News for hackers. Stuff that matters.

A comment on Hijack of Amazon’s domain service used to reroute web traffic for two hours. Parent comment

Re:Hijack of Amazon’s domain service used to reroute web tra... by C4K3 on Tuesday April 24, 2018 @06:20PM (#16917167)
No they wouldn't, without HSTS a bad actor (public wifi) could just do an SSL strip attack. Sure, observant users would notice that the page isn't over https, and with browsers adding warnings on all http pages, that'll become more obvious, but it's still not something most people notice.

Are you thinking of HPKP?

[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by tekstar on Wednesday April 25, 2018 @09:41AM (#16921404)
ah, yes, I was confusing HSTS with HPKP.

Now I need to re-read the whole thread with this context. Thanks for the correction!

[ Parent | on HN ]