News for hackers. Stuff that matters.

A comment on Ask HN: How bad is it to use a self-signed SSL certificate?. Parent comment

Re:Ask HN: How bad is it to use a self-signed SSL certificate? by pbreit on Saturday May 31, 2014 @12:27PM (#7826412)
What could be achieved with a MitM attack on an information-only site?
[ Parent | on HN ]
Re:Ask HN: How bad is it to use a self-signed SSL certificate? by MichaelGG on Saturday May 31, 2014 @04:13PM (#7827113)
Finding out what someone is interested in. Search queries or specific articles. Determining their browser information.

If the site is particularly trusted (say, a news site), misleading users into trusting another party. If CNN ran an article about how adding some SSL cert to your trust store would make YouTube faster, a lot of people would do it.

Or you could directly attack the user by providing false information.

[ Parent | on HN ]