3 ms·
Although I found the comment funny, the paypal button sends the data to https://www.paypal.com/.. https://www.paypal.com/... so wouldn't http be just as safe? (
by tonmoy 10y ago
Although I found the comment funny, the paypal button sends the data to https://www.paypal.com/.. https://www.paypal.com/... so wouldn't http be just as safe? (As long as the MIM does not serve a altered version of the page that has attacker's site instead of paypal's that looks exactly alike as paypal I guess)
- qu4z-2 10y agoYeah, so your details are protected from passive wiretapping/MitMing, but not any active attempts (see sslstrip).
- icebraining 10y agoPaypal is on the HSTS preload list, so if you're using a reasonably recent browser version, sslstrip (without changing the domain) shouldn't work.
- qu4z-2 10y agoAh, I didn't know this. Thanks.