6 ms·
The attacker could just proxy the plaintext by issuing HTTPS requests to the backend server instead of issuing HTTP requests. Also, what threat model does SSL
by hedora 3y ago
The attacker could just proxy the plaintext by issuing HTTPS requests to the backend server instead of issuing HTTP requests.
Also, what threat model does SSL protect against that doesn’t involve an attacker in control of a hop in the path between the client and the server?
- woodruffw 3y ago> The attacker could just proxy the plaintext by issuing HTTPS requests to the backend server instead of issuing HTTP requests. Yes, assuming the target has HTTPS. The context I originally assumed was one where the target doesn’t yet have a certificate and is using ACME to obtain one. Separate from that, I agree that an attacker with the ability to demonstrate domain control can subvert issuance in a way that only CT, stapling, and other “post hoc” methods can detect.