4 ms·
Granted, it doesn't provide as much protection as a cert signed by a trusted CA - but it's still far more protection than plain HTTP, right? e.g, Firesheep woul
by smanek 15y ago
Granted, it doesn't provide as much protection as a cert signed by a trusted CA - but it's still far more protection than plain HTTP, right? e.g, Firesheep wouldn't work
I don't know if browsers do this, but in principle they could even notify the user on certificate change, so the MITM would have to be on the first connection to a site.
- jrockway 15y agoFiresheep would work. The attack is more involved than just openly sniffing packets. You need to poison the DNS cache on the victim's machine, so that facebook.com resolves to you. Or, you need to poison the ARP cache, so the victim machine thinks that you are the router. These are both easy to do, though, and once you've done that, then you are a man that's in the middle, and MITM attacks are easy under those circumstances. "ettercap" is a program to automate this technique to spy on SSH, HTTPS, etc. Works quite well.
- deleted 15y ago[deleted]
- vladd 15y agoIntroducing a "third state" for the SSL indicator, usability-wise, is very difficult. A lot of browser users don't understand SSL, and those that do have a binary understanding of the protocol: it can be used to either confirm or refute the identity of a website. It's very difficult to implement a UI for the regular users that says: "this might be a MITM attack since I cannot confirm the identity of the site but at least I can confirm that it's the same with the one that you connected with the first time".
- deleted 15y ago[deleted]
- MatthewPhillips 15y agoIt's a false sense of security, which is why they put the warning. You have no sense of security when visiting a plain http site.