7 ms·
not just unencrypted - traffic for any website that doesn't use HSTS. All they need to do is intercept a single HTTP page and then they can modify it to contai
by dgoldstein0 10y ago
not just unencrypted - traffic for any website that doesn't use HSTS. All they need to do is intercept a single HTTP page and then they can modify it to contain iframes to their favorite sites over http, and any site without HSTS can then be owned.
- dgoldstein0 10y agoHopefully though everyone sets the secure flag on important cookies... I wouldn't bet on it, but I suspect it may be more common than HSTS.