44 ms·
Do you really think that Google are going to hide their https signals? If anything, hiding the URL gives phishers less to use. So marlinspike demonstrated that
by etcet 16y ago
Do you really think that Google are going to hide their https signals? If anything, hiding the URL gives phishers less to use. So marlinspike demonstrated that you can 'spoof' "https:// https:// and fake a secure looking favicon. But can you spoof the browser detecting a secure connection and then turning the page tab bright green? I don't know how they are going to do it but I bet their positive feedback signals are going to be strong and very hard to spoof.
- burgerbrain 16y ago"But can you spoof the browser detecting a secure connection and then turning the page tab bright green?" The important part of what Marlinspike showed is that you don't have to. He ran his setup on a Tor exit node, the users of which are presumably more security minded than the rest of the general population, and not a single user balked at the lack of positive feedback. HSTS is a real solution, but not a scalable one.