4 ms·

What about DNS spoofing[1] at the local network level? [1] https://en.wikipedia.org/wiki/DNS_spoofing https://en.wikipedia.org/wiki/DNS_spoofing

• p49k 8y ago
  The spoofer wouldn’t be able to obtain a valid certificate for the spoofed site, though.
  • swiftcoder 8y ago
    The spoofer can obtain a valid certificate for another, seemingly legitimate site. Any software that hasn't explicitly pinned the leaf TLS certificates will still accept the (valid) certificate it is redirected to. And sadly, a lot of software still doesn't perform certificate pinning.
    • tedunangst 8y ago
      How is this redirect performed?
      • ktta 8y ago
        When a URL is manually typed in, and HSTS or HSTS-preloading isn't enabled, the initial 301 redirect would be http.
      • dlubarov 8y ago
        It could just be a 3xx redirect over clear http, right? The http site can redirect to a https site with a similar name.
    • deleted 8y ago
      [deleted]
• adamconroy 8y ago
  it might redirect to a malicious web page, but https would still prevent a problem. perhaps read the article you posted.
  • stordoff 8y ago
    Only if they are serving HTTPS or HTTPS is pinned. Otherwise, aren't you relying on the user noticing the lack of HTTPS (which I wouldn't want to do)?
  • krn 8y ago
    The user can just be redirected to another similar looking site with a valid TLS certificate.
    • tedunangst 8y ago
      How?
      • ktta 8y ago
        https://gmail.com.inbox-redirect.pro https://gmail.com.inbox-redirect.pro This will seem like a valid website, especially if the phishing site is done well. Not just non-technical users, I'd wager some tech familiar users would be fooled too. The focus always being on the lock icon might not always cover it. Safari will prevent this though.
        • aaron_m04 8y ago
          Isn't that why browsers visually distinguish the TLD and the part before it from the rest of the URL?
      • krn 8y ago
        SSL/TLS downgrade attack when HSTS is not enabled.