4 ms·
HTTPS does nothing for you in this case. The passwords are generated locally with JavaScript, and there is an option you can check to prevent them being sent ba
by Udo 11y ago
HTTPS does nothing for you in this case. The passwords are generated locally with JavaScript, and there is an option you can check to prevent them being sent back to the server. But even if they actually were generated on the server, HTTPS would be of limited use, since you'd still have to trust the server itself and the people operating it.
- itcrowd 11y agoGood point. However, the dictionaries also need to be transferred to the user and a MITM could easily replace this with his own (flawed) dictionary. Same point: JavaScript injection/modification. HTTPS doesn't guarantee that the dictionary isn't flawed or the JS is secure, but it does guarantee that the received data/scripts/dictionaries are exactly the ones the server intended to send.