3 ms·
Perfectly valid cert for the evil.com domain - someone below pointed out that I flipped the domain names. In reality the "evil" page would look something like
by hguant 8y ago
Perfectly valid cert for the evil.com domain - someone below pointed out that I flipped the domain names.
In reality the "evil" page would look something like "https://www.login.chase/login?id=DEADBEEF/.evil.com" https://www.login.chase/login?id=DEADBEEF/.evil.com". For a non-trivial number of users, that's enough - "I see the nice green lock, I see chase, and some crazy web address characters that are always there".
- SamBam 8y agoHuh? "https://www.login.chase/login?id=DEADBEEF/.evil.com" https://www.login.chase/login?id=DEADBEEF/.evil.com" wouldn't go to evil.com, it would go to login.chase. "chase" is the TLD of that URI. Unless you're doing something super clever with characters that I'm not understand, that's not how urls work. ".evil.com" is clearly part of the query parameter.
- notriddle 8y agoAssuming they're not doing anything weird with Unicode, the evil pi is probably running its own DNS server, intercepting the traffic intended for normal DNS, and basically creating its own TLD the same way you would normally do localdomain. The evil.com part is redundant.
- SamBam 8y agoSure, that's a totally different scenario than tricky-looking urls.
- closetohome 8y agoThis seems...a little unnecessarily pedantic. It's an example of a well-known URL obfuscation technique -- we all understood what he meant.