Quote from: stingleword on December 21, 2015, 05:11:05 PM

Quote from: nachoig on December 20, 2015, 09:39:30 PM

Quote from: stingleword on December 20, 2015, 03:31:33 PM

A MITM attack against LuckyBit could - at worst - replace the game addresses with malicious ones.

This is a sufficient reason to put HTTPS. The attacker has a financial incentive to repllace those addresses.

Quote from: stingleword on December 20, 2015, 03:31:33 PM

There has never been a report of MITM attacks against LuckyBit.

Until it happens. But why wait until an incident happens if you already can fix the issue?

SSL implementation is not a simple process. Getting a signed certificate, implementing security across the site and filtering for non-essential services such as the LuckyBit Community Hub are not a quick-switch option. These things take time and money that aren't justified by a "potential" threat that hasn't been realized and can be easily avoided by customers. Most of our players don't even depend on the site to provide the addresses; the information is available elsewhere and the majority of wallets also provide address-book services that would make this attack ineffective.

tl;dr: not worth the effort for an attacker, not worth the effort for us

Man in the middle attack isn't a problem for luckybit because:

1.- MITM is a LAN attack. That mean the only users who will be affected are those who are on the local area network of the attacker. Users access point is users responsability, if you are on a not secure network better don't use bitcoin, because if you are under MITM attack, the hacker will not change the betting addys, he will get your blockchain.info wallet access information.

2.- MITM can be detected by users with tools like wireshark. But is responsability of the user to verify if the network is secure.

3.- MITM have a tool called sslstrip to bypass the SSL connection, so, change the site to SSL will fix nothing about the attack.

Make a man in the middle to change luckybit addys, is one of the worst things you can do with this attack. Because if the users don't see the bets rolling they will ask to support what happen?, then we will ask for the TX ID, and in that moment we will see the fake addy. How much the hacker get? 0.005? 0.01?... not really a big lost. So, that attack is just a waste of time if some one is thinking about use it that way.

I want to make emphasis on the point of; This has never happened to luckybit and isn't something to worry about.