Not that hard. It's pretty easy to social engineer a typical not-HN user to install an arbitrary root cert to the trusted store. Another commenter mentioned ce

Not that hard. It's pretty easy to social engineer a typical not-HN user to install an arbitrary root cert to the trusted store. Another commenter mentioned certificate pinning, and it Peach does this, and refuses non-secure API requests, I'd agree it's overblown. It is a vulnerability, yes, but where's the exploit? An honest query to add on: wouldn't a nonce-style expiration digest be sufficient to prevent this hypothetical reply attack from being effective once the nonce expired?