3 ms·
The other possibility is somehow intercepting them between SSL termination and hashing.
by TallGuyShort 10y ago
The other possibility is somehow intercepting them between SSL termination and hashing.
- perfectfire 10y agoThat's a good point. If they got ahold of Yahoo's cert key they could even grab passwords before SSL termination.
- schoen 10y agoNot passively anymore: login.yahoo.com is negotiating PFS ciphersuites which the private key can't decrypt without a copy of the ephemeral ECDHE parameters.