LeakyX, a vulnerability that Apple and Microsoft have known about for years

Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by DiThi on Saturday September 23, 2017 @07:36PM (#15322366)

Because setting up a let's encrypt certificate is almost as easy as to making a self signed one. We're talking about typosquatting, having a completely valid domain of your own that is the same as someone else's but with a typo.

Edit: From what it is said in another comment, it's not exactly about typosquatting, but the author expresses the problem very badly. It seems credentials are sent to the domain before the certificate is checked. So one is vulnerable to DNS spoofing in e.g. a public wifi.

[ Parent | on HN ]

Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by lesserknowndan on Saturday September 23, 2017 @07:59PM (#15322455)

I'm not sure how they can be more clear than the first sentence, "So back in February I discovered that an iPhone was sending usernames and passwords unencrypted to an exchange server even when SSL was enabled."

Are you saying the later text contradicted this statement?

[ Parent | on HN ]

Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by ktta on Saturday September 23, 2017 @09:59PM (#15322846)

It was a bit confusing since he talks about typosquatting. He also talks about credentials sent unencrypted when SSL is off, which further makes everyone question the validity of his claims.

But he did find a vulnerability in iOS's Mail app.

[ Parent | on HN ]