3 ms·
That is correct. However it's trivial for a MiTM attacker to perform an SSL stripping attacks when the victim is communicating with sites that support plain HTT
by edeirme 10y ago
That is correct. However it's trivial for a MiTM attacker to perform an SSL stripping attacks when the victim is communicating with sites that support plain HTTP.
- jp3141 10y agoeven with HSTS?
- edeirme 10y agoIf a website employs the use of HSTS all traffic will be redirected to HTTPS, rendering the support for HTTP redundant.
- marichards 10y agoHmm, if you can control the plaintext network isn't there an NTP attack to reverse time and use old compromisable certificates or move it forward past hsts max age?
- deleted 10y ago[deleted]