3 ms·
Would the third part not need to serve a valid cert to do this? I'd like to hear if it is easier or harder to do with http vs https
by netizen-9748 6y ago
Would the third part not need to serve a valid cert to do this? I'd like to hear if it is easier or harder to do with http vs https
- yjftsjthsd-h 6y agoYes, you'd need either a valid cert, or for the user to click through the big scary warning to accept the invalid (or self-signed) cert, either of which raises the bar way above unencrypted HTTP, where this attack is trivial (ex. https://en.wikipedia.org/wiki/Firesheep https://en.wikipedia.org/wiki/Firesheep and https://stopthecap.com/2013/04/03/isp-crams-its-own-ads-all-over-your-capped-internet-connection-banners-block-your-view/ https://stopthecap.com/2013/04/03/isp-crams-its-own-ads-all-... )