Re:HTTPS is more secure, so why isn't the Web using it?
by kinofcain on Sunday March 20, 2011 @11:35PM
(#2348334)
Sort of. Twitter and Facebook still serve their home pages as HTTP and provide a login form that posts over HTTPS.
The problem is that I can do a MITM attack on the unsecured home page and put my own script in there that siphons off the user's password when they click the submit button.
So the HTTPS-posting form prevents the eavesdropping case, but not the man-in-the-middle case.
That's how the Tunisian government was harvesting their citizen's facebook logins:
The problem is that I can do a MITM attack on the unsecured home page and put my own script in there that siphons off the user's password when they click the submit button.
So the HTTPS-posting form prevents the eavesdropping case, but not the man-in-the-middle case.
That's how the Tunisian government was harvesting their citizen's facebook logins:
http://www.thehackernews.com/2011/03/exposure-how-does-tunis...