Re:HTTPS is more secure, so why isn't the Web using it?
by jevinskie on Sunday March 20, 2011 @11:09PM
(#2348247)
The reason is that to achieve true security, they go hand in hand. Without identity verification, you can simply perform a MITM attack (decrypt connection from client, re-encrypt when talking to the server). Firesheep showed MITM over HTTP to be trivially easy. Modifying Firesheep to do the same MITM attacks over HTTPS with self-signed certificates would be equally easy.
[ Parent
| on HN ]
Re:HTTPS is more secure, so why isn't the Web using it?
by jedsmith on Sunday March 20, 2011 @11:18PM
(#2348280)
> Firesheep showed MITM over HTTP to be trivially easy.
Firesheep does not perform MITM attacks (the media made this mistake too). It catches sessions out of the air and impersonates them, which is session hijacking.
As you wrote yourself, a man in the middle attack makes the victim think he is communicating with the far end; Firesheep doesn't involve the victim except to catch his packets.