicit authority to make a scam look more authentic. It also will have a lot of traffic; a lot of opportunities for the scam to work if you do manage to get in the middle.

For example, inject a dialog box that says "Our records indicate your taxes were not paid this year! Before you can view the weather you must click here and log in to resolve this issue!".

paleface|2 years ago

Aside from browsing history, privacy implications, some ISPs insert adverts, into the HTML - possibly opening up the user, to drive by browser exploits…

The reality is, it’s not complicated to add HTTPS, as a feature, so there’s no good reason as to why it’s not implemented - aside from incompetence, or trying to save money, on staff?!

mike-cardwell|2 years ago

You can sign in to this website. If you do, your password has been sent over clear text. People re-use passwords across sites.

verve_rat|2 years ago

Nah, the NZ secret police is too busy removing NZ from maps so no one can find us.

akdor1154|2 years ago

I wonder if you could mitm an HSTS header.. short term dick move but might raise enough of a stink for it to be fixed..? I can only dream.

fowl2|2 years ago

HSTS headers are only respected on HTTPS connections

cjs_ac|2 years ago

The Bureau of Meteorology has form when it comes to computer security incidents[0].

[0] https://www.abc.net.au/news/2018-03-08/bureau-of-meteorology...

defrost|2 years ago

Employees on the inside using the data cruncher to mine bitcoin isn't a HTTPS issue - given these chancers were caught it appears the BOFH functioned uncorrupted and reported their illicit cycles.

pophenat|2 years ago

I find intriguing their explanation about how to use their FTP service and why it’s not possible to access it with a modern browser.

http://www.bom.gov.au/catalogue/anon-ftp-hints.shtml

matrss|2 years ago

They make an (easily made) mistake on that page: the encrypted version of FTP is not SFTP, but FTPS. SFTP is an entirely different protocol based on SSH.

slowbdotro|2 years ago

Back in 2013-15 I was fortunate enough to know some people at BoM, specifically done IT people.

Their off hand comment around why BOM didn't have https was due to the amount of overhead and infrastructure changes needed to make that https change.

Fast forward to 2018ish they recently created a new API, and a new website. Https://Weather.bom.gov.au with https enabled! (which I now have integrated into a raspberry pi and an eink display for my morning weather).

For whatever (archaic) reason the new weather webui is now defunct but the api still exists, uses https, and as far as I know supports their mobile applications.

All it would take is for some ISPs here to mitm the traffic with ads / junk and maybe they would change it. The upside to this story is that it is currently a great site to visit for captive portal detection.

davidbanham|2 years ago

I am very interested in this api. How do I get at it?

AFAIK the only way to programatically obtain bom data is the awful ftp endpoint.

JonathanBeuys|2 years ago

HTTPS is still a pain in the ass, even in 2024.

If letsencrypt would offer wildcard certificates with their url based authentification as they offer for non-wildcard certificates, it would be ok.

But having to tinker with the DNS infrastructure for each project which wants to use domain wide HTTPS is so much hassle.

lgeorget|2 years ago

It depends on your provider though. I can tell from experience that with OVH and their API, it's been easy to set up the automatic renewal via DNS verification. Apparently, the official client has support for the DNS API of 159 providers: https://github.com/acmesh-official/acme.sh/wiki/dnsapi

8organicbits|2 years ago

What's the challenge for you? Does your DNS server not have an API, is it internal politics and process, or something else?

NL807|2 years ago

I personally know someone working at BOM. His endless ranting about how the place is run is hilarious.

pwdisswordfishc|2 years ago

Well, credit where it’s due: given the number of disparaging statements about cryptography made by Australian politicians, it seems they actually practice what they preach.

gia_ferrari|2 years ago

The fact that this is on a .gov.au makes it a bit more attractive to targeted MITM attacks, I would think, given a government site's position of authority.

dottjt|2 years ago

I remember seeing this yesterday when visiting the site. Wasn't sure if it'd always been like this, or if this was recent.

exikyut|2 years ago

Probably your browser trying HTTPS-first

ulrischa|2 years ago

Controverse opinion: Why do I need https when looking for the weather forcast. Https is blindly thrown on everything. If the data is public and no login or personal/sensitive data is involved why do I need https?

matrss|2 years ago

> If the data is public and no login or personal/sensitive data is involved why do I need https?

Do you care about if the data actually comes from your weather forecasting service and was not tampered with by a third party? Then you need https as well.

A different example: a podcasts website I've seen was served over http, and someone argued the same (data is public, no login). The page contained an IBAN for donations. That would be a valuable target to replace as an MitM.

mplewis9z|2 years ago

What happens when a site you really do need and have HTTPS on (your bank, say) has a cross-site request forgery vulnerability, and someone plops an exploit script on that non-HTTPS site you visit? With crafty enough hackers, your savings just got wired to a foreign country.

The entire internet needs to be HTTPS to protect against stupid security decisions made long ago that we can’t undo now in the name of backwards compatibility.

harrymit907|2 years ago

Your LE friendly ISP can insert a JS browser exploit and gain access to your device. Is that a valid reason?

la_oveja|2 years ago

seeing verdana gives me such good memories back. my fav font when i started learning webdev

einpoklum|2 years ago

So? it also doesn't scramble voice calls when you call their offices, I would think.

ksaho|2 years ago

Welcome to Australia. This has been an issue for years, and I don't know why.

defrost|2 years ago

The rationale, such as it is, is that BoM serves current and historic weather parameters for various parts of Australia and hasn't seen any need to ensure that be delivered in a secure manner to individual web users.

There might be some hypothetical scenario from faking weather data and injecting it to fool the casual user but that seemingly hasn't come up in practice and so they don't fuss about it.

On the flip side, for those interested in RAW downloads from MODIS and other sats relevant to the weather, to ground station raw data transfers, to modelled predictions under various assumptions for commercial | military | government use etc ... BOM has secure login and bulk data transfer protocols, and has had those for at least 30+ years (morphing with time).

LAC-Tech|2 years ago

NZ feels behind Australia in most ways. But in this area we're ahead. It's slightly insane to me a country as wealthy as yours still has this sort of thing going on.

springah|2 years ago

Assuming this has come from Tall Paul Tech’s latest video?

LAC-Tech|2 years ago

DJ Tall Paul is a tech youtuber!?! fuck yeah

matrss|2 years ago

Honestly, I think every third-party involved in transporting http traffic should do the public a service and replace the transmitted data with some cat images or whatever else. Every unencrypted connection should be messed with so that there cannot be accidental unencrypted transmission of sensitive data, just in case.

FpUser|2 years ago

It least someone had decided to have common sense.