3 ms·
In the case of DDG, that would be difficult. DDG uses SSL. If you make a mistake and type "duckduckgo.com" instead of "https://duckduckgo.com" https://duckduc
by adamtj 13y ago
In the case of DDG, that would be difficult. DDG uses SSL. If you make a mistake and type "duckduckgo.com" instead of "https://duckduckgo.com" https://duckduckgo.com", it will automatically redirect you to the secure page. Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL; however, that's tricky enough that its hard to imagine anyone pulling it off without ever being noticed.
- jackpirate 13y ago>Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL As long as the SSL cert isn't compromised, I don't see how this is possible.
- betterunix 13y agohttp://www.wired.com/threatlevel/2010/03/packet-forensics/ http://www.wired.com/threatlevel/2010/03/packet-forensics/
- icebraining 13y agoThey don't need the existing SSL cert. The "beauty" of SSL is that they can use a cert generated by any CA trusted by your browser - or even a second one from the same CA -, even if there's already a cert issued by one.
- lurkinggrue 13y agoYou are assuming they are looking exactly at search requests. Email is unencrypted and so is DNS. The rest they store in case they can break it later. They were doing this in 2007 at AT&T Worldcom I expect it only got better over the past 6 years.
- enoch_r 13y agoThe initial request/redirect response is insecure. So a MITM can intercept the redirect response and replace it with his own content. That content could be, for example, a 200 response status and HTML pulled from the attacker's HTTPS connection to the target site. So rather than being redirected to a secure connection, I happily communicate with the attacker instead.
- jackpirate 13y agoBut a redirect would change the status bar, right? So presumably it would still be pretty noticeable.
- jiggy2011 13y agoIf you have an hour to kill. http://www.youtube.com/watch?v=MFol6IMbZ7Y http://www.youtube.com/watch?v=MFol6IMbZ7Y
- magicalist 13y agoHSTS allows a site to indicate that in the future it should always be loaded over a secure connection, so you only have an interceptable connection the very first time you visit that site. Both Firefox and Chrome allow sites to add themselves to a list to "preload" HSTS enforcement, so even that initial connection which is man-in-the-middle-able doesn't happen. I don't see them in the current lists, so DDG should contact Mozilla and Google to get added to their preloaded HSTS lists[1][2] so all connections will automatically happen only over HTTPS. [1] http://dev.chromium.org/sts http://dev.chromium.org/sts [2] https://blog.mozilla.org/security/2012/11/01/preloading-hsts/ https://blog.mozilla.org/security/2012/11/01/preloading-hsts...