4 ms·
The software is vulnerable to a MITM attack. There's no reason it should be.
by MaxBarraclough 7y ago
The software is vulnerable to a MITM attack. There's no reason it should be.
- vageli 7y agoFrankly, I'm surprised the site didn't respond with a 302 redirect to SSL to avoid this kind of thing entirely (versus relying on client to specify the correct protocol).
- MaxBarraclough 7y agoI don't follow. That's quite obviously not a proper fix.
- cwillu 7y agoThe client _must_ use the correct protocol, that's precisely the issue. An insecure request to switch to a secure protocol would just be elided by an attacker. If the client is coded to expect such a switch and fail if it doesn't happen, that client is at best implementing a more complicated, ad-hoc secure protocol.