3 ms·
Assuming that the site you're using over HTTPS is: 1.) Not vulnerable to any CSRF flaws 2.) Uses Strict-Transport-Security 3.) Uses cookies with the "sec
by mike-cardwell 13y ago
Assuming that the site you're using over HTTPS is:
1.) Not vulnerable to any CSRF flaws
2.) Uses Strict-Transport-Security
3.) Uses cookies with the "secure" flag set
If any of those conditions are not met, then no, HTTPS over open wi-fi is not trustworthy.
- gohrt 13y agoCSRF has nothing much to due with wifi in particular, unless an HTTPS page is loading HTTP content, and a DNS hijacker is MITMing HTTP content.
- mike-cardwell 13y agoIf your site has a CSRF flaw, then a CSRF attack can be launched against it by a MITM as soon as you access any other HTTP site. So it's best to use a trusted network if the HTTPS site you're accessing has CSRF flaws. That was my point.