4 ms·
Because setting up a let's encrypt certificate is almost as easy as to making a self signed one. We're talking about typosquatting, having a completely valid do
by DiThi 9y ago
Because setting up a let's encrypt certificate is almost as easy as to making a self signed one. We're talking about typosquatting, having a completely valid domain of your own that is the same as someone else's but with a typo.
Edit: From what it is said in another comment, it's not exactly about typosquatting, but the author expresses the problem very badly. It seems credentials are sent to the domain before the certificate is checked. So one is vulnerable to DNS spoofing in e.g. a public wifi.
- lesserknowndan 9y agoI'm not sure how they can be more clear than the first sentence, "So back in February I discovered that an iPhone was sending usernames and passwords unencrypted to an exchange server even when SSL was enabled." Are you saying the later text contradicted this statement?
- deleted 9y ago[deleted]
- ktta 9y agoIt was a bit confusing since he talks about typosquatting. He also talks about credentials sent unencrypted when SSL is off, which further makes everyone question the validity of his claims. But he did find a vulnerability in iOS's Mail app.