News for hackers. Stuff that matters.

A comment on WA man set up fake free WiFi at Australian airports and on flights,police allege. Parent comment

Re:WA man set up fake free WiFi at Australian airports and o... by omegabravo on Friday June 28, 2024 @07:41AM (#40819648)
How would they have got a proper CA signed cert for a domain they don't own?

HSTS will only make a HTTPS connection. Without the valid certificate, they should get a warning.

The only way this "works" is if a captive portal pops up a browser to a site that looks the same like amaz0n.com. Password manager wouldn't popup, but many people don't use them.

Faking DNS also won't help with the TLS warning, they won't have the certificate.

Basically, this shouldn't be possible with HSTS.

[ Parent | on HN ]
Re:WA man set up fake free WiFi at Australian airports and o... by rahimnathwani on Friday June 28, 2024 @07:46AM (#40819679)
> How would they have got a proper CA signed cert for a domain they don't own?

No need. People probably don't look closely at the domain name.

[ Parent | on HN ]