2 ms·
Regarding the MITM, more specifically i meant able to compromise HTTPS. If i sit between you and your https site, can i read all of your traffic? I know very l
by notheguyouthink 10y ago
Regarding the MITM, more specifically i meant able to compromise HTTPS. If i sit between you and your https site, can i read all of your traffic?
I know very little about the nitty gritty of HTTPS, so forgive my ignorance, but i thought the most i could do was try to pass off a custom key (ie, spoof the key authority), but then the signing done from the https site (say, https://google.com https://google.com) wouldn't be valid based on my bad key.
How common is it to read full https data if you're a MITM?
- cjcampbell 10y agoIt's not likely that they would attempt active attacks to decrypt your TLS web traffic. I'd assume they won't be able to read the full contents of those sessions. STARTTLS on mail is a slightly different story, though I'm going to assume that most of the established compaines are smart enough fo avoid email snooping. You might, however, be surprised at how much you give away via the metadata associated with your web browsing.
- UncleMeat 10y agoYou don't need to compromise HTTPS. You need to get your cert onto the trusted list on the device. "As part of the setup for Comcast-Super-PlanTM please run this script" is enough to let your ISP terminate the SSL connection and restart it so they can read content. In the worst case, they can pay a company like Lenovo to stick their certs on devices on day 1.