3 ms·

Sounds like we were always on the same page... I never said an attacker can't do this. I'm saying an attacker can't do a s/https/http and have a user end up at

Sounds like we were always on the same page... I never said an attacker can't do this. I'm saying an attacker can't do a s/https/http and have a user end up at an HTTP login page, where the attacker can sniff credentials.

nitrogen 12y ago
The attacker operates the http login page as a MITM. If they can mangle http traffic, they can run a full MITM.
coderzach 12y ago
yes they can. They make the secure login connection, and terminate it themselves, then route what they received along to the user with s/https/http.