3 ms·

A MitM (e.g. an untrusted WiFi network) could replace a download by a malicious version.

• huuuz 5y ago
  In that case the html text of the page could be replaced by the attacker so the download link points to an https link.
  • MauranKilom 5y ago
    At least it can't be an HTTPS link to the same domain. But even if a user notices this, it's not worth a lot in the age of CDNs on weirdly abbreviated separate domains...
  • Semaphor 5y ago
    It’s for https sites that link http downloads.
  • peckrob 5y ago
    This absolutely can happen. A few years ago I discovered [0] Atlanta Airport's public WiFi was injecting ads into non-https pages. A malicious actor changing download links is not a far fetched possibility. [0] https://twitter.com/codelemur/status/1052285395575164929?s=20 https://twitter.com/codelemur/status/1052285395575164929?s=2...
  • falcolas 5y ago
    Firefox already aggressively alerts if you're not on an SSL secured page. They didn't for downloads.