4 ms·
The reason is that to achieve true security, they go hand in hand. Without identity verification, you can simply perform a MITM attack (decrypt connection from
by jevinskie 16y ago
The reason is that to achieve true security, they go hand in hand. Without identity verification, you can simply perform a MITM attack (decrypt connection from client, re-encrypt when talking to the server). Firesheep showed MITM over HTTP to be trivially easy. Modifying Firesheep to do the same MITM attacks over HTTPS with self-signed certificates would be equally easy.
- jedsmith 16y ago> Firesheep showed MITM over HTTP to be trivially easy. Firesheep does not perform MITM attacks (the media made this mistake too). It catches sessions out of the air and impersonates them, which is session hijacking. As you wrote yourself, a man in the middle attack makes the victim think he is communicating with the far end; Firesheep doesn't involve the victim except to catch his packets.