33 ms·
What stops anyone doing that on most e-commerce sites? If I go to Amazon.co.uk, my basket is served over HTTP. A man in the middle attack could rewrite that a
by martin-adams 14y ago
What stops anyone doing that on most e-commerce sites? If I go to Amazon.co.uk, my basket is served over HTTP. A man in the middle attack could rewrite that and get me to log into a fake site that looks legit.
Of course, the obvious answer is to run everything over HTTPS, but I'm not sure I understand the difference in what Amazon do and this demo page.
- danenania 14y agoYeah, even displaying a login form on a non-https page is a big hole for mitm attacks, but most of the web can't be bothered.
- delinka 14y agoEven displaying any page over non-HTTPS and linking to a login page is a big hole for MITM attacks. Who's to say the login page is really on the correct server? As long at the little lock looks green (does Joe Public even pay attention?), it's safe ... right?
- chacham15 14y agoThe idea is that hopefully the page where you enter cc and other personal info is https. This way, the user can look at the url and see, is this https to the site that I think it should be? If yes, enter personal info, else leave. That methodology works even if the main site is not https. An attacker can only at best replicate the page without https. I would like to believe that everyone follows that methodology, but I have more experience that that. So for now, I like to believe that at least people who visit hn follow that methodology.