3 ms·
>Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL As long as the SSL cert isn't compromised, I d
by jackpirate 13y ago
>Unfortunately, that redirect gives a man-in-the-middle and opportunity to hijack your connection, even with SSL
As long as the SSL cert isn't compromised, I don't see how this is possible.
- betterunix 13y agohttp://www.wired.com/threatlevel/2010/03/packet-forensics/ http://www.wired.com/threatlevel/2010/03/packet-forensics/
- icebraining 13y agoThey don't need the existing SSL cert. The "beauty" of SSL is that they can use a cert generated by any CA trusted by your browser - or even a second one from the same CA -, even if there's already a cert issued by one.
- lurkinggrue 13y agoYou are assuming they are looking exactly at search requests. Email is unencrypted and so is DNS. The rest they store in case they can break it later. They were doing this in 2007 at AT&T Worldcom I expect it only got better over the past 6 years.
- enoch_r 13y agoThe initial request/redirect response is insecure. So a MITM can intercept the redirect response and replace it with his own content. That content could be, for example, a 200 response status and HTML pulled from the attacker's HTTPS connection to the target site. So rather than being redirected to a secure connection, I happily communicate with the attacker instead.
- jackpirate 13y agoBut a redirect would change the status bar, right? So presumably it would still be pretty noticeable.
- jiggy2011 13y agoIf you have an hour to kill. http://www.youtube.com/watch?v=MFol6IMbZ7Y http://www.youtube.com/watch?v=MFol6IMbZ7Y