3 ms·
Https doesn't stop them, mitm solves the problem for them. I'm sure you have already seen it, if you travel a lot. It's bad idea to redirect http to https. It'
by Sami_Lehtinen 13y ago
Https doesn't stop them, mitm solves the problem for them. I'm sure you have already seen it, if you travel a lot.
It's bad idea to redirect http to https. It's much better to drop http support completely. Redirection weakens security.
- flyt 13y agoThis is why we have HSTS.
- Sami_Lehtinen 13y agoAnd secure cookies, yes. But as we have seen, those things simply do not work out. As the usual layered security approach, it's good idea not to provide HTTP service at all, so redirection isn't hiding failures to use HTTPS.
- bad_user 13y agoYou can't MITM without the browser giving huge warnings about how the connection is not secure, therefore I noticed that networks that do this avoid doing it for HTTPS connections. The only way you can MITM successfully without the user noticing is if you control the browser used (e.g. Nokia).
- deleted 13y ago[deleted]