News for hackers. Stuff that matters.

A comment on LeakyX, a vulnerability that Apple and Microsoft have known about for years. Parent comment

Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by ricardobeat on Saturday September 23, 2017 @06:54PM (#15322225)
Same as DNS hijacking any website where the user has an account. What's the security issue in Exchange here?
[ Parent | on HN ]
Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by ktta on Saturday September 23, 2017 @09:25PM (#15322743)
DNS hijacking shouldn't result in credential compromise if TLS is implemented properly. TLS is implemented here, but incorrectly (hold on) because the credentials are sent as soon as the validation fails and a dialog shows up (about the invalid certificate). So the user will realize they are being MITMed but the credentials are sent even if they don't continue.

https://news.ycombinator.com/item?id=15322740

[ Parent | on HN ]