3 ms·
Which is why everyone needs to learn about HSTS (my new favorite thing). There's room for a stripping attack upon first connecting and being redirected from htt
by bpatrianakos 14y ago
Which is why everyone needs to learn about HSTS (my new favorite thing). There's room for a stripping attack upon first connecting and being redirected from http to https but from then on you've mitigated most of the problem.
- kyrra 14y agoYou use webmitm[1] or ettercap[2] to get the traffic. Sure users will get a cert warning, but you are going to at least catch a few people that click through it. [1] http://manned.org/webmitm/8187425a http://manned.org/webmitm/8187425a [2] http://samiux.blogspot.com/2011/05/howto-sniffing-ssl-with-ettercap-on.html http://samiux.blogspot.com/2011/05/howto-sniffing-ssl-with-e...
- bpatrianakos 14y agoWell done, sir. Even so, I think once a user is shown a cert warning it becomes their problem, not the site owner's(in the sense of who's responsible that is). When it comes to security, everyone has their part to play.
- sophacles 14y agoAmusingly the general classes of "users who leave default passwords" and "users who click through a warning" are going to have a big intersection.