3 ms·
If the attacker has ability to inject code, can't they simply redirect you to non-https version of the website on their servers anyway?
by 6d6b73 11y ago
If the attacker has ability to inject code, can't they simply redirect you to non-https version of the website on their servers anyway?
- hwdsl2 11y agoThey could. But how would they show the users their desired contents after login?
- notatoad 11y agoDoesn't matter, they've already gotten your password at that point. They can just say "login failed" and redirect you to the real login page
- kilburn 11y agoThat's one of the reasons why HSTS [1] was invented. Basically your website itself informs the browser to never contact it though http. Then a man-in-the-middle, which can inject whatever in any http pages you visit, simply cannot inject (nor replace) your website ever, because they (supposedly) cannot fake a valid certificate covering your domain. You can even submit your domain [2] so that current browsers automatically apply the https-only preference to your domain, even when it hasn't ever been contacted before. Cool, isn't it? [1] https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security [2] https://hstspreload.appspot.com/ https://hstspreload.appspot.com/