4 ms·
>If a site provides only HTTPS then sslstrip would fail as it can't fall back to HTTP I don't believe this is true. Sslstrip would get the site in HTTPS and se
by ikeboy 10y ago
>If a site provides only HTTPS then sslstrip would fail as it can't fall back to HTTP
I don't believe this is true. Sslstrip would get the site in HTTPS and serve it to you in HTTP, right? Only pinning or hsts would prevent that, HTTPS only servers wouldn't help.
I guess they could mean hsts by HTTPS only, but the end of the article implies otherwise.
>Certificate pinning, though, is limited to Google sites at present
This is also false.
I'd also hope they'd mention something like HTTPS everywhere which also mitigates this.
- prashnts 10y agoMITM tools such as [0] can also generate new certificates on the fly. So, unless HSTS is enabled, the user will still see the green padlock. This, obviously is only possible if the signing authority is in the device's trusted CAs. But I'd assume that corporate systems would have local CAs trusted by their admins. [0] MITM Proxy https://mitmproxy.org https://mitmproxy.org
- lucaspiller 10y agoAlso it should be noted that Chromium will ignore certificate pinning if a private root certificate is used. So this will do nothing to prevent corporate snooping.
- pfg 10y agoWhich makes sense, because anyone who could install a root certificate on your system could easily disable any such check, backdoor Chrome, install a keylogger, etc. This would lead to a false sense of security, which I believe would be worse than the status quo.
- n0on3 10y agoexactly the comment I was going to write :)