3 ms·
Great analysis. Interesting 10 times as many requests against 443 than 80. I wouldn't expect that. (of course it doesn't mean it's all HTTPS but still)
by yread 13y ago
Great analysis. Interesting 10 times as many requests against 443 than 80. I wouldn't expect that. (of course it doesn't mean it's all HTTPS but still)
- slashdotaccount 13y agoUnfortunately the author didn't use mitmproxy (or sslstrip).
- eli 13y agoOne would hope sslstrip would not work against an app!
- jiayo 13y agoYou'd be surprised how much code out there "uses SSL" but to get it to "just work", it outright ignores things like DN checking, certificate expiry, even chain verification. It's on the faulty premise that encryption is the only thing that's important.