News for hackers. Stuff that matters.

A comment on Identifying Airtel middleboxes that censor HTTPS traffic. Parent comment

Re:Identifying Airtel middleboxes that censor HTTPS traffic by Tepix on Tuesday September 29, 2020 @09:33AM (#24627605)
How do they inject stuff into HTTPS pages?
[ Parent | on HN ]
Re:Identifying Airtel middleboxes that censor HTTPS traffic by eggsnbacon1 on Tuesday September 29, 2020 @01:32PM (#24630615)
Unless the site uses certificate pinning its possible to do a downgrade attack that forces browser off of HTTPS. The extension HTTPS Everywhere is a stopgap against this
[ Parent | on HN ]
Re:Identifying Airtel middleboxes that censor HTTPS traffic by walrus01 on Tuesday September 29, 2020 @10:13AM (#24628041)
things that do stuff like this can't, they try whatever tricks are possible to push javascript or redirects to send the client browser to something non https, on port 80
[ Parent | on HN ]
Re:Identifying Airtel middleboxes that censor HTTPS traffic by kzrdude on Tuesday September 29, 2020 @09:40AM (#24627667)
it does say "Not secure" for the https info, so I guess they intercept the request
[ Parent | on HN ]
Re:Identifying Airtel middleboxes that censor HTTPS traffic by disiplus on Tuesday September 29, 2020 @10:49AM (#24628481)
yeah but not secure is regular http. on https they cannot do that without triggering a browser warning.
[ Parent | on HN ]