Re:82% of People Say They Connect to Any Free WiFi That’s Av...
by _-___________-_ on Thursday August 01, 2019 @12:30PM
(#20585448)
No, attacker can just MITM your DNS traffic and synthesise lots of typosquats of their own. They can't do the actual bigbank.com or facebook.com domains thanks to various protections like HSTS, but typos are unlikely to have HSTS preload etc, and they can have vast numbers of them at basically zero cost.
“You typo an address” — well, then, sure. But how did you manage to typo an address that’s exactly where the attacker put their stuff, and the bank didn’t catch them?
Now, if you meant “type”, then NO. Unless the browser includes a certificate authority that gave out a certificate to the attacker for that domain, the browser will flag this “valid” SSL cert.