5 ms·
Once you have the host key for the site you are connecting to on your laptop SSH is not vulnerable to a MITM attack in the same way that browsers are with their
by onedognight 17y ago
Once you have the host key for the site you are connecting to on your laptop SSH is not vulnerable to a MITM attack in the same way that browsers are with their huge CA list. Of course, pay attention to the warnings about changed host keys.
- swolchok 17y agoPatently false. If users submit to the login URL through a link that was sent in the clear, a MITM can just run sslstrip (http://www.thoughtcrime.org/software/sslstrip/ http://www.thoughtcrime.org/software/sslstrip/) and presto, you're visiting the HTTP version of the page instead of HTTPS. The login URL needs to be unavailable over HTTP, as does the login form.