4 ms·

"... was stealing usernames and passwords from common sites like Google Mail and Facebook". Gmail always opens with SSL for me. Didn't Google make this the def

"... was stealing usernames and passwords from common sites like Google Mail and Facebook". Gmail always opens with SSL for me. Didn't Google make this the default after Chinagate?

jawher 16y ago
Nope, at the time of these incidents, I could request GMail's login page over HTTP, though the login form action pointed to a HTTPS url. This was fixed a day or two later though. Same with Yahoo.
gcb 16y ago
If you're the ISP, can't you fake ssl certs all the way down to the root? sorry if i'm being ignorant
- die_sekte 16y ago
  SSL certificates usually come with the OS or the browser. AFAIK there's no easy way for the ISP to add certificates.
  - duskwuff 16y ago
    Unless they are a government entity which is recognized as a certificate authority, or which can exert influence over one.
  - gcb 16y ago
    But there are millions of ways to provide you their version of firefox_installer.exe with the 'right' certificates.