News for hackers. Stuff that matters.

A comment on Mmm, Pi-hole. Parent comment

Re:Mmm, Pi-hole by cremp on Wednesday September 26, 2018 @09:42AM (#18075806)
> resources don't use SSL

Huh? DNS is hit even if the site is SSL. Unless the site has HSTS, and you've got to the site before; DNS poisoning is very much doable.

[ Parent | on HN ]
Re:Mmm, Pi-hole by emilecantin on Wednesday September 26, 2018 @10:58AM (#18076588)
Yes, but the hijacker will still need to present a valid cert for that domain, which is much harder.
[ Parent | on HN ]
Re:Mmm, Pi-hole by filleokus on Wednesday September 26, 2018 @10:49AM (#18076486)
How would the attacker do anything useful with a SSL connection attempt? They can either send the real certificate, and then not be able to decrypt the data, or send a self-signed cert which the OS/browser wouldn't trust?

Are you thinking of some downgrade attack vector?

[ Parent | on HN ]