Re: SSL is not about encryption
by S_A_P on Saturday August 04, 2012 @11:49PM
(#4340523)
He is both right and wrong IMO. Ssl is about encrypted communication to and from the server, but the cerrificate also means that you are sending your data to a trusted authority, and the people are who they say they are. I think the real issue is that the switch from http -> https can be a security hole and the safest bet is to use ssl before you ever start entering credentials.
[ Parent
| on HN ]
It's always good practice to type in the https. It's not to difficult to stop the redirect from http => https.
Re: SSL is not about encryption
by zaptheimpaler on Sunday August 05, 2012 @01:52AM
(#4340741)
If the server redirects from HTTP to HTTPS, how is it possible to stop it?
MITM attack. If your on the same networking and the router isn't configured to block ARPing. You can proxy the traffic that filters out the redirect. Your proxy keeps the https connection open and passes back unsecured content. Public wifi can be a bad idea sometimes...