4 ms·
HTTPS would tend to rob you of anything interesting, though.
by redthrowaway 14y ago
HTTPS would tend to rob you of anything interesting, though.
- natermer 14y agolol. No. If SSL error is standing between a man and his porn, which do you think he will do? Click 'ok I understand' to continue or give up and go take a nap?
- schoen 14y agoFor many users and many sites, SSL stripping is still quite a significant vulnerability. http://www.thoughtcrime.org/software/sslstrip/ http://www.thoughtcrime.org/software/sslstrip/ Assuming DNSSEC isn't in use, controlling someone's DNS settings is enough to carry out an SSL stripping attack!
- bpatrianakos 14y agoWhich is why everyone needs to learn about HSTS (my new favorite thing). There's room for a stripping attack upon first connecting and being redirected from http to https but from then on you've mitigated most of the problem.
- kyrra 14y agoYou use webmitm[1] or ettercap[2] to get the traffic. Sure users will get a cert warning, but you are going to at least catch a few people that click through it. [1] http://manned.org/webmitm/8187425a http://manned.org/webmitm/8187425a [2] http://samiux.blogspot.com/2011/05/howto-sniffing-ssl-with-ettercap-on.html http://samiux.blogspot.com/2011/05/howto-sniffing-ssl-with-e...
- bpatrianakos 14y agoWell done, sir. Even so, I think once a user is shown a cert warning it becomes their problem, not the site owner's(in the sense of who's responsible that is). When it comes to security, everyone has their part to play.
- sophacles 14y agoAmusingly the general classes of "users who leave default passwords" and "users who click through a warning" are going to have a big intersection.
- darkarmani 14y agoOnly if anyone actually looks at the SSL cert warnings instead of just clicking through them.