{"action":"opened","issue":{"url":"https://api.github.com/repos/piwik/piwik/issues/8235","labels_url":"https://api.github.com/repos/piwik/piwik/issues/8235/labels{/name}","comments_url":"https://api.github.com/repos/piwik/piwik/issues/8235/comments","events_url":"https://api.github.com/repos/piwik/piwik/issues/8235/events","html_url":"https://github.com/piwik/piwik/issues/8235","id":91399306,"number":8235,"title":"default config: api_service_url to use https","user":{"login":"thomaszbz","id":11200727,"avatar_url":"https://avatars.githubusercontent.com/u/11200727?v=3","gravatar_id":"","url":"https://api.github.com/users/thomaszbz","html_url":"https://github.com/thomaszbz","followers_url":"https://api.github.com/users/thomaszbz/followers","following_url":"https://api.github.com/users/thomaszbz/following{/other_user}","gists_url":"https://api.github.com/users/thomaszbz/gists{/gist_id}","starred_url":"https://api.github.com/users/thomaszbz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thomaszbz/subscriptions","organizations_url":"https://api.github.com/users/thomaszbz/orgs","repos_url":"https://api.github.com/users/thomaszbz/repos","events_url":"https://api.github.com/users/thomaszbz/events{/privacy}","received_events_url":"https://api.github.com/users/thomaszbz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-06-27T01:40:48Z","updated_at":"2015-06-27T01:40:48Z","closed_at":null,"body":"Current download of piwik 13.x comes along with\r\n\r\n    api_service_url = http://api.piwik.org\r\n\r\nThis should be changed to https asap, because MITM could compromise the api output otherwise (keep in mind that the output is presented to user including links, update information etc.)\r\n\r\nThis issue (#1867) has already been discussed 5 years ago. Now that https-api is available for a long time you should default to it. We have 2015 now and attackers use every possibility they can find.\r\n\r\nVia MITM, tt potentionally compromises all the nice automatic update, can be used for phishing attacks, ...\r\n\r\nUsers should be recommended to use https if they have overridden the global.ini.php default."}}