3 ms·
MITM'd == not passive, so can inject malicious js.
by seemslegit 7y ago
MITM'd == not passive, so can inject malicious js.
- smolder 7y agoGood point, but what's the relative difficulty of recording all your MITM'd TLS traffic org-wide as plaintext versus attacking specific sites with custom JS to exflitrate JS encryption keys? It's additional friction for lazy spying, mostly, and for a situation where TLS traffic is passively snooped and broken by other means than MITM.