14 ms·
facepalm Security company learns that HTTP MITM + cache poisoning is a thing that exists. (Edit: If it wasn't obvious, 301's are a common and well known form of
by dsl 13y ago
facepalm Security company learns that HTTP MITM + cache poisoning is a thing that exists. (Edit: If it wasn't obvious, 301's are a common and well known form of cache poisoning in this scenario)
Next I bet they will discover that you can pretend to be anyone you want in e-mail!
- theboss 13y agoYeah, I does sound like that but it also says persistently DNS poisoning or ARP poisoning isn't very persistent. So there COULD be something here...but I don't think so In my experience, most mobile apps use cert pinning or regular ol https. Only a few that I have seen actually use http. The biggest thing mobile apps do is client-side checks instead of server-side, since an assumption of network connectivity can't be made. It's pretty funny the types of things you'll find. Anyways... edit: Oh wow. I watched the video. That's embarrassing. "We haven't done a responsible disclosure because everyone knows HTTP is just like that"