3 ms·
Yeah, because MITMing the origin page to submit to evil.example.org is trivial.
by Piskvorrr 10y ago
Yeah, because MITMing the origin page to submit to evil.example.org is trivial.
- jessaustin 10y agoIn such a case one would expect the evil page to present something that looked like a credit card input to the user, but not to the browser. Sites would still want to use HSTS to combat the MITMing itself.
- Piskvorrr 10y agoNope, too risky. Just redirect to an evil HTTPS page, and do all your phishing there - look, it's got the green lock and everything >;-)