3 ms·
If your TLS connection has been MITM’d, you have much bigger problems than your unique randomly generated password being sniffed out.
by masklinn 3y ago
If your TLS connection has been MITM’d, you have much bigger problems than your unique randomly generated password being sniffed out.
- hal0x2328 3y agoIt's very easy to fall prey to an Evilginx or similar AITM phishing attack. Passkeys or TLS client certificates are the only guaranteed defense. Relying on the user noticing the different domain or the lack of autofill by the password manager, not so much.
- thinkharderdev 3y agoIt is not required that your connection has been MITM'd. The service you are authenticating can accidentally log the plaintext password, they can store it with an insufficiently secure hash function or not salt it. A malicious browser extension can scrape it directly from the input form. Etc, etc, etc. Passwords are reasonably secure since we've been using them for a long time but there is in fact a huge chain of trust required to keep them secure and links in that chain frequently break.
- aragilar 3y agoIf the service is like that, then I'm not sure being able to log in as you is a major issue...