5 ms·
According to the following quote, the problem seems avoidable if you have an https login page to begin with (happily something I was planning on): "Marlinspike
by timf 18y ago
According to the following quote, the problem seems avoidable if you have an https login page to begin with (happily something I was planning on):
"Marlinspike said SSLstrip is able to work because the vast majority of sites that use SSL begin by showing visitors an unencrypted page"
- mooism2 18y agoIf your users get to your https login page by following a link from your http front page, I think he can rewrite the link in the front page to be http, and the attack can still happen. As you say in your other comment, we need more details.
- gojomo 18y agoThe user also has to navigate with careful intent to the proper HTTPS entry point. (Counting on the site's redirect mechanism to bounce you from any plain-HTTP URL to the HTTPS login page is just as vulnerable as a plain-HTTP login form.)
- timf 18y agoThat sucks. This URL will even be a top level domain for me for other reasons. Your point may still apply because when someone enters the domain name without typing "https", that's also a redirect (albeit a 301 redirect, I have no idea if that would make a difference). This is such a nasty prospect in general because such a tiny fraction of users would take time to type in URLs...