3 ms·
The reference implementation's domain is vulnerable to MITM attacks between KeeWeb and CloudFlare until they set their CloudFlare crypto settings to "strict" an
by Sephr 11y ago
The reference implementation's domain is vulnerable to MITM attacks between KeeWeb and CloudFlare until they set their CloudFlare crypto settings to "strict" and get some real certificates of their own (e.g. Let's Encrypt).
I submitted an issue here: https://github.com/antelle/keeweb/issues/111 https://github.com/antelle/keeweb/issues/111
Of course exploiting this would be very difficult, but it is possible to MITM the connection between the CloudFlare proxy and GitHub pages as long as keeweb.info continues to not use DNSSEC.
- Sephr 11y agoUpdate: The author has reasonably mitigated this vulnerability. This isn't much of an issue now.