3 ms·
That's not their point. An unsecured site can easily be spoofed; a secured one would require either getting intel's ssl cert or convincing users to click throu
by thedufer 14y ago
That's not their point. An unsecured site can easily be spoofed; a secured one would require either getting intel's ssl cert or convincing users to click through a big "dont trust this site" page in their browser.
The fact that they don't send the password just means that a MITM needs to put in slightly more work.
- tbrownaw 14y agoa secured one would require either getting intel's ssl cert or convincing users to click through a big "dont trust this site" page Or breaking into their DNS registrar and getting your own cert for their domain, or breaking into any one of the many many dozens of CAs that most browsers trust...
- thedufer 14y agoFair enough. Those are still generally on the order of very difficult, and certainly more difficult than doing none of those things at all.