Multiple download links on minecraft.net and account.mojang.com use http instead of https
The bug
Multiple download links on minecraft.net use http instead of https. All affected links can be replaced since the respective servers support https. Without HTTPS, some platform users (such as Linux) have no verified chain of trust back to Mojang. This chain of trust is essential for a secure execution environment.
Affected links
Linux
https://minecraft.net/en-us/download/?ref=bm
- Download button on the right: http://s3.amazonaws.com/Minecraft.Download/launcher/Minecraft.jar
- Java download link: http://java.com/
https://account.mojang.com/me
- Link for Tux icon
General
https://minecraft.net/en-us/download/alternative
Linked Issues
ImportantCreated Issue:
Linux Minecraft.jar Download is Not Secure
The download for Linux's Minecraft.jar at https://minecraft.net/en-us/store/minecraft/?ref=m#owned defaults to insecure HTTP. As far as I know, unlike EXEs, plain JARs do not perform any certificate validation before being executed. It is no longer generally acceptable to provide executable code in an insecure manner. With plain old HTTP, the executable code could be altered in transit by a skilled adversary. The Amazon download server supports HTTPS which can be tested by manually changing the URL. To fix this issue, all you need to do is add an 's' into the download link. i.e. change http://s3.amazonaws.com/Minecraft.Download/launcher/Minecraft.jar to https://s3.amazonaws.com/Minecraft.Download/launcher/Minecraft.jar
Thank you.
Environment
Any.
![[Mod] Pokechu22](../../../data/avatars/users/92931.png){kind=small}
![[Mod] Neko](../../../data/avatars/users/92901.png){kind=small}
MC-116440 → 
WEB-787![[Mod] bemoty](../../../data/avatars/users/50554.png){kind=small}
Normal
Linux Minecraft.jar Download is Not SecureMultiple download links on minecraft.net use http instead of https
The download for Linux's Minecraft.jar at https://minecraft.net/en-us/store/minecraft/?ref=m#owned defaults to insecure HTTP. As far as I know, unlike EXEs, plain JARs do not perform any certificate validation before being executed. It is no longer generally acceptable to provide executable code in an insecure manner. With plain old HTTP, the executable code could be altered in transit by a skilled adversary. The Amazon download server supports HTTPS which can be tested by manually changing the URL. To fix this issue, all you need to do is add an 's' into the download link. i.e. change http://s3.amazonaws.com/Minecraft.Download/launcher/Minecraft.jar to https://s3.amazonaws.com/Minecraft.Download/launcher/Minecraft.jar
Thank you.
The bug
Multiple download links on minecraft.net use http instead of https. All affected links can be replaced since the respective servers support https.
Affected links
Linux
https://minecraft.net/en-us/download/?ref=bm
- Download button on the right: http://s3.amazonaws.com/Minecraft.Download/launcher/Minecraft.jar
- Java download link: http://java.com/
General
https://minecraft.net/en-us/download/alternative
The bug
Multiple download links on minecraft.net use http instead of https. All affected links can be replaced since the respective servers support https. Without HTTPS, some platform users (such as Linux) have no verified chain of trust back to Mojang. This chain of trust is essential for a secure execution environment.
Affected links
Linux
https://minecraft.net/en-us/download/?ref=bm
- Download button on the right: http://s3.amazonaws.com/Minecraft.Download/launcher/Minecraft.jar
- Java download link: http://java.com/
General
https://minecraft.net/en-us/download/alternative
The bug
Multiple download links on minecraft.net use http instead of https. All affected links can be replaced since the respective servers support https. Without HTTPS, some platform users (such as Linux) have no verified chain of trust back to Mojang. This chain of trust is essential for a secure execution environment.
Affected links
Linux
https://minecraft.net/en-us/download/?ref=bm
- Download button on the right: http://s3.amazonaws.com/Minecraft.Download/launcher/Minecraft.jar
- Java download link: http://java.com/
https://account.mojang.com/me
- Link for Tux icon
General
https://minecraft.net/en-us/download/alternative
Multiple download links on minecraft.net and account.mojang.com use http instead of https
![[Mojang] Web Team](../../../data/avatars/users/10122.svg){kind=small}
[Mojang] Web Teamrelates to
The bug
Similar to WEB-787, there are non-download links on https://account.mojang.com/me which use http instead of https.
This list is likely incomplete:
- minecraft.net
- minecraft.net/profile
- "Minecraft for Windows 10" redeem link
- help.mojang.com (on https://account.mojang.com/me/settings)
From the menu bar:
- Games
playcobalt.com(This site does not even support https, seeWEB-1078)- minecraft.net
- scrolls.com (should be https://callersbane.com/)
Can confirm, also an issue with the alternative download page.
They can (there can be certificates within META-INF, and there are for the main launcher but not the bootstrap), but it's not required and you won't get a warning if they aren't present (only if they're invalid). But HTTP does mean you can fully replace the file, so it wouldn't actually make a difference.
In the modifications of this bug, the original problem that this bug is attempting to address has been lost. I've updated the description to reflect this.
The problem is not really that the links are not HTTPS. Making them HTTPS was more of a recommended solution. The problem is that, by default, users of some non-Windows platforms are executing code without any type of secure code verification.
Also, I find it rather concerning that a security related bug is marked as minor.
Updated. WEB is the only project that has priority enabled, and even then the priority field isn't actually used that often, so it's easy to forget about it.