3 ms·
As someone else said, public wifi network, DNS hijack and boom, you've got their credentials.
by philjohn 9y ago
As someone else said, public wifi network, DNS hijack and boom, you've got their credentials.
- ricardobeat 9y agoSame as DNS hijacking any website where the user has an account. What's the security issue in Exchange here?
- ktta 9y agoDNS hijacking shouldn't result in credential compromise if TLS is implemented properly. TLS is implemented here, but incorrectly (hold on) because the credentials are sent as soon as the validation fails and a dialog shows up (about the invalid certificate). So the user will realize they are being MITMed but the credentials are sent even if they don't continue. https://news.ycombinator.com/item?id=15322740 https://news.ycombinator.com/item?id=15322740