5 ms·
Yes. Visitors to the site are vulnerable to Man in the Middle (MitM) attacks, IF they click past the warning (which many people do)
by sciencejerk 7mo ago
Yes. Visitors to the site are vulnerable to Man in the Middle (MitM) attacks, IF they click past the warning (which many people do)
- deleted 7mo ago[deleted]
- belter 7mo agoAn expired certificate alone doesn't enable a MITM attack.
- LadyCailin 7mo agoThat’s not true. The encryption still works as well as it did 3 days ago, and doesn’t care if the certificate is expired.
- russell_h 7mo agoI think the argument would go that if people are clicking through certificate errors and you're in a position to MITM their traffic, you can just serve them a different certificate and they'll click through the error without noticing or understanding the specifics.
- sciencejerk 7mo agoFair point, but I think the situation is a bit more complicated when a user "needs the site for work", or something urgent. You might have smart cautious users that feel like they have no choice but to proceed and click through the warnings since the site is most likely still legitimate
- eli 7mo agoIMHO host mismatch is more serious than expired cert and browsers should treat it as such
- austin-cheney 7mo agoThat could happen either way regardless of expiry. The only reason for an expiration date is to force site owners to cycle their certs at regular intervals to defeat the long time it takes to brute force a successful forgery.
- f_devd 7mo agoI think they mean that a non-observant visitor cannot tell the difference between both situations
- LeifCarrotson 7mo agoIt's true that the expiration doesn't mean the encryption no longer works, but if the user is under a MITM attack and is presented by their browser with a warning that the certificate is invalid, then the encryption will still work but the encrypted communication will be happening with the wrong party. I don't trust the average user to inspect the certificate and understand the reason for the browser's rejection.
- School-Cotton 7mo agoOkay, but that’s not what was being asked. OP, someone who presumably understands the difference between a totally invalid cert and an expired one, was asking specifically whether clicking through the latter is dangerous.
- wang_li 7mo agoIt's entirely the second paragraph and not part of certificate expiration, in and of itself, lends to being MITM. Firefox tells me what the problem is, expired, wrong name, etc. So, it's not just saying "oh no, something is wrong." I can tell what is wrong before I choose to proceed.
- hamdingers 7mo agoThis is an infohazard. True information that can cause harm or enable some agent to cause harm. Telling people not to worry about expired cert warnings makes them vulnerable to a variety of attacks.
- KaiserPro 7mo agoIf you're ignoring certificate warnings, then you'll ignore mismatching domain warnings. More over, if your org's browser setting allow you to override the warnings, thast also pretty bad for anything other than a small subset of your team.
- ktm5j 7mo agoThat's not what man in the middle attacks are about.. it's not about the encryption, it's about verifying that you really know who you're talking to.