Efficient Wi-Fi Phishing Attacks

Re:Efficient Wi-Fi Phishing Attacks by jp3141 on Thursday January 05, 2017 @07:38AM (#13326628)

How do you redirect to the phishing site, if you are currently browsing an SSL encrypted website without making it to obvious? Since you get an error message in the browser...

[ Parent | on HN ]

Re:Efficient Wi-Fi Phishing Attacks by edeirme on Thursday January 05, 2017 @07:53AM (#13326713)

That is correct. However it's trivial for a MiTM attacker to perform an SSL stripping attacks when the victim is communicating with sites that support plain HTTP.

[ Parent | on HN ]

Re:Efficient Wi-Fi Phishing Attacks by jp3141 on Thursday January 05, 2017 @08:12AM (#13326809)

even with HSTS?

[ Parent | on HN ]

Re:Efficient Wi-Fi Phishing Attacks by edeirme on Thursday January 05, 2017 @08:21AM (#13326863)

If a website employs the use of HSTS all traffic will be redirected to HTTPS, rendering the support for HTTP redundant.

[ Parent | on HN ]

Re:Efficient Wi-Fi Phishing Attacks by marichards on Thursday January 05, 2017 @07:26PM (#13332818)

Hmm, if you can control the plaintext network isn't there an NTP attack to reverse time and use old compromisable certificates or move it forward past hsts max age?

[ Parent | on HN ]