3 ms·
The download itself is over https, but the page where you click the download link is http. If someone were going to MITM the executable, they can just MITM the
by wlesieutre 4y ago
The download itself is over https, but the page where you click the download link is http.
If someone were going to MITM the executable, they can just MITM the download page instead and point the download button to their own server with the bad executable.
- chrisweekly 4y agoExactly; this is why mixed content is problematic, and the r'aison d'etre for HTTPS Everywhere.