3 ms·
That opens you up to any active attacker simply stopping traffic. You're usually safe against passive attacks if the network has no glitches, but completely vul
by Buge 11y ago
That opens you up to any active attacker simply stopping traffic. You're usually safe against passive attacks if the network has no glitches, but completely vulnerable to active attacks.
Then again, if you don't use https on the whole site, active attacks could already simply change the url of the iframe to be http and intercept that with sslstrip, and passive attacks could already steal cookies.
- Zarel 11y agoYeah, I was going to ask the user for confirmation before falling back to HTTP, when I realized what you did: an active attacker can just change the URL of the iframe. Anyone who really needs secure pokemon battles can just use the HTTPS site, anyway. (Which does ask the user for confirmation before falling back to HTTP, if an HTTPS connection fails)