3 ms·
Am I missing something, or is this suggestion trivially mitm-able? If you fail to forward the request the upgrade, neither side will know something is missing.
by thedufer 10y ago
Am I missing something, or is this suggestion trivially mitm-able? If you fail to forward the request the upgrade, neither side will know something is missing.
- spb 10y agoI think you're missing the part where a non-upgraded connection will be treated by the client as insecure and untrustable.
- thedufer 10y agoSo the suggestion is that in 1994 (when the https protocol was introduced) we should have put big scary warnings on every non-ssl site? I don't see how that could've gone well. It's now 22 years later and people still aren't ready for that.