Re:API Shouldn't Redirect HTTP to HTTPS
by tsimionescu on Tuesday May 28, 2024 @06:55PM
(#40506465)
I don't think people would consider 1 or 3 to be MITM. MITM requires someone who is, well, in the middle: you connect to the MITM, and they connect to your destination. 2 is clearly a MITM.
Also, while 1 is arguably a case of "physical access", I don't think 3 is. If you have a tap in an ISP, you don't have "physical access" to any of the endpoints of the HTTP connection. Otherwise, you could say you have "physical access" to literally every machine on the internet, since there is some physical path between you and that machine.
For another example, Kubernetes started as IPv4-only, and there are still plenty of plugins that have IPv4-only features.
Also, while 1 is arguably a case of "physical access", I don't think 3 is. If you have a tap in an ISP, you don't have "physical access" to any of the endpoints of the HTTP connection. Otherwise, you could say you have "physical access" to literally every machine on the internet, since there is some physical path between you and that machine.
For another example, Kubernetes started as IPv4-only, and there are still plenty of plugins that have IPv4-only features.