5 ms·
>The sslstrip problem seems impossible to make secure I just do a 301 redirect to HTTPS on any requests that hit port 80. What makes that insecure?
by notatoad 12y ago
>The sslstrip problem seems impossible to make secure
I just do a 301 redirect to HTTPS on any requests that hit port 80. What makes that insecure?
- jimktrains2 12y agoA proxy could make the secure connection to the server and then feed the client an insecure one. If the client has visited the server previously and obtained an HSTS header, it'll refuse to connect to make an insecure connection.
- xorcist 12y agoIt's not secure against traffic hijacking, where a malicious server would serve plaintext to the client and the average user would be none the wiser (no broken padlock).
- notatoad 12y agooh, of course. that makes sense. thanks.