3 ms·
This is all orchestrated over a HTTPS transport, the transport does not use certificate pinning.
by johnflan 10y ago
This is all orchestrated over a HTTPS transport, the transport does not use certificate pinning.
- toyg 10y agoOrchestrated how? If the passwords are not going over the wire unencrypted, it doesn't really matter how secure the wire is -- unless the attacker is also actively replacing stuff that does go on the wire and would touch unencrypted passwords at some point, like JS files, but that indeed requires an active attacker.
- johnflan 10y agoA very simple case would be logging into lastpass.com, your password is passed to lp.com via a https transport.