3 ms·
> then the authentication token they send to the real google will have the correct signature, but the wrong domain name. So a domain hijacking attack is the on
by sofixa 4y ago
> then the authentication token they send to the real google will have the correct signature, but the wrong domain name.
So a domain hijacking attack is the only possibility? (and made drastically harder for serious websites with Certificate pinning)
- red_admiral 4y agoWell, if you can get the user to install malware on their computer ("you must update your flash plugin to continue ...") then you could potentially fiddle with their certificate store, or many other things.
- choko 4y agoThere is not a solid consensus on cert pinning, and for good reason. https://www.digicert.com/blog/certificate-pinning-what-is-certificate-pinning https://www.digicert.com/blog/certificate-pinning-what-is-ce...