{"action":"opened","issue":{"url":"https://api.github.com/repos/TEAMMATES/teammates/issues/4852","repository_url":"https://api.github.com/repos/TEAMMATES/teammates","labels_url":"https://api.github.com/repos/TEAMMATES/teammates/issues/4852/labels{/name}","comments_url":"https://api.github.com/repos/TEAMMATES/teammates/issues/4852/comments","events_url":"https://api.github.com/repos/TEAMMATES/teammates/issues/4852/events","html_url":"https://github.com/TEAMMATES/teammates/issues/4852","id":137572921,"number":4852,"title":"Generated links should use HTTPS","user":{"login":"thngkaiyuan","id":10496851,"avatar_url":"https://avatars.githubusercontent.com/u/10496851?v=3","gravatar_id":"","url":"https://api.github.com/users/thngkaiyuan","html_url":"https://github.com/thngkaiyuan","followers_url":"https://api.github.com/users/thngkaiyuan/followers","following_url":"https://api.github.com/users/thngkaiyuan/following{/other_user}","gists_url":"https://api.github.com/users/thngkaiyuan/gists{/gist_id}","starred_url":"https://api.github.com/users/thngkaiyuan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thngkaiyuan/subscriptions","organizations_url":"https://api.github.com/users/thngkaiyuan/orgs","repos_url":"https://api.github.com/users/thngkaiyuan/repos","events_url":"https://api.github.com/users/thngkaiyuan/events{/privacy}","received_events_url":"https://api.github.com/users/thngkaiyuan/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-03-01T13:21:17Z","updated_at":"2016-03-01T13:21:17Z","closed_at":null,"body":"Generated links (e.g. in emails) should use HTTPS instead of HTTP to reduce the risk of a man-in-the-middle (MITM) attack since the links themselves may contain sensitive information (e.g. reusable student keys).\r\n\r\n## Example of an attack (proof-of-concept)\r\n1. An attacker performs ARP poisoning on all hosts on the subnet to carry out a MITM attack.\r\n2. All traffic on the subnet now passes through this attacker. \r\n3. Since HTTP requests are unencrypted, all request URIs will be visible to the attacker.\r\n4. The attacker can then filter HTTP requests to the Teammates website and gather all traffic that contains student keys and emails.\r\n5. The attacker can then reuse the same keys and emails to impersonate any student on Teammates."}}