4 ms·
The guy apparently sells the SSL for an account upgrade[1], which IMHO is kinda bad practice. The SSL is the only thing keeping away low and average level attac
by atmosx 12y ago
The guy apparently sells the SSL for an account upgrade[1], which IMHO is kinda bad practice. The SSL is the only thing keeping away low and average level attacks easily.
> The attacker doesn't seem to be after passwords (they probably have some of them now). We get less than 1 user of 42K complaining about their account being hijacked every 3 months.
Hm, I wonder how many of the 42k users have paid for an upgrade. I always had the feeling that many services would have a considerable amount of users/clients if they had a counter-part running on TOR and accepting bitcoins (or any alt-coin).
[1] http://sigaintevyh2rzvw.onion/upgrade.html http://sigaintevyh2rzvw.onion/upgrade.html
- fabulist 12y ago> The SSL is the only thing keeping away low and average level attacks easily. The password is meant to authenticate the user to the server; the user is meant to authenticate to other users through the use of PGP. In theory it shouldn't be too big a deal to lose control of your password, because your emails should all be encrypted. (Though theres certainly a lot of metadata that someone with your password could glean that you'd much rather they didn't.)
- Buge 12y agoThe MITM could insert malicious javascript, or delete all your emails. And PGP doesn't encrypt the subject.
- deleted 12y ago[deleted]