News for hackers. Stuff that matters.

A comment on Here’s Why Public Wifi Is a Public Health Hazard.

Re:Here’s Why Public Wifi Is a Public Health Hazard by Cpoll on Thursday December 24, 2015 @12:09PM (#10788784)
>He asks me to go to Live.com (the Microsoft email site) and enter a random username and password. A few seconds later, the information I just typed appears on his screen. “Now I have the login details of your email account,” Slotboom says. “The first thing I would do is change the password of your account and indicate to other services you use that I have forgotten my password.

What's happening here? The author's browser would report that the connection is un-certified, and that would be a red flag if the author had checked, no?

Would there be any demand for a service that checks if a website should have a valid cert? Would it make sense to have this built into the browser?

[ Parent | on HN ]
Re:Here’s Why Public Wifi Is a Public Health Hazard by occamrazor on Thursday December 24, 2015 @01:17PM (#10789061)
Chrome has certificate pinning and HSTS, making this kind of attack impossible by a MITM.

It is curious that the only serious vulnerability described in the article lacks any technical details.

[ Parent | on HN ]
Re:Here’s Why Public Wifi Is a Public Health Hazard by throwastone on Thursday December 24, 2015 @12:33PM (#10788880)
The author goes on to describe DNS spoofing in the following paragraph. Perhaps this was used for the live.com attack. He even says, "Within 20 minutes he’s obtained the login details, including passwords for my Live.com, SNS Bank, Facebook, and DigiD accounts."
[ Parent | on HN ]
Re:Here’s Why Public Wifi Is a Public Health Hazard by Piskvorrr on Wednesday December 30, 2015 @09:08AM (#10812073)
Even with spoofed DNS, the HTTPS certificates would not match (J. Random Hacker is unlikely to lug around a compromised, trusted root CA certificate, much less show it off to a passerby).
[ Parent | on HN ]