3 ms·
But it correctly supports HTTPS right? If so, then a MITM attack shouldn't be possible unless your system trusts a bad CA.
by gatmne 9y ago
But it correctly supports HTTPS right? If so, then a MITM attack shouldn't be possible unless your system trusts a bad CA.
- sanxiyn 9y agosslstrip exists. HTTPS support doesn't matter if you don't get HTTPS.
- willstrafach 9y agosslstrip does not stop HTTPS connections. It simply replaces https links on a page with http, and that itself requires the initially manipulated page to be served over plain HTTP. It was far more relevant when websites were mostly HTTP, but used HTTPS for login or payment pages.
- CydeWeys 9y agoIt doesn't stop HTTPS connections, but if I type in randomdomain.com in my browser and hit return, that sends an HTTP request by default. If someone is intercepting my connection, they can modify what's being returned by the webserver, and even if the server itself only serves via HTTPS, the man-in-the-middle program can simply terminate HTTPS and then serve a modified version of the now-unencrypted contents via HTTP. The only way to get guaranteed security is if your browser will only ever make HTTPS connections to a given domain name, and that requires HSTS preloading.
- dogma1138 9y agoYour carrier can preload any CA certificates it wants on the device and install them OTA at least on android devices. iPhones are a bit more restrictive apps can install their own CA/trusted certificates but these are accessible to the only the apps iirc Apple manages the general trust store on its own with system update.
- CydeWeys 9y agoHistory lesson incoming: https://www.youtube.com/watch?v=MFol6IMbZ7Y https://www.youtube.com/watch?v=MFol6IMbZ7Y The only effective way to get guaranteed security is with HSTS preloading. Anything short of that leaves you vulnerable to the linked attack, which dates way back to 2012.